CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:28 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115813 New | MU multi-model-server AWS | 5.8 | Oct 23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server |
| CVE-2026-115812 New | MU multi-model-server AWS | 9.8 | Oct 23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server |
| CVE-2026-115567 New | TO tokio tokio-rs | 5.8 | Oct 23 | Tokio: Race condition in `tokio::time::Interval` |
| CVE-2026-110975 New | Product not mapped yet | 7.4 | Oct 23 | Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure |
| CVE-2026-106069 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a… |
| CVE-2026-105481 New | NO node nodejs | 6.5 | Oct 23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request |
| CVE-2026-105482 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() |
| CVE-2026-106074 New | NO node nodejs | 4.8 | Oct 23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup… |
| CVE-2026-106071 New | NO node nodejs | 3.6 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule |
| CVE-2026-106072 New | NO node nodejs | 6.7 | Oct 23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling,… |
| CVE-2026-87901 New | PH phpBB phpBB | 8.3 | Oct 23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting |
| CVE-2026-105483 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with… |
| CVE-2026-106070 New | NO node nodejs | 3.7 | Oct 23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails |
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-115810 New | RE recipes TandoorRecipes | 7.7 | Oct 23 | Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL |
| CVE-2026-57845 New | DA datasets huggingface | 8.8 | Oct 23 | Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder |
| CVE-2026-54668 New | KI kitodo-production kitodo | 8.7 | Oct 23 | Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config) |
| CVE-2026-58497 New | UN Uni-CLI olo-dot-io | 8.6 | Oct 23 | Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests |
| CVE-2026-49442 New | CA cacti Cacti | 5.3 | Oct 23 | Cacti: User Enumeration via Error Messages |
| CVE-2026-39902 New | CA cacti Cacti | 7.2 | Oct 23 | Cacti: Authenticated RCE on Data Input |
| CVE-2026-46531 New | CA cacti Cacti | 5.5 | Oct 23 | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) |
| CVE-2026-102786 New | PG Phoca Gallery extension for Joomla phoca.cz | 8.6 | Oct 23 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 |
| CVE-2026-55222 New | IS isar ilbers | 5.1 | Oct 23 | Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap |
| CVE-2026-53942 New | IN infrastructure conda | 9.9 | Oct 23 | Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN |
| CVE-2026-55486 New | GO goobi-viewer-core intranda | 9.3 | Oct 23 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS |
| CVE-2026-55465 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: Solr injection via unvalidated region parameter in spatial search |
| CVE-2026-55463 New | GO goobi-viewer-core intranda | 6.5 | Oct 23 | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation |
| CVE-2026-112333 New | GA GFI Archiver GFI Software | 5.4 | Oct 23 | GFI Archiver < 15.14 Stored XSS via MailInsights.aspx |
| CVE-2026-55459 New | GO goobi-viewer-core intranda | 7.4 | Oct 23 | Goobi viewer: OpenID JWT audience not enforced by the verifier |
| CVE-2026-55457 New | GO goobi-viewer-core intranda | 7.4 | Oct 23 | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass |
| CVE-2026-55444 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters |
| CVE-2026-46652 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer |
| CVE-2026-46651 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer |
| CVE-2026-46347 New | GO goobi-viewer-core intranda | 6.8 | Oct 23 | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset |
| CVE-2026-46346 New | GO goobi-viewer-core intranda | 6.5 | Oct 23 | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset |
| CVE-2026-55442 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection |
| CVE-2026-115478 New | OB obsidian-tc The-40-Thieves | 7.1 | Oct 23 | obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes |
| CVE-2026-115477 New | OB obsidian-tc The-40-Thieves | 7.1 | Oct 23 | obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP |
| CVE-2026-115457 New | BA basercms baserproject | 7.1 | Oct 23 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments |
| CVE-2026-115786 New | CO Collaboration Zimbra | 6.5 | Oct 23 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion |
| CVE-2026-115785 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address |
| CVE-2026-114624 New | BA basercms baserproject | 7.2 | Oct 23 | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity |
| CVE-2026-114623 New | BA basercms baserproject | 6.5 | Oct 23 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure |
| CVE-2026-114622 New | BA basercms baserproject | 7.2 | Oct 23 | baserCMS: Encoded path traversal bypass in the theme file API |
| CVE-2026-57207 New | NE netbox-mcp-server netboxlabs | 5.9 | Oct 23 | NetBox MCP Server: HTTP transport exposes all NetBox data without authentication |
| CVE-2026-114621 New | BA basercms baserproject | 8.8 | Oct 23 | baserCMS: SQL injection in the admin panel and admin API |
| CVE-2026-114357 New | CZ CrystalSky ZS600C DJI | 9.3 | Oct 23 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) |
| CVE-2026-57208 New | CL cli entireio | 6.2 | Oct 23 | Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind |
| CVE-2026-114356 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization |
| CVE-2026-115480 New | BA basercms baserproject | 5.3 | Oct 23 | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA |