CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 15:55 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-98883 New | LI Linux Linux | – | Oct 23 | serial: 8250_port: recognize UPIO_AU |
| CVE-2026-98882 New | LI Linux Linux | – | Oct 23 | media: chips-media: wave5: Add range checks for dec_output_info |
| CVE-2026-98881 New | LI Linux Linux | – | Oct 23 | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() |
| CVE-2026-98880 New | LI Linux Linux | – | Oct 23 | ntfs3: handle set_blocksize failures |
| CVE-2026-98879 New | LI Linux Linux | – | Oct 23 | isofs: handle set_blocksize failures |
| CVE-2026-98878 New | LI Linux Linux | – | Oct 23 | irqchip/gic-v5: Immediately exec priority drop following activate |
| CVE-2026-98877 New | LI Linux Linux | – | Oct 23 | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed |
| CVE-2026-98876 New | LI Linux Linux | – | Oct 23 | host1x: bus: Fix missing ops null check in error teardown |
| CVE-2026-98875 New | LI Linux Linux | – | Oct 23 | drm/nouveau/gsp: add SEC2 to GA100 chip table |
| CVE-2026-98874 New | LI Linux Linux | – | Oct 23 | wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect |
| CVE-2026-98873 New | LI Linux Linux | – | Oct 23 | netfilter: nf_conntrack_expect: zero at allocation time |
| CVE-2026-98872 New | LI Linux Linux | – | Oct 23 | freevxfs: don't BUG() on unknown typed-extent type |
| CVE-2026-98871 New | LI Linux Linux | – | Oct 23 | crypto: ccp - Fix possible deadlock in SEV init failure path |
| CVE-2026-98870 New | LI Linux Linux | 8.8 | Oct 23 | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-115727 New | AG AgenticSeek Fosowl | 8.1 | Oct 23 | AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server |
| CVE-2026-115726 New | AI aider Aider-AI | 7.8 | Oct 23 | Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings |
| CVE-2026-115725 New | CH chatwoot chatwoot | 4.2 | Oct 23 | Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id |
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-115723 New | SN snap7 davenardella | 7.4 | Oct 23 | Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion |
| CVE-2026-115722 New | RP rply diegonehab | 6.1 | Oct 23 | RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header |
| CVE-2026-107685 New | RE req_llm agentjido | 9.1 | Oct 23 | WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers |
| CVE-2026-95620 New | QT qt qt | 2.1 | Oct 23 | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt |
| CVE-2026-94263 New | AC Advanced Custom Fields: Extended | 4.8 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message |
| CVE-2026-111965 New | PB Profile Builder | 4.3 | Oct 23 | Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass |
| CVE-2026-105963 New | PL plug elixir-plug | 5.1 | Oct 23 | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments |
| CVE-2026-16762 New | QT qt qt | 8.7 | Oct 23 | Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt |
| CVE-2026-89320 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 8.8 | Oct 23 | HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity |
| CVE-2026-25784 New | BL BlueSpice Hallo Welt! GmbH | 9.8 | Oct 23 | bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop |
| CVE-2026-89319 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation |
| CVE-2026-25716 New | BL BlueSpice Hallo Welt! GmbH | 7.1 | Oct 23 | BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users |
| CVE-2026-89318 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) |
| CVE-2026-89317 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) |
| CVE-2026-89316 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion |
| CVE-2026-89315 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix |
| CVE-2026-89314 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s |
| CVE-2026-89313 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil |
| CVE-2026-89312 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV |
| CVE-2025-58403 New | CC CGM CLININET CGM | 5.1 | Oct 23 | Reflected Cross-Site Scripting (XSS) in CGM CLININET |
| CVE-2025-30054 New | CC CGM CLININET CGM | 9.3 | Oct 23 | Local Privilege Escalation in CGM CLININET |
| CVE-2025-30053 New | CC CGM CLININET CGM | 6.9 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2025-30052 New | CC CGM CLININET CGM | 8.8 | Oct 23 | Authentication Bypass via IP Spoofing in CGM CLININET rsyncd |
| CVE-2025-30051 New | CC CGM CLININET CGM | 6.8 | Oct 23 | Insecure File Permissions in CGM CLININET |
| CVE-2025-30050 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30049 New | CC CGM CLININET CGM | 8.2 | Oct 23 | Use of Unsalted MD5 Password Hashes in CGM CLININET |
| CVE-2025-30047 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution via Java Deserialization in CGM CLININET |
| CVE-2025-30046 New | CC CGM CLININET CGM | 9.0 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30045 New | CC CGM CLININET CGM | 8.6 | Oct 23 | Code Injection in CGM CLININET |
| CVE-2025-30043 New | CC CGM CLININET CGM | 7.1 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2026-115657 New | KA KNIME Analytics Platform KNIME | 4.8 | Oct 23 | KNIME Analytics Platform logs credentials of configured proxy when used as an executor |
| CVE-2026-112860 New | PD Participants Database xnau webdesign | 9.3 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability |