CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 14:38 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119189 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage |
| CVE-2026-119188 New | FO forge digitalbazaar | 7.5 | Oct 29 | Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message |
| CVE-2026-119187 New | FO forge digitalbazaar | 7.5 | Oct 29 | Forge: Denial of service in TLS record processing via call stack exhaustion |
| CVE-2026-119186 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: AES-GCM authentication bypass via unvalidated tagLength option |
| CVE-2026-103093 New | SA ServiceNow AI Platform ServiceNow | 9.4 | Oct 29 | Sandbox Escape via Table Rotation in ServiceNow AI Platform |
| CVE-2026-118782 New | FO forge digitalbazaar | 7.5 | Oct 29 | Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count |
| CVE-2026-6877 New | SA ServiceNow AI Platform ServiceNow | 5.3 | Oct 29 | Domain Separation Bypass in ServiceNow AI Platform |
| CVE-2026-118781 New | FO forge digitalbazaar | 2.9 | Oct 29 | Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) |
| CVE-2026-118780 New | FO forge digitalbazaar | 3.7 | Oct 29 | Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store |
| CVE-2026-118779 New | FO forge digitalbazaar | 7.5 | Oct 29 | Forge: Regular expression denial of service in PEM decoding (pem.decode) |
| CVE-2026-118778 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: TLS client crash when the server sends no certificate |
| CVE-2026-118777 New | FO forge digitalbazaar | 4.8 | Oct 29 | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie |
| CVE-2026-103094 New | SA ServiceNow AI Platform ServiceNow | 7.1 | Oct 29 | Cleartext Storage of OAuth Credentials in ServiceNow AI Platform |
| CVE-2026-118776 New | FO forge digitalbazaar | 3.7 | Oct 29 | Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption |
| CVE-2026-118775 New | FO forge digitalbazaar | 3.7 | Oct 29 | Forge: ASN.1 OID first arc truncation in asn1.oidToDer |
| CVE-2026-118774 New | FO forge digitalbazaar | 3.7 | Oct 29 | Forge: Certificate signature verified with the issuer's RSA signature scheme |
| CVE-2026-119251 New | WD WiFiman Desktop for macOS Ubiquiti Inc | 6.7 | Oct 29 | A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the… |
| CVE-2026-118773 New | NO node-glob isaacs | 6.3 | Oct 29 | Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal |
| CVE-2026-119250 New | WD WiFiman Desktop for macOS Ubiquiti Inc | 7.8 | Oct 29 | A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary… |
| CVE-2026-119249 New | WD WiFiman Desktop for macOS Ubiquiti Inc | 7.5 | Oct 29 | A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the… |
| CVE-2026-41216 New | VT vtk vtk | 7.5 | Oct 29 | An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6 |
| CVE-2026-42057 New | VT vtk vtk | 7.5 | Oct 29 | An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6 |
| CVE-2026-8822 New | VT vtk vtk | 7.5 | Oct 29 | A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1) |
| CVE-2026-8824 New | VT vtk vtk | 7.5 | Oct 29 | A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1) |
| CVE-2026-9535 New | VT vtk vtk | 8.2 | Oct 29 | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1) |
| CVE-2026-9536 New | VT vtk vtk | 7.5 | Oct 29 | A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1) |
| CVE-2026-118772 New | JO joi @hapi | 7.5 | Oct 29 | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service |
| CVE-2026-119168 New | NO Nomad HashiCorp | 8.8 | Oct 29 | Nomad allocation data migration may allow host directory permission modification via symlink following |
| CVE-2026-107347 New | NO Nomad HashiCorp | 8.4 | Oct 29 | Nomad dispatch payload writes can escape the allocation directory through symlinks |
| CVE-2026-102260 New | NO Nomad HashiCorp | 4.3 | Oct 29 | Nomad vulnerable to cross-namespace information disclosure in multiple endpoints |
| CVE-2026-116566 New | CP CPython Python Software Foundation | 5.3 | Oct 29 | socket.getaddrinfo() accepts embedded null bytes in host and port |
| CVE-2026-118769 New | BO botan randombit | 9.2 | Oct 29 | Botan: Integer overflow when reporting block size in FFI can cause memory corruption |
| CVE-2026-118768 New | BO botan randombit | 5.9 | Oct 29 | Botan: CLI utility `ocsp_check` accepts unauthenticated responses |
| CVE-2026-118767 New | BO botan randombit | 4.8 | Oct 29 | Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs |
| CVE-2026-118766 New | BO botan randombit | 6.1 | Oct 29 | Botan: Online OCSP redirects enable blind requests to internal HTTP services |
| CVE-2026-118765 New | BO botan randombit | 7.3 | Oct 29 | Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state |
| CVE-2026-118764 New | MI minimatch isaacs | 8.7 | Oct 29 | minimatch: potential denial of service via globparts amplification |
| CVE-2026-118763 New | SI sigstore-js sigstore | 7.4 | Oct 29 | @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location |
| CVE-2026-118762 New | MO monkeytype monkeytypegame | 9.3 | Oct 29 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN |
| CVE-2026-115805 New | IA Insight Agent Rapid7 | 7.8 | Oct 29 | Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path |
| CVE-2026-11587 New | CE Centreon Centreon | 7.2 | Oct 29 | Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 |
| CVE-2023-7357 New | FP FlexNet Publisher Revera | 8.6 | Oct 29 | FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability |
| CVE-2026-118761 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory |
| CVE-2026-119115 New | AW aws-privateca-issuer AWS | 8.5 | Oct 29 | Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes |
| CVE-2026-118760 New | PI pipelines kubeflow | 6.5 | Oct 29 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads |
| CVE-2026-118759 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant |
| CVE-2025-12523 New | CE Centreon Centreon | 6.5 | Oct 29 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure |
| CVE-2026-62374 New | SD @sd-jwt/core openwallet-foundation | 7.1 | Oct 29 | SD JWT JS: Tampered disclosures silently dropped instead of rejected |
| CVE-2026-118758 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source |
| CVE-2026-118673 New | KE keepassxc keepassxreboot | 4.1 | Oct 29 | KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses |