CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:21 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106647 New | RA Royal Addons for Elementor | 3.8 | Oct 28 | Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision |
| CVE-2026-118276 New | A2 a2ui a2ui-project | 3.5 | Oct 28 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-57199 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers |
| CVE-2026-116775 New | RU russh Eugeny | 2.3 | Oct 27 | pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) |
| CVE-2026-116696 New | RU russh Eugeny | 3.3 | Oct 27 | russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages |
| CVE-2026-103995 New | CP CPython Python Software Foundation | 2.0 | Oct 27 | Lenient parsing of integers for response body and chunk framing |
| CVE-2026-116687 New | CK ckeditor5 ckeditor | 3.1 | Oct 27 | CKEditor: Cross-site scripting (XSS) in the engine package |
| CVE-2026-108311 New | TS Tanium Server Tanium | 2.7 | Oct 27 | Tanium addressed an insufficient logging vulnerability in Tanium Server. |
| CVE-2026-108330 New | EC Endpoint Configuration Toolset Solution Tanium | 3.6 | Oct 27 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. |
| CVE-2026-108333 New | EC Endpoint Configuration Toolset Solution Tanium | 2.5 | Oct 27 | Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. |
| CVE-2026-108331 New | EC Endpoint Configuration Toolset Solution Tanium | 3.3 | Oct 27 | Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. |
| CVE-2026-57189 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Generation Accumulation OOB Write |
| CVE-2026-57198 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Heap Buffer Overflow |
| CVE-2026-116673 New | SY systeminformation sebhildebrandt | 3.3 | Oct 27 | systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net |
| CVE-2026-67400 New | RI Richdocuments Nextcloud | 3.5 | Oct 27 | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token |
| CVE-2026-77171 New | CO Collectives Nextcloud | 3.5 | Oct 27 | A public shared collective always allowed recipients of the link to create pages |
| CVE-2026-82983 New | TA Tables Nextcloud | 3.3 | Oct 27 | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning… |
| CVE-2026-109823 New | TI tidewave tidewave-ai | 2.3 | Oct 27 | Host filesystem path disclosure via DNS rebinding |
| CVE-2026-90727 New | PD PowerProtect Data Domain Dell | 3.8 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-107590 New | QT Qt qt | 1.9 | Oct 27 | Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt |
| CVE-2026-117499 New | FA @fastify/session @fastify/session | 3.7 | Oct 27 | @fastify/session vulnerable to session revocation bypass via a logout race condition |
| CVE-2026-117539 New | SV svg-sanitizer darylldoyle | 3.5 | Oct 27 | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass |
| CVE-2026-110737 New | FL flow vaadin | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers |
| CVE-2026-18451 New | MB MBD-X12SPI SMCI | 3.1 | Oct 27 | Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token |
| CVE-2026-103325 New | TP TiendaCrypto para WooCommerce | 3.7 | Oct 27 | TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass |
| CVE-2026-110910 New | QS qs ljharb | 3.7 | Oct 27 | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection |
| CVE-2026-116640 New | HR HR-Payroll-Management-System Saruf-Ratul | 3.5 | Oct 27 | Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting |
| CVE-2026-116639 New | ON Online-Payroll-Management-System MD-MAFUJUL-HASAN | 3.5 | Oct 27 | MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting |
| CVE-2026-116556 New | AR Argilla Argilla | 2.4 | Oct 26 | Argilla TextField.vue cross site scripting |
| CVE-2026-116555 New | AR Argilla Argilla | 2.4 | Oct 26 | Argilla Sandbox.vue cross site scripting |
| CVE-2026-116554 New | AR Argilla Argilla | 3.5 | Oct 26 | Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting |
| CVE-2026-116734 New | FL flatcc dvidelabs | 3.7 | Oct 26 | flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header |
| CVE-2026-116733 New | FL flatcc dvidelabs | 3.7 | Oct 26 | flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number |
| CVE-2026-116729 New | LI libfvde libyal | 3.3 | Oct 26 | libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a |
| CVE-2026-116727 New | GB gbsplay mmitch | 3.3 | Oct 26 | gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c |
| CVE-2026-116726 New | GB gbsplay mmitch | 3.3 | Oct 26 | gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title |
| CVE-2026-116578 New | TO tornado tornadoweb | 2.1 | Oct 26 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs |
| CVE-2026-116671 New | XP Xpdf Xpdf | 2.1 | Oct 26 | Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder |
| CVE-2026-116482 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 26 | subhajitkhan online-clinic-management-system patientregistration.php cross site scripting |
| CVE-2026-57196 New | AS asterisk asterisk | 2.3 | Oct 26 | Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages |
| CVE-2026-111404 New | PR Photo Reviews for WooCommerce VillaTheme | 3.7 | Oct 26 | WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability |
| CVE-2026-116385 New | G2 Garage 24 Garage Management Software Bdtask | 3.5 | Oct 26 | Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting |
| CVE-2026-72755 New | RO Routinator NLnet Labs | 3.8 | Oct 26 | Routinator stores TA certificate in cache without validation |
| CVE-2026-82390 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver |
| CVE-2026-19742 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key |
| CVE-2026-93846 New | MA Mattermost Mattermost | 3.8 | Oct 26 | Team admin can escalate a team member's permissions via the team member roles endpoint |
| CVE-2026-116544 New | OP open5gs open5gs | 3.7 | Oct 26 | Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output |