CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 16:19 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118690 New | SI signalk-server SignalK | 9.8 | Oct 28 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |
| CVE-2026-117574 New | RH Red Hat OpenShift AI (RHOAI) Red Hat | 9.1 | Oct 28 | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization |
| CVE-2026-63190 New | FE FearlessCMS fearlessgeekmedia | 9.4 | Oct 28 | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS |
| CVE-2026-118264 New | EC echo labstack | 9.1 | Oct 28 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-103409 New | SS Session Smart Router Juniper Networks | 9.8 | Oct 28 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed |
| CVE-2026-103406 New | SS Session Smart Conductor Juniper Networks | 9.8 | Oct 28 | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. |
| CVE-2026-44179 New | XW xwiki-pro-macros xwikisas | 9.9 | Oct 28 | XWiki Pro Macros: excerpt-include title and content injection executes code |
| CVE-2026-115968 New | UM Ultimate Member Ultimate Member | 9.8 | Oct 28 | WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability |
| CVE-2026-105420 New | WF Wing FTP Server Wing Soft Technology | 9.4 | Oct 28 | Path Traversal in Wing WFTP Server leading to Remote Code Execution |
| CVE-2026-111411 New | FA FunnelKit Automations Aman | 9.3 | Oct 28 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability |
| CVE-2026-115607 New | DT DXP ToolKit Crowd Favorite | 9.3 | Oct 28 | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability |
| CVE-2026-115904 New | AP App topluyo | 9.6 | Oct 28 | Topluyo Desktop for Linux has an OS Command Injection issue |
| CVE-2026-67074 New | BA BigFix AEX HCL Software | 9.1 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-114278 New | EC Eclipse Che Eclipse Foundation | 9.8 | Oct 28 | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec |
| CVE-2026-118477 New | KA Kalifast EISGE | 9.8 | Oct 28 | KaliFast Project Management Platform ei_git_repo_url OS Command Injection |
| CVE-2026-103792 New | PD PowerProtect Data Domain Management Center Dell | 9.6 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-103799 New | PD PowerProtect Data Domain Management Center Dell | 9.6 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-112197 New | ND NoviGest Desktop App Tactis | 9.4 | Oct 28 | Missing Authentication for Critical Function in Tactis' NoviGest Desktop App |
| CVE-2026-103780 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86384 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-14571 New | FS Futurum Software User Authentication Module Futurum Software | 9.1 | Oct 28 | SQL injection (SQLi) in the user authentication module of Futurum Software |
| CVE-2026-86397 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86400 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90717 New | PD PowerProtect Data Domain Management Center Dell | 9.1 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-109218 New | CM Contact Manager kleor | 9.8 | Oct 28 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass |
| CVE-2026-103688 New | CF Checkout Files Upload for WooCommerce | 9.8 | Oct 28 | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload |
| CVE-2026-104383 New | AQ Aquila EagleCloud | 9.4 | Oct 28 | Code injection in EagleCloud Aquila on-premises version |
| CVE-2026-84999 New | PR Pie Register Premium Pie Register | 9.8 | Oct 28 | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler |
| CVE-2026-106013 New | JX Jupiter X Core artbees | 9.8 | Oct 28 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter |
| CVE-2026-110879 New | JA jackson-databind FasterXML | 9.8 | Oct 28 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) |
| CVE-2026-118312 New | CH Chrome Google | 9.6 | Oct 27 | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118309 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-118308 New | CH Chrome Google | 9.6 | Oct 27 | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118310 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-118342 New | CH Chrome Google | 9.6 | Oct 27 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118316 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118332 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-118355 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-118321 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-118340 New | CH Chrome Google | 9.6 | Oct 27 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118305 New | CH Chrome Google | 9.6 | Oct 27 | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118306 New | CH Chrome Google | 9.6 | Oct 27 | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-58256 New | GR GRR JeromeDevome | 9.1 | Oct 27 | GRR vulnerable to Remote Code Execution Via PHP Code Injection |
| CVE-2026-116692 New | ML mlflow mlflow | 9.8 | Oct 27 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules |
| CVE-2026-112352 New | SU SureLine Sunhillo Corporation | 9.1 | Oct 27 | Sunhillo SureLine Authentication Bypass via Session Cookie |
| CVE-2026-104353 New | AC Adobe Campaign Classic Adobe | 9.9 | Oct 27 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) |
| CVE-2026-105780 New | AC Adobe Campaign Classic Adobe | 9.9 | Oct 27 | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
| CVE-2026-105489 New | AC Adobe Campaign Classic Adobe | 9.9 | Oct 27 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
| CVE-2026-104350 New | AC Adobe Campaign Classic Adobe | 9.3 | Oct 27 | Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79) |
| CVE-2026-105781 New | AC Adobe Campaign Classic Adobe | 10.0 | Oct 27 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |