CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 14:33 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116186 New | CO core openremote | 2.3 | Oct 25 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116184 New | CO core openremote | 2.1 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-116197 New | CO contrast edgelesssys | 2.6 | Oct 25 | Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection |
| CVE-2026-116190 New | RC rclone rclone | 3.7 | Oct 25 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect |
| CVE-2026-116162 New | PA parse-server parse-community | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login |
| CVE-2026-116160 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate |
| CVE-2026-116159 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option |
| CVE-2026-116158 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in magick compare |
| CVE-2026-116157 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading |
| CVE-2026-116156 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option |
| CVE-2026-116153 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit |
| CVE-2026-116151 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder |
| CVE-2026-116150 New | IM ImageMagick ImageMagick | 3.1 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder |
| CVE-2026-116148 New | IM ImageMagick ImageMagick | 3.6 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options |
| CVE-2026-116147 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder |
| CVE-2026-116146 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder |
| CVE-2026-116145 New | IM ImageMagick ImageMagick | 3.9 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix |
| CVE-2026-116144 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder |
| CVE-2026-116143 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders |
| CVE-2026-116142 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box |
| CVE-2026-116140 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing |
| CVE-2026-116137 New | AD adm-zip cthackers | 3.7 | Oct 25 | adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names |
| CVE-2026-115183 New | QA Qi Addons For Elementor | 2.4 | Oct 25 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget |
| CVE-2026-114743 New | IC InstaWP Connect | 3.1 | Oct 25 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings |
| CVE-2026-114742 New | WP WPVR | 2.7 | Oct 25 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR |
| CVE-2026-114741 New | WP WPVR | 3.8 | Oct 25 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR |
| CVE-2026-111981 New | GI GiveWP | 2.7 | Oct 25 | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses |
| CVE-2025-15705 New | CF Contact Form by Supsystic | 3.5 | Oct 25 | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS |
| CVE-2026-116007 New | RU ruoyi-vue-pro YunaiV | 3.7 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication |
| CVE-2026-116004 New | ON Onyx onyx-dot-app | 3.5 | Oct 25 | onyx-dot-app Onyx PreviewTab.tsx cross site scripting |
| CVE-2026-115996 New | UG Unitree Go2 Unitree Robotics | 3.7 | Oct 24 | Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation |
| CVE-2026-115981 New | PH phpIPAM Phpipam | 2.4 | Oct 24 | phpIPAM index.php cross site scripting |
| CVE-2026-116013 New | LU lua-resty-dns openresty | 3.7 | Oct 24 | OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing |
| CVE-2026-116012 New | GH ghidra NationalSecurityAgency | 3.6 | Oct 24 | Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser |
| CVE-2026-113674 New | GE GeoDirectory | 3.7 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification |
| CVE-2026-115897 New | SE serialize-javascript yahoo | 2.1 | Oct 23 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
| CVE-2026-83813 New | TW twisted twisted | 3.1 | Oct 23 | Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation |
| CVE-2026-115797 New | F6 F6 Tenda | 3.7 | Oct 23 | Tenda F6 Web Management cleartext transmission |
| CVE-2026-79978 New | ZE zephyr zephyrproject | 3.6 | Oct 23 | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path |
| CVE-2026-115569 New | FA fallow-node @fallow-cli | 3.3 | Oct 23 | Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root |
| CVE-2026-106071 New | NO node nodejs | 3.6 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule |
| CVE-2026-106070 New | NO node nodejs | 3.7 | Oct 23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails |
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-115751 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname |
| CVE-2026-115750 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects |
| CVE-2026-115749 New | HY hydra-ray-launcher hydra-ecosystem | 3.3 | Oct 23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import |
| CVE-2026-115730 New | I1 i18next-http-backend i18next | 3.1 | Oct 23 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl |
| CVE-2026-54711 New | PG pghoard Aiven-Open | 2.4 | Oct 23 | PGHoard: Password written to debug log |
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-95620 New | QT qt qt | 2.1 | Oct 23 | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt |