CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118691 New | XI xianyu-auto-reply-fix GuDong2003 | 3.7 | Oct 28 | xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message |
| CVE-2026-118690 New | SI signalk-server SignalK | 9.8 | Oct 28 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |
| CVE-2026-118689 New | OV OvenMediaEngine OvenMediaLabs | 7.5 | Oct 28 | OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length |
| CVE-2026-118682 New | CL clashmi KaringX | 7.5 | Oct 28 | ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM |
| CVE-2026-118669 New | OA oauthlib oauthlib | 8.4 | Oct 28 | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client |
| CVE-2026-118668 New | LA langgraph-api langchain-ai | 8.6 | Oct 28 | LangGraph JavaScript custom authentication may permit cross-user Store access |
| CVE-2026-118667 New | LA langgraph langchain-ai | 4.3 | Oct 28 | LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests |
| CVE-2026-118666 New | EX executor-legacy-ws @graphql-tools | 6.0 | Oct 28 | GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller |
| CVE-2026-118665 New | EX executor-legacy-ws @graphql-tools | 8.2 | Oct 28 | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications |
| CVE-2026-118664 New | DE decode-uri-component SamVerschueren | 8.2 | Oct 28 | decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs |
| CVE-2026-118663 New | NO node-server honojs | 5.3 | Oct 28 | @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths |
| CVE-2026-118662 New | VI vite vitejs | 6.9 | Oct 28 | Vite: `server.fs.deny` bypassed with queries |
| CVE-2026-118661 New | HA happy-dom capricorn86 | 6.5 | Oct 28 | Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies |
| CVE-2026-118660 New | HA happy-dom capricorn86 | 8.6 | Oct 28 | Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML |
| CVE-2026-118659 New | HA happy-dom capricorn86 | 7.5 | Oct 28 | @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy |
| CVE-2026-118658 New | EC echo labstack | 4.7 | Oct 28 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto |
| CVE-2026-118657 New | EC echo labstack | 5.9 | Oct 28 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| CVE-2026-118656 New | EC echo labstack | 6.1 | Oct 28 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI |
| CVE-2026-76418 New | CS Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Cisco | 8.6 | Oct 28 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability |
| CVE-2026-118655 New | EC echo labstack | 5.9 | Oct 28 | Echo: Static Middleware Double-Unescape Path Traversal |
| CVE-2026-117574 New | RH Red Hat OpenShift AI (RHOAI) Red Hat | 9.1 | Oct 28 | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization |
| CVE-2026-118654 New | EC echo labstack | 5.9 | Oct 28 | Echo static file middleware route protection bypass via encoded dot-dot traversal |
| CVE-2026-13451 New | RH Red Hat OpenShift AI (RHOAI) Red Hat | 7.7 | Oct 28 | Kserve: kserve: server-side request forgery via malicious storageuri |
| CVE-2026-61542 New | GE Gearboy drhelius | 8.6 | Oct 28 | Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools |
| CVE-2026-54162 New | EM ember alexandre-daubois | 4.7 | Oct 28 | Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI |
| CVE-2026-61529 New | EN endatix endatix | 4.7 | Oct 28 | Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`) |
| CVE-2026-118653 New | EC echo labstack | 5.3 | Oct 28 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration |
| CVE-2026-118652 New | EC echo labstack | 6.1 | Oct 28 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob |
| CVE-2026-115415 New | ST strands-agents-tools amazon | 6.5 | Oct 28 | Secret masking bypass in the environment tool in Strands Agents Tools |
| CVE-2026-118651 New | EC echo labstack | 5.3 | Oct 28 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-63190 New | FE FearlessCMS fearlessgeekmedia | 9.4 | Oct 28 | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS |
| CVE-2026-118650 New | EC echo labstack | 7.5 | Oct 28 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-118266 New | EC echo labstack | 5.3 | Oct 28 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-78674 New | BP Business Process Server WSO2 | 8.8 | Oct 28 | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution |
| CVE-2026-6647 New | WC WSO2 Carbon OAuth WSO2 | 7.4 | Oct 28 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events |
| CVE-2026-3583 New | WA WSO2 API Control Plane WSO2 | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] |
| CVE-2026-11854 New | WA WSO2 API Control Plane WSO2 | 6.1 | Oct 28 | Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products |
| CVE-2025-14260 New | SS SAML2 SSO Authenticator UI Bundle WSO2 | 8.3 | Oct 28 | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources |
| CVE-2026-109411 New | SA Samba Samba | 8.1 | Oct 28 | Samba: access control bypass via vfs_ceph_rgw case-insensitive open |
| CVE-2026-118265 New | EC echo labstack | 5.3 | Oct 28 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118264 New | EC echo labstack | 9.1 | Oct 28 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-118263 New | EC echo labstack | 6.3 | Oct 28 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118262 New | EC echo labstack | 8.2 | Oct 28 | Echo: WebSocket proxy can retain connections and handlers after client disconnect |
| CVE-2026-118688 New | WA wasmtime bytecodealliance | 7.9 | Oct 28 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename |
| CVE-2026-118687 New | CO coder coder | 6.5 | Oct 28 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication |
| CVE-2026-118686 New | ES espocrm espocrm | 7.5 | Oct 28 | EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex |
| CVE-2026-118685 New | TO ToolJet ToolJet | 6.5 | Oct 28 | ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard |
| CVE-2026-118684 New | MO MONAI Project-MONAI | 5.9 | Oct 28 | MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads |
| CVE-2026-118683 New | MO MONAI Project-MONAI | 8.8 | Oct 28 | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf |
| CVE-2026-118681 New | CH chi go-chi | 3.7 | Oct 28 | go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware |