CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119168 New | NO Nomad HashiCorp | 8.8 | Oct 29 | Nomad allocation data migration may allow host directory permission modification via symlink following |
| CVE-2026-107347 New | NO Nomad HashiCorp | 8.4 | Oct 29 | Nomad dispatch payload writes can escape the allocation directory through symlinks |
| CVE-2026-102260 New | NO Nomad HashiCorp | 4.3 | Oct 29 | Nomad vulnerable to cross-namespace information disclosure in multiple endpoints |
| CVE-2026-116566 New | CP CPython Python Software Foundation | 5.3 | Oct 29 | socket.getaddrinfo() accepts embedded null bytes in host and port |
| CVE-2026-118769 New | BO botan randombit | 9.2 | Oct 29 | Botan: Integer overflow when reporting block size in FFI can cause memory corruption |
| CVE-2026-118768 New | BO botan randombit | 5.9 | Oct 29 | Botan: CLI utility `ocsp_check` accepts unauthenticated responses |
| CVE-2026-118767 New | BO botan randombit | 4.8 | Oct 29 | Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs |
| CVE-2026-118766 New | BO botan randombit | 6.1 | Oct 29 | Botan: Online OCSP redirects enable blind requests to internal HTTP services |
| CVE-2026-118765 New | BO botan randombit | 7.3 | Oct 29 | Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state |
| CVE-2026-118764 New | MI minimatch isaacs | 8.7 | Oct 29 | minimatch: potential denial of service via globparts amplification |
| CVE-2026-118763 New | SI sigstore-js sigstore | 7.4 | Oct 29 | @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location |
| CVE-2026-118762 New | MO monkeytype monkeytypegame | 9.3 | Oct 29 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN |
| CVE-2026-115805 New | IA Insight Agent Rapid7 | 7.8 | Oct 29 | Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path |
| CVE-2026-11587 New | CE Centreon Centreon | 7.2 | Oct 29 | Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 |
| CVE-2023-7357 New | FP FlexNet Publisher Revera | 8.6 | Oct 29 | FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability |
| CVE-2026-118761 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory |
| CVE-2026-119115 New | AW aws-privateca-issuer AWS | 8.5 | Oct 29 | Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes |
| CVE-2026-118760 New | PI pipelines kubeflow | 6.5 | Oct 29 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads |
| CVE-2026-118759 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant |
| CVE-2025-12523 New | CE Centreon Centreon | 6.5 | Oct 29 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure |
| CVE-2026-62374 New | SD @sd-jwt/core openwallet-foundation | 7.1 | Oct 29 | SD JWT JS: Tampered disclosures silently dropped instead of rejected |
| CVE-2026-118758 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source |
| CVE-2026-118673 New | KE keepassxc keepassxreboot | 4.1 | Oct 29 | KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses |
| CVE-2025-13050 New | CE Centreon Centreon | 5.4 | Oct 29 | Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users |
| CVE-2026-119145 New | FR frappe frappe | 9.9 | Oct 29 | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload |
| CVE-2026-119144 New | FR frappe frappe | 8.8 | Oct 29 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields |
| CVE-2026-119143 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes |
| CVE-2026-119142 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop |
| CVE-2026-119141 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc |
| CVE-2026-119140 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield |
| CVE-2026-119139 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call |
| CVE-2026-119138 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap |
| CVE-2026-119137 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry |
| CVE-2026-119136 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass |
| CVE-2026-119135 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch |
| CVE-2026-119134 New | WA wasmtime bytecodealliance | 6.2 | Oct 29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles |
| CVE-2026-119133 New | WA wasmtime bytecodealliance | 2.6 | Oct 29 | Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags |
| CVE-2026-119132 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter |
| CVE-2026-119131 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http |
| CVE-2026-119130 New | WA wasmtime bytecodealliance | 2.6 | Oct 29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling |
| CVE-2026-119129 New | ZI zitadel zitadel | 8.1 | Oct 29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval |
| CVE-2026-119128 New | ZI zitadel zitadel | 7.4 | Oct 29 | ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie |
| CVE-2026-119127 New | ZI zitadel zitadel | 8.1 | Oct 29 | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection |
| CVE-2026-119126 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys |
| CVE-2026-119125 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields |
| CVE-2026-119124 New | IM ImageMagick ImageMagick | 3.3 | Oct 29 | ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option |
| CVE-2026-119123 New | IM ImageMagick ImageMagick | 3.7 | Oct 29 | ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder |
| CVE-2026-119122 New | CR crawl4ai unclecode | 5.3 | Oct 29 | Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check |
| CVE-2026-119121 New | CR crawl4ai unclecode | 4.3 | Oct 29 | Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for |
| CVE-2026-119120 New | CR crawl4ai unclecode | 7.5 | Oct 29 | Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name |