CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 09:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114615 | AU authlib authlib | 9.1 | Oct 22 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys |
| CVE-2026-114625 In wildKEV | VO VeloCloud Orchestrator Arista Networks | 9.9 | Oct 22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host |
| CVE-2026-115384 | WA wasmtime bytecodealliance | 9.9 | Oct 22 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow |
| CVE-2026-115377 | IN incus lxc | 9.9 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream |
| CVE-2026-115375 | IN incus lxc | 9.9 | Oct 22 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes |
| CVE-2022-51026 | BY bytebase bytebase | 9.8 | Oct 22 | Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login |
| CVE-2026-79876 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing |
| CVE-2026-79875 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access |
| CVE-2026-79874 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Authentication Bypass in the API allows Administrative Access of AOS-10 |
| CVE-2026-79873 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access |
| CVE-2026-79872 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.4 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8 |
| CVE-2026-79871 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10 |
| CVE-2026-79870 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass leads to Unauthorized Access in AOS-8 |
| CVE-2026-79869 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-10 |
| CVE-2026-79868 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8 |
| CVE-2026-79867 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-8 |
| CVE-2026-79866 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8 |
| CVE-2026-79865 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79864 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Command Injection Vulnerability in AOS-10 |
| CVE-2026-79863 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution |
| CVE-2026-79862 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution |
| CVE-2026-79861 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10 |
| CVE-2026-79860 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 |
| CVE-2026-79859 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 |
| CVE-2026-79858 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8 |
| CVE-2026-79857 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol |
| CVE-2026-79856 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8 |
| CVE-2026-79855 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise |
| CVE-2026-79854 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79853 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10 |
| CVE-2026-79852 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface |
| CVE-2026-79851 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79850 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-8 |
| CVE-2026-79849 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79848 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79847 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 |
| CVE-2026-79846 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Command Injection Vulnerabilities in AOS-8 |
| CVE-2026-79844 | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-10 |
| CVE-2026-114612 | LI litellm BerriAI | 9.9 | Oct 22 | LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
| CVE-2026-114611 | OC OCO-Server schorschii | 9.1 | Oct 22 | OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack |
| CVE-2026-114607 | BE better-auth better-auth | 9.1 | Oct 22 | better-auth: OAuth state can be used as a Magic Link to sign in as another user |
| CVE-2026-97631 | ED EDK2 TianoCore | 9.5 | Oct 22 | Pre-boot RCE in EDK II PXE driver |
| CVE-2026-85079 | EM EmberZNet Silicon Labs | 9.8 | Oct 22 | Out-of-bounds write in Zigbee Simple_Desc_req handling |
| CVE-2026-94502 | EM EmberZNet Silicon Labs | 9.8 | Oct 22 | Out-of-bounds write in Zigbee Publish Price Matrix handling |
| CVE-2026-85080 | EM EmberZNet Silicon Labs | 9.1 | Oct 22 | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling |
| CVE-2026-111497 In wildKEV | BR Brotli Google | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-102785 | YP YOOtheme Pro extension for Joomla yootheme.com | 10.0 | Oct 22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 |
| CVE-2026-112832 | RO Rootblox CozyThemes | 9.8 | Oct 22 | WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability |
| CVE-2022-51022 | YI YiShaAdmin liukuo362573 | 9.1 | Oct 22 | YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint |
| CVE-2021-48016 | DE DedeCMS DedeCMS | 9.8 | Oct 22 | DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php |