CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 12:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118619 New | UL Ultralytics Ultralytics | 8.8 | Oct 28 | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability |
| CVE-2026-118618 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118617 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118616 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118615 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability |
| CVE-2026-118614 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118613 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118610 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-103506 New | GR Grafana Grafana | 8.9 | Oct 28 | SSO settings authorization bypass |
| CVE-2026-118606 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability |
| CVE-2026-118605 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118603 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118602 New | IL iLX-F511 Alpine | 7.8 | Oct 28 | Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability |
| CVE-2026-88967 New | GR Grafana Grafana | 7.7 | Oct 28 | Azure Monitor access token disclosure via SSRF |
| CVE-2026-100105 New | GR Grafana Grafana | 7.7 | Oct 28 | Alerting contact point authorization bypass via schema downgrade |
| CVE-2026-106079 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration |
| CVE-2026-103411 New | SS Session Smart Router Juniper Networks | 7.1 | Oct 28 | Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing |
| CVE-2026-103410 New | SS Session Smart Router Juniper Networks | 7.5 | Oct 28 | Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection |
| CVE-2026-103408 New | SS Session Smart Router Juniper Networks | 8.8 | Oct 28 | Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options |
| CVE-2026-103407 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management |
| CVE-2026-103403 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules |
| CVE-2026-103402 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation |
| CVE-2026-103401 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root |
| CVE-2026-93523 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write |
| CVE-2026-118510 New | MO MongoDB MongoDB | 8.8 | Oct 28 | Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs |
| CVE-2026-93522 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server Glamor CopyArea Heap Buffer Overflow |
| CVE-2026-116778 New | FO fogproject FOGProject | 8.8 | Oct 28 | FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution |
| CVE-2026-116776 New | US usb-test n-romanovich | 7.0 | Oct 28 | USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS |
| CVE-2026-56828 New | SH shopper shopperlabs | 8.8 | Oct 28 | Shopper: read-only team permissions allow administrator creation and permission escalation |
| CVE-2026-47235 New | SI simc simulationcraft | 7.5 | Oct 28 | SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array |
| CVE-2026-93521 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow |
| CVE-2026-59979 New | YO Yosemite-Crew YosemiteCrew | 8.3 | Oct 28 | YosemiteCrew: Missing organization authorization on service and PMS library/template routes |
| CVE-2026-112357 New | GK GFI KerioConnect GFI USA, LLC | 7.8 | Oct 28 | GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation |
| CVE-2026-67187 New | NF Ninja Forms Saturday Drive | 7.1 | Oct 28 | Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields |
| CVE-2026-93520 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write |
| CVE-2026-93519 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XFixes Pointer Barrier Event List Buffer Overflow |
| CVE-2026-93518 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XKB ResizeKeyType Numeric Truncation |
| CVE-2026-115603 New | AA Advanced Ads – Tracking Advanced Ads GmbH | 8.5 | Oct 28 | WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability |
| CVE-2026-116390 New | FE Filter Everything — WordPress & WooCommerce Filters stepasyuk | 7.2 | Oct 28 | WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability |
| CVE-2026-116389 New | PM Phoenix Media Rename crossi72 | 8.8 | Oct 28 | WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability |
| CVE-2026-115590 New | DO Dokan weDevs | 7.2 | Oct 28 | WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability |
| CVE-2026-116078 New | BA bandit mtrudel | 8.7 | Oct 28 | HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit |
| CVE-2026-52729 New | XI xibo-cms xibosignage | 7.1 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion |
| CVE-2026-93517 New | XW xwayland x.org | 8.5 | Oct 28 | X.Org Server GLX RenderLarge Heap Buffer Overflow |
| CVE-2026-59185 New | ID identrail identrail | 8.5 | Oct 28 | identrail: Cross-tenant GitHub installation binding without ownership verification |
| CVE-2026-59179 New | OP openhop naorsabag | 8.3 | Oct 28 | OpenHop: Path Traversal in Flow ID File Operations |
| CVE-2026-59177 New | DE device-builder esphome | 8.8 | Oct 28 | ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces |
| CVE-2026-59176 New | FU functype jordanburke | 7.8 | Oct 28 | Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import |
| CVE-2026-59172 New | JO joker candid82 | 7.8 | Oct 28 | Joker linter executed project-local .jokerd/linter.* files during linting |
| CVE-2026-59164 New | NO nora getnora-io | 7.1 | Oct 28 | NORA missing cross-user token-management authorization |