CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 03:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107250 New | DR Drupal Drupal | 5.9 | Oct 30 | ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193 |
| CVE-2026-107251 New | DR Drupal Drupal | 6.5 | Oct 30 | Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194 |
| CVE-2026-107252 New | DR Drupal Drupal | 5.4 | Oct 30 | MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195 |
| CVE-2026-107253 New | DR Drupal Drupal | 5.9 | Oct 30 | Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196 |
| CVE-2026-107254 New | DR Drupal Drupal | 4.8 | Oct 30 | Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197 |
| CVE-2026-107257 New | DR Drupal Drupal | 6.5 | Oct 30 | Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 |
| CVE-2026-107258 New | DR Drupal Drupal | 5.4 | Oct 30 | Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 |
| CVE-2026-107259 New | DR Drupal Drupal | 5.4 | Oct 30 | Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 |
| CVE-2026-107261 New | DR Drupal Drupal | 4.2 | Oct 30 | Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 |
| CVE-2026-107263 New | DR Drupal Drupal | 5.4 | Oct 30 | Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 |
| CVE-2026-107264 New | DR Drupal Drupal | 5.4 | Oct 30 | Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 |
| CVE-2026-107265 New | DR Drupal Drupal | 5.4 | Oct 30 | Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 |
| CVE-2026-96389 New | DR Drupal Drupal | 6.5 | Oct 30 | Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 |
| CVE-2026-107268 New | DR Drupal Drupal | 4.3 | Oct 30 | Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 |
| CVE-2026-107267 New | DR Drupal Drupal | 5.3 | Oct 30 | DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 |
| CVE-2026-107307 New | DR Drupal Drupal | 4.3 | Oct 30 | SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 |
| CVE-2026-107310 New | DR Drupal Drupal | 4.3 | Oct 30 | Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 |
| CVE-2026-107312 New | DR Drupal Drupal | 4.3 | Oct 30 | Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 |
| CVE-2026-107262 New | DR Drupal Drupal | 5.3 | Oct 30 | Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 |
| CVE-2026-114572 New | DR Drupal Drupal | 5.4 | Oct 30 | Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 |
| CVE-2026-118539 New | DR Drupal Drupal | 6.5 | Oct 30 | Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 |
| CVE-2026-91920 New | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 6.5 | Oct 30 | Undertow: undertow: chunkreader message length permits chunk-size overflow |
| CVE-2026-110133 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.8 | Oct 30 | Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback |
| CVE-2026-118959 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 30 | Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter |
| CVE-2026-118947 New | RH Red Hat Build of Keycloak Red Hat | 4.3 | Oct 30 | Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor |
| CVE-2026-119272 New | CH Chrome Google | 4.3 | Oct 30 | Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page |
| CVE-2026-76027 New | CH Chrome Google | 4.3 | Oct 30 | Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page |
| CVE-2026-76024 New | CH Chrome Google | 6.5 | Oct 30 | Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page |
| CVE-2026-119285 New | FI fiber gofiber | 5.9 | Oct 29 | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads |
| CVE-2026-119284 New | JO joserfc authlib | 6.9 | Oct 29 | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection |
| CVE-2026-61673 New | WE WeGIA LabRedesCefetRJ | 6.3 | Oct 29 | WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover |
| CVE-2026-119317 New | PF Plugin Feed Tenable, Inc. | 6.5 | Oct 29 | Incorrect Authorization |
| CVE-2026-119281 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing |
| CVE-2026-119279 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths |
| CVE-2026-119278 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication |
| CVE-2026-119277 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths |
| CVE-2026-119276 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets |
| CVE-2026-119210 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files |
| CVE-2026-119209 New | PY pypdf py-pdf | 5.5 | Oct 29 | pypdf: Possible large memory usage when parsing cross-reference streams |
| CVE-2026-119201 New | NU nuxt nuxt | 4.8 | Oct 29 | Nuxt dev server exposes generated appSecret through Vite file serving |
| CVE-2026-119200 New | NI nitro-server @nuxt | 6.5 | Oct 29 | Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
| CVE-2026-119199 New | NU nuxt nuxt | 5.9 | Oct 29 | Nuxt dev server exposes private runtime config through the Nitro dev bundle |
| CVE-2026-119198 New | NU nuxt nuxt | 5.9 | Oct 29 | Nuxt dev server arbitrary file read through client error reports |
| CVE-2026-119193 New | PH phpunit sebastianbergmann | 5.4 | Oct 29 | PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling |
| CVE-2026-119189 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage |
| CVE-2026-119186 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: AES-GCM authentication bypass via unvalidated tagLength option |
| CVE-2026-6877 New | SA ServiceNow AI Platform ServiceNow | 5.3 | Oct 29 | Domain Separation Bypass in ServiceNow AI Platform |
| CVE-2026-118778 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: TLS client crash when the server sends no certificate |
| CVE-2026-118777 New | FO forge digitalbazaar | 4.8 | Oct 29 | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie |
| CVE-2026-119251 New | WD WiFiman Desktop for macOS Ubiquiti Inc | 6.7 | Oct 29 | A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the… |