CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 16:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115915 New | VL vllm vllm-project | 9.8 | Oct 26 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE |
| CVE-2026-102649 New | BU burrito padok-team | 9.9 | Oct 26 | Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset |
| CVE-2026-115905 New | ZI zip2 zip-rs | 10.0 | Oct 26 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
| CVE-2026-116370 New | SM Sid Meier's Civilization VI 2K Games | 9.6 | Oct 26 | 2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion |
| CVE-2026-112346 New | OS OpenHands Software Agent SDK OpenHands | 9.8 | Oct 26 | OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE |
| CVE-2026-77055 New | BL black_debian_images boneIO | 9.3 | Oct 26 | Improper Privilege Assignment in boneIO |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-65184 New | AA Avocent ACS8000 Vertiv | 9.8 | Oct 26 | Avocent ACS8000 wsserver command injection |
| CVE-2026-115693 New | HA hackney benoitc | 9.1 | Oct 26 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
| CVE-2026-107656 New | FO FortiSandbox Fortinet | 9.8 | Oct 26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all… |
| CVE-2026-59107 New | CP Cynap Pro, Cynap Core Pro WolfVision | 9.8 | Oct 26 | Shared SSH Authentication Key in vSolution Matrix File Sharing |
| CVE-2026-59106 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 9.8 | Oct 26 | Unauthenticated RCE Vulnerability in WolfProt interface implementation |
| CVE-2026-116485 New | DA danmu_api huangxd- | 9.8 | Oct 26 | danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints |
| CVE-2026-116214 New | MA maccms10 maccmspro | 9.1 | Oct 26 | MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code |
| CVE-2026-115188 New | Product not mapped yet | 9.9 | Oct 26 | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7 |
| CVE-2026-110475 New | CC CreditNirvana Collections Platform (CollectionWorkz) CreditNirvana | 9.3 | Oct 26 | Improper Authentication Vulnerability in CreditNirvana Collections Platform |
| CVE-2026-116235 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro L2TP Authentication crlf injection |
| CVE-2026-116234 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection |
| CVE-2026-116233 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-116232 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro SNMP snmp_set crlf injection |
| CVE-2026-116231 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro Ser2net crlf injection |
| CVE-2026-116111 New | CV Civilization V 2K Games | 9.6 | Oct 26 | 2K Games Civilization V Lua Sandbox loadstring type confusion |
| CVE-2026-107092 New | Product not mapped yet | 9.8 | Oct 26 | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint |
| CVE-2026-116207 New | YE yeswiki YesWiki | 9.1 | Oct 25 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API |
| CVE-2026-115214 New | DP Datawiza Proxy Auth Plugin | 9.8 | Oct 25 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers |
| CVE-2026-115995 New | UG Unitree Go2 Unitree Robotics | 9.6 | Oct 24 | Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection |
| CVE-2026-114820 New | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 24 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-115933 New | PO postiz-app GitroomHQ | 9.9 | Oct 24 | Forged signed tokens let any registered user take over other users and organizations |
| CVE-2026-115557 New | CP CPython Python Software Foundation | 9.4 | Oct 24 | Distrust compromised intermediate certificates in ssl module |
| CVE-2026-115932 New | PO postiz-app GitroomHQ | 9.6 | Oct 24 | Path traversal in post media lets any registered user read server files |
| CVE-2026-114196 New | PA Paytium paytiumsupport | 9.8 | Oct 24 | WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability |
| CVE-2026-112866 New | PF Product Filter by WBW WPFactory | 9.3 | Oct 24 | WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability |
| CVE-2026-94075 New | NE Newsletters Tribulant Software | 9.8 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability |
| CVE-2026-111402 New | NE Newsletters Tribulant Software | 9.3 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability |
| CVE-2026-110956 New | AS asVereinbase | 9.8 | Oct 24 | asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation |
| CVE-2026-115806 New | PM Prime Mover – Backup and Migration codexonics | 9.8 | Oct 24 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace |
| CVE-2026-115931 New | PO postiz-app GitroomHQ | 9.9 | Oct 23 | Arbitrary file read and backend crash through unrestricted provider method calls |
| CVE-2026-115893 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction |
| CVE-2026-115889 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation |
| CVE-2026-115812 New | MU multi-model-server AWS | 9.8 | Oct 23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server |
| CVE-2026-53942 New | IN infrastructure conda | 9.9 | Oct 23 | Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN |
| CVE-2026-55486 New | GO goobi-viewer-core intranda | 9.3 | Oct 23 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS |
| CVE-2026-46652 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer |
| CVE-2026-46651 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer |
| CVE-2026-114357 New | CZ CrystalSky ZS600C DJI | 9.3 | Oct 23 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) |
| CVE-2026-53921 New | OD odhcpd openwrt | 9.8 | Oct 23 | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) |
| CVE-2026-112848 New | HV Hostme v2 AivahThemes | 9.8 | Oct 23 | WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability |
| CVE-2026-112854 New | HC Holistic Center axiomthemes | 9.8 | Oct 23 | WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability |
| CVE-2026-112847 New | ZE ZenSoul ThemeREX | 9.8 | Oct 23 | WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability |
| CVE-2026-112846 New | SL Save Life ThemeREX Group | 9.8 | Oct 23 | WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability |