CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-94386 New | AC Apache Camel Apache Software Foundation | 4.8 | Oct 26 | Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache |
| CVE-2026-77061 New | BO boneIO boneIO | 5.3 | Oct 26 | Missing Authentication for Critical Function in boneIO |
| CVE-2026-77060 New | BL black_debian_images boneIO | 6.8 | Oct 26 | Incorrect Permission Assignment for Critical Resource in boneIO |
| CVE-2026-77059 New | BO boneIO boneIO | 8.8 | Oct 26 | TOCTOU Race Condition in boneIO |
| CVE-2026-77058 New | BO boneIO boneIO | 5.1 | Oct 26 | Cross-Site Request Forgery (CSRF) in boneIO |
| CVE-2026-77057 New | BO boneIO boneIO | 2.3 | Oct 26 | Improper Restriction of Excessive Authentication Attempts in boneIO |
| CVE-2026-77056 New | BL black_debian_images boneIO | 7.1 | Oct 26 | Use of Default Credentials in boneIO |
| CVE-2026-77055 New | BL black_debian_images boneIO | 9.3 | Oct 26 | Improper Privilege Assignment in boneIO |
| CVE-2026-77054 New | BO boneIO boneIO | 6.9 | Oct 26 | Cleartext Storage of Sensitive Information in boneIO |
| CVE-2026-77053 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication in Default Configuration in boneIO |
| CVE-2026-77052 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication for Node-RED in boneIO |
| CVE-2026-116340 New | AS astron-agent iFlytek | 4.3 | Oct 26 | iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization |
| CVE-2026-112345 New | TT TTLock Sciener | 8.1 | Oct 26 | TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure |
| CVE-2026-3322 New | LO Lobster_pro Lobster DATA GmbH | 5.6 | Oct 26 | Privilege escalation via request replaying in Lobster_pro |
| CVE-2026-110748 New | AS Apache SIS Apache Software Foundation | – | Oct 26 | Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files |
| CVE-2026-92171 New | RH Red Hat Data Grid 8 Red Hat | 6.5 | Oct 26 | Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store |
| CVE-2026-116497 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.5 | Oct 26 | Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon |
| CVE-2026-116339 New | AS astron-agent iFlytek | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist |
| CVE-2026-93848 New | MA Mattermost Mattermost | 2.7 | Oct 26 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator |
| CVE-2026-93850 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Unbounded memory consumption during PDF text extraction |
| CVE-2026-93849 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-110733 New | AS Apache SIS Apache Software Foundation | 5.4 | Oct 26 | Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store |
| CVE-2026-93847 New | MA Mattermost Mattermost | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints |
| CVE-2026-65184 New | AA Avocent ACS8000 Vertiv | 9.8 | Oct 26 | Avocent ACS8000 wsserver command injection |
| CVE-2026-115930 New | MO mongosh MongoDB, Inc. | 6.8 | Oct 26 | MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-116284 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Local API user-info information disclosure |
| CVE-2026-116516 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Insufficient length validation when parsing Zoom chat transcriptions |
| CVE-2026-97200 New | HA hackney benoitc | 8.2 | Oct 26 | Unbounded response body buffering and decompression in hackney |
| CVE-2026-115693 New | HA hackney benoitc | 9.1 | Oct 26 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
| CVE-2026-113440 New | HA hackney benoitc | 6.0 | Oct 26 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney |
| CVE-2026-115700 New | HA hackney benoitc | 6.9 | Oct 26 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney |
| CVE-2026-112880 New | HA hackney benoitc | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
| CVE-2026-116283 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Local API profiles information disclosure |
| CVE-2026-107656 New | FO FortiSandbox Fortinet | 9.8 | Oct 26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all… |
| CVE-2026-111590 New | HA Harbor Harbor | – | Oct 26 | SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services |
| CVE-2026-108529 New | BA bandit mtrudel | 8.7 | Oct 26 | SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit |
| CVE-2026-59107 New | CP Cynap Pro, Cynap Core Pro WolfVision | 9.8 | Oct 26 | Shared SSH Authentication Key in vSolution Matrix File Sharing |
| CVE-2026-110499 New | BA bandit mtrudel | 8.7 | Oct 26 | Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit |
| CVE-2026-109584 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit |
| CVE-2026-111103 New | BA bandit mtrudel | 8.2 | Oct 26 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit |
| CVE-2026-111101 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit |
| CVE-2026-113436 New | BA bandit mtrudel | 8.7 | Oct 26 | Quadratic bignum parsing of Content-Length and Host port values in Bandit |
| CVE-2026-110314 New | BA bandit mtrudel | 6.3 | Oct 26 | WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit |
| CVE-2026-114213 New | BA bandit mtrudel | 8.7 | Oct 26 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit |
| CVE-2026-114216 New | BA bandit mtrudel | 6.3 | Oct 26 | Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit |
| CVE-2026-115269 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit |
| CVE-2026-108525 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit |
| CVE-2026-116282 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure |
| CVE-2026-59106 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 9.8 | Oct 26 | Unauthenticated RCE Vulnerability in WolfProt interface implementation |