CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113674 New | GE GeoDirectory | 3.7 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification |
| CVE-2026-115897 New | SE serialize-javascript yahoo | 2.1 | Oct 23 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
| CVE-2026-83813 New | TW twisted twisted | 3.1 | Oct 23 | Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation |
| CVE-2026-115797 New | F6 F6 Tenda | 3.7 | Oct 23 | Tenda F6 Web Management cleartext transmission |
| CVE-2026-79978 New | ZE zephyr zephyrproject | 3.6 | Oct 23 | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path |
| CVE-2026-115569 New | FA fallow-node @fallow-cli | 3.3 | Oct 23 | Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root |
| CVE-2026-106071 New | NO node nodejs | 3.6 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule |
| CVE-2026-106070 New | NO node nodejs | 3.7 | Oct 23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails |
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-115751 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname |
| CVE-2026-115750 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects |
| CVE-2026-115749 New | HY hydra-ray-launcher hydra-ecosystem | 3.3 | Oct 23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import |
| CVE-2026-115730 New | I1 i18next-http-backend i18next | 3.1 | Oct 23 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl |
| CVE-2026-54711 New | PG pghoard Aiven-Open | 2.4 | Oct 23 | PGHoard: Password written to debug log |
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-95620 New | QT qt qt | 2.1 | Oct 23 | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt |
| CVE-2026-113501 New | LC LiteSpeed Cache | 3.1 | Oct 23 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal |
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-115535 New | HO HospitalManagement gedelumbung | 2.4 | Oct 23 | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting |
| CVE-2026-115449 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 22 | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest |