CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 14:17 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109823 New | TI tidewave tidewave-ai | 2.3 | Oct 27 | Host filesystem path disclosure via DNS rebinding |
| CVE-2026-90727 New | PD PowerProtect Data Domain Dell | 3.8 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-107590 New | QT Qt qt | 1.9 | Oct 27 | Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt |
| CVE-2026-117499 New | FA @fastify/session @fastify/session | 3.7 | Oct 27 | @fastify/session vulnerable to session revocation bypass via a logout race condition |
| CVE-2026-117539 New | SV svg-sanitizer darylldoyle | 3.5 | Oct 27 | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass |
| CVE-2026-110737 New | FL flow vaadin | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers |
| CVE-2026-18451 New | MB MBD-X12SPI SMCI | 3.1 | Oct 27 | Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token |
| CVE-2026-103325 New | TP TiendaCrypto para WooCommerce | 3.7 | Oct 27 | TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass |
| CVE-2026-110910 New | QS qs ljharb | 3.7 | Oct 27 | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection |
| CVE-2026-116640 New | HR HR-Payroll-Management-System Saruf-Ratul | 3.5 | Oct 27 | Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting |
| CVE-2026-116639 New | ON Online-Payroll-Management-System MD-MAFUJUL-HASAN | 3.5 | Oct 27 | MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting |
| CVE-2026-116556 New | AR Argilla Argilla | 2.4 | Oct 26 | Argilla TextField.vue cross site scripting |
| CVE-2026-116555 New | AR Argilla Argilla | 2.4 | Oct 26 | Argilla Sandbox.vue cross site scripting |
| CVE-2026-116554 New | AR Argilla Argilla | 3.5 | Oct 26 | Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting |
| CVE-2026-116734 New | FL flatcc dvidelabs | 3.7 | Oct 26 | flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header |
| CVE-2026-116733 New | FL flatcc dvidelabs | 3.7 | Oct 26 | flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number |
| CVE-2026-116729 New | LI libfvde libyal | 3.3 | Oct 26 | libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a |
| CVE-2026-116727 New | GB gbsplay mmitch | 3.3 | Oct 26 | gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c |
| CVE-2026-116726 New | GB gbsplay mmitch | 3.3 | Oct 26 | gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title |
| CVE-2026-116578 New | TO tornado tornadoweb | 2.1 | Oct 26 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs |
| CVE-2026-116671 New | XP Xpdf Xpdf | 2.1 | Oct 26 | Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder |
| CVE-2026-116482 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 26 | subhajitkhan online-clinic-management-system patientregistration.php cross site scripting |
| CVE-2026-57196 New | AS asterisk asterisk | 2.3 | Oct 26 | Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages |
| CVE-2026-111404 New | PR Photo Reviews for WooCommerce VillaTheme | 3.7 | Oct 26 | WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability |
| CVE-2026-116385 New | G2 Garage 24 Garage Management Software Bdtask | 3.5 | Oct 26 | Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting |
| CVE-2026-72755 New | RO Routinator NLnet Labs | 3.8 | Oct 26 | Routinator stores TA certificate in cache without validation |
| CVE-2026-82390 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver |
| CVE-2026-19742 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key |
| CVE-2026-93846 New | MA Mattermost Mattermost | 3.8 | Oct 26 | Team admin can escalate a team member's permissions via the team member roles endpoint |
| CVE-2026-116544 New | OP open5gs open5gs | 3.7 | Oct 26 | Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output |
| CVE-2026-77057 New | BO boneIO boneIO | 2.3 | Oct 26 | Improper Restriction of Excessive Authentication Attempts in boneIO |
| CVE-2026-93848 New | MA Mattermost Mattermost | 2.7 | Oct 26 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator |
| CVE-2026-93847 New | MA Mattermost Mattermost | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints |
| CVE-2026-112880 New | HA hackney benoitc | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
| CVE-2026-116215 New | MA maccms10 maccmspro | 3.1 | Oct 26 | MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption |
| CVE-2026-116281 New | KA Kameleo Kameleo | 3.3 | Oct 26 | Kameleo Profile Controller t.cs ListProfiles information disclosure |
| CVE-2026-107157 New | QT Qt qt | 2.0 | Oct 26 | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework |
| CVE-2026-96432 New | QT qt qt | 2.1 | Oct 26 | Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt |
| CVE-2026-116261 New | LI libimobiledevice Libimobiledevice | 3.5 | Oct 26 | libimobiledevice AFC File afc.c afc_file_open out-of-bounds |
| CVE-2026-116229 New | FT FFXIV Teamcraft ffxiv-teamcraft | 3.5 | Oct 26 | ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting |
| CVE-2026-116228 New | AG agent-teams-ai 777genius | 3.3 | Oct 26 | 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication |
| CVE-2026-116227 New | BR BR-6208AC Edimax | 2.4 | Oct 26 | Edimax BR-6208AC Virtual Server cross site scripting |
| CVE-2026-116123 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB signup validatePassword excessive authentication |
| CVE-2026-116122 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure |
| CVE-2026-116121 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Registration users.service.ts race condition |
| CVE-2026-116115 New | GC GM8135S Camera Yoosee | 3.1 | Oct 26 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization |
| CVE-2026-116114 New | GC GM8135S Camera Yoosee | 3.7 | Oct 26 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission |
| CVE-2026-116105 New | HA HeyCyan App Heycyan App | 3.7 | Oct 26 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission |
| CVE-2026-116100 New | GO gougucms Gougucms | 2.4 | Oct 26 | gougucms User Level Level.php add cross site scripting |
| CVE-2026-116054 New | SH SH3 Sh3 | 2.2 | Oct 25 | SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash |