CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114641 | TR traefik traefik | 3.7 | Oct 22 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper |
| CVE-2026-114721 | WE Webmail Roundcube | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed |
| CVE-2026-114576 | RE RE6250 Linksys | 3.7 | Oct 22 | Linksys RE6250 Web Management strcmp random values |
| CVE-2026-114719 | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin |
| CVE-2026-84911 | DR Drupal Drupal | 3.1 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 |
| CVE-2026-84916 | DR Drupal Drupal | 3.7 | Oct 22 | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 |
| CVE-2026-16648 | DR Drupal Drupal | 3.8 | Oct 22 | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 |
| CVE-2026-84918 | DR Drupal Drupal | 3.7 | Oct 22 | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 |
| CVE-2026-87948 | DR Drupal Drupal | 3.5 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 |
| CVE-2026-87949 | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 |
| CVE-2026-87951 | DR Drupal Drupal | 3.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 |
| CVE-2026-87952 | DR Drupal Drupal | 3.1 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 |
| CVE-2026-87953 | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 |
| CVE-2026-96360 | DR Drupal Drupal | 3.5 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 |
| CVE-2026-96369 | DR Drupal Drupal | 3.1 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 |
| CVE-2026-96373 | DR Drupal Drupal | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 |
| CVE-2026-96384 | DR Drupal Drupal | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 |
| CVE-2026-96387 | DR Drupal Drupal | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 |
| CVE-2026-96392 | DR Drupal Drupal | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 |
| CVE-2026-14288 | GI GitLab GitLab | 3.1 | Oct 21 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-103515 | GI GitLab GitLab | 2.7 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105711 | GI GitLab GitLab | 3.5 | Oct 21 | Use of Cache Containing Sensitive Information in GitLab |
| CVE-2026-112326 | GI GitLab GitLab | 3.1 | Oct 21 | Improper Cleanup on Thrown Exception in GitLab |
| CVE-2026-114377 | WI wiki-go leomoon-studios | 3.8 | Oct 21 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal |
| CVE-2026-18748 | ZE zephyr zephyrproject | 3.5 | Oct 21 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling |
| CVE-2026-105938 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all |
| CVE-2026-105933 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization |
| CVE-2026-105932 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints |
| CVE-2026-105931 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants |
| CVE-2026-105927 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission |
| CVE-2026-114130 | NU nuxt nuxt | 2.3 | Oct 21 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
| CVE-2026-114127 | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-114124 | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114122 | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-113797 | EL electron electron | 3.1 | Oct 21 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
| CVE-2026-114472 | HM hMailServer Progressive Robot Ltd | 3.7 | Oct 21 | Insufficient Resource Pool in hMailServer |
| CVE-2026-114370 | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 3.7 | Oct 21 | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal |
| CVE-2026-113786 | PY pypdf py-pdf | 2.3 | Oct 21 | pypdf: Unvalidated JPEG image data loading |
| CVE-2026-104949 | WA WarehousePG EnterpriseDB | 2.3 | Oct 21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() |
| CVE-2026-87096 | AC Acronis Cyber Infrastructure Acronis | 3.3 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-35501 | UN Unbound NLnet Labs | 3.7 | Oct 21 | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. |
| CVE-2026-104642 | SS Simple Shopping Cart | 2.7 | Oct 21 | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass |
| CVE-2026-114236 | CC Confidential Compute Attestation Red Hat | 3.3 | Oct 21 | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers |
| CVE-2026-96901 | CA Cart Abandonment Recovery for WooCommerce | 3.7 | Oct 21 | Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token |
| CVE-2026-105257 | AB Appointment Booking Plugin | 2.7 | Oct 21 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR |
| CVE-2026-114040 | BE BerryNet DT42 | 3.5 | Oct 21 | DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal |
| CVE-2026-114115 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection |
| CVE-2026-114071 | TR trigger.dev triggerdotdev | 3.1 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route |
| CVE-2026-114070 | TR trigger.dev triggerdotdev | 3.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records |
| CVE-2026-114049 | VL vllm vllm-project | 3.7 | Oct 21 | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense |