CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107091 New | Product not mapped yet | 7.8 | Oct 26 | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic |
| CVE-2026-104591 New | Product not mapped yet | 7.5 | Oct 26 | libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c |
| CVE-2026-104596 New | Product not mapped yet | 7.5 | Oct 26 | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c |
| CVE-2026-104598 New | Product not mapped yet | – | Oct 26 | libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c |
| CVE-2026-36698 New | Product not mapped yet | – | Oct 26 | Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh |
| CVE-2026-106781 New | Product not mapped yet | – | Oct 26 | An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges |
| CVE-2026-104597 New | Product not mapped yet | – | Oct 26 | libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c |
| CVE-2026-104592 New | Product not mapped yet | – | Oct 26 | libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c |
| CVE-2026-104593 New | Product not mapped yet | – | Oct 26 | osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c |
| CVE-2026-107080 New | Product not mapped yet | – | Oct 26 | OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c |
| CVE-2026-106677 New | Product not mapped yet | – | Oct 26 | Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl |
| CVE-2026-106676 New | Product not mapped yet | – | Oct 26 | qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value |
| CVE-2026-104594 New | Product not mapped yet | – | Oct 26 | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c |
| CVE-2026-116638 New | Product not mapped yet | – | Oct 26 | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords |
| CVE-2026-107090 New | Product not mapped yet | – | Oct 26 | An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution… |
| CVE-2026-116099 New | SC SCP Containment Breach Multiplayer Fusion Creators Studio | 8.8 | Oct 25 | Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write |
| CVE-2026-116098 New | RA Ravenfield SteelRaven7 | 7.8 | Oct 25 | SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization |
| CVE-2026-116097 New | CL CloudClassroom-PHP-Project Cloudclassroom-php-project | 4.3 | Oct 25 | CloudClassroom-PHP-Project addnewstudent.php cross site scripting |
| CVE-2026-116096 New | LL llama.cpp ggml-org | 5.3 | Oct 25 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write |
| CVE-2026-116095 New | SM smg smg-project | 5.3 | Oct 25 | smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation |
| CVE-2026-116094 New | EY EyouCMS Eyoucms | 7.3 | Oct 25 | EyouCMS function.php remote_file_to_local server-side request forgery |
| CVE-2026-115627 New | AS ash_postgres ash-project | 6.0 | Oct 25 | AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows |
| CVE-2026-115635 New | AS ash_postgres ash-project | 6.0 | Oct 25 | AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set |
| CVE-2026-114214 New | AS ash ash-project | 6.0 | Oct 25 | Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records |
| CVE-2026-116063 New | DE DedeCMS Dedecms | 4.7 | Oct 25 | DedeCMS update_guide.php require_once code injection |
| CVE-2026-116062 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System save_profile.php sql injection |
| CVE-2026-116061 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System edit_dealer.php sql injection |
| CVE-2026-115825 New | Product not mapped yet | – | Oct 25 | HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length |
| CVE-2026-115824 New | Product not mapped yet | – | Oct 25 | Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies |
| CVE-2026-115823 New | Product not mapped yet | – | Oct 25 | Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections |
| CVE-2026-115822 New | Product not mapped yet | – | Oct 25 | Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies |
| CVE-2026-115817 New | Product not mapped yet | – | Oct 25 | Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers |
| CVE-2026-116060 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System adddealer.php sql injection |
| CVE-2026-116058 New | AC Activiti Alfresco | 6.3 | Oct 25 | Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection |
| CVE-2026-116057 New | KO KodExplorer KodCloud | 6.3 | Oct 25 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload |
| CVE-2026-116056 New | KO KodExplorer KodCloud | 6.3 | Oct 25 | KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery |
| CVE-2026-116055 New | PI Performance Indicator System SourceCodester | 6.3 | Oct 25 | SourceCodester Performance Indicator System deleteproduct.php sql injection |
| CVE-2026-116054 New | SH SH3 Sh3 | 2.2 | Oct 25 | SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash |
| CVE-2026-116053 New | MY mycli dbcli | 5.3 | Oct 25 | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection |
| CVE-2026-116186 New | CO core openremote | 2.3 | Oct 25 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116185 New | CO core openremote | 5.0 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos |
| CVE-2026-116184 New | CO core openremote | 2.1 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-116211 New | YE yeswiki YesWiki | 8.2 | Oct 25 | YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create |
| CVE-2026-116208 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts |
| CVE-2026-116207 New | YE yeswiki YesWiki | 9.1 | Oct 25 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API |
| CVE-2026-116206 New | YE yeswiki YesWiki | 6.4 | Oct 25 | YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax |
| CVE-2026-116205 New | YE yeswiki YesWiki | 5.3 | Oct 25 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax |
| CVE-2026-116204 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki before 4.7.0 CSRF via despam Admin Action |
| CVE-2026-116203 New | YE yeswiki YesWiki | 6.1 | Oct 25 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters |
| CVE-2026-116202 New | YE yeswiki YesWiki | 5.4 | Oct 25 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload |