CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 17:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119133 New | WA wasmtime bytecodealliance | 2.6 | Oct 29 | Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags |
| CVE-2026-119130 New | WA wasmtime bytecodealliance | 2.6 | Oct 29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling |
| CVE-2026-119126 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys |
| CVE-2026-119125 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields |
| CVE-2026-119124 New | IM ImageMagick ImageMagick | 3.3 | Oct 29 | ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option |
| CVE-2026-119123 New | IM ImageMagick ImageMagick | 3.7 | Oct 29 | ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder |
| CVE-2026-112255 New | AA Advanced Authentication Server OpenText | 2.9 | Oct 29 | Endpoint credential minting (insecure default allow-list) |
| CVE-2026-104312 New | LO Langflow OSS IBM | 3.5 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities |
| CVE-2026-85498 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 29 | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow |
| CVE-2026-115303 New | CF Contact Form by Supsystic | 3.7 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping |
| CVE-2026-85007 New | VP Video Player for YouTube | 3.8 | Oct 29 | YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax |
| CVE-2026-108686 New | WP WP Post Author | 3.7 | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure |
| CVE-2026-108685 New | WP WP Post Author | 3.7 | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields |
| CVE-2026-105258 New | AB Appointment Booking Plugin | 3.5 | Oct 29 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings |
| CVE-2024-3586 New | LE LetterPress | 3.5 | Oct 29 | LetterPress < 2.4.0 - Admin+ Stored XSS |
| CVE-2026-118585 New | IN inventariobasico configuroweb | 3.5 | Oct 28 | configuroweb inventariobasico Add Product addlist.php cross site scripting |
| CVE-2026-118691 New | XI xianyu-auto-reply-fix GuDong2003 | 3.7 | Oct 28 | xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message |
| CVE-2026-3583 New | WA WSO2 API Control Plane WSO2 | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] |
| CVE-2026-118681 New | CH chi go-chi | 3.7 | Oct 28 | go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware |
| CVE-2026-118258 New | I1 i18next-http-backend i18next | 3.7 | Oct 28 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string |
| CVE-2026-118256 New | VU vue-i18n intlify | 2.1 | Oct 28 | Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list |
| CVE-2026-105615 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats |
| CVE-2026-105612 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles |
| CVE-2026-118608 New | IL iLX-F511 Alpine | 3.5 | Oct 28 | Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2026-103394 New | SS Session Smart Router Juniper Networks | 3.7 | Oct 28 | Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. |
| CVE-2026-21830 New | BA BigFix AEX HCL Software | 3.7 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-101272 New | Product not mapped yet | 2.3 | Oct 28 | Incorrect session validation for API-created shredder exports |
| CVE-2026-87100 New | AC Acronis Cyber Protect 17 Acronis | 3.6 | Oct 28 | Protection mechanism failure due to missing binary hardening in Linux executables |
| CVE-2026-87098 New | AC Acronis Cyber Protect 17 Acronis | 3.1 | Oct 28 | Sensitive information disclosure due to improper authorization |
| CVE-2026-86401 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90719 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90721 New | PD PowerProtect Data Domain Dell | 3.4 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90723 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90724 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-113494 New | GE GeoDirectory | 2.7 | Oct 28 | GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode |
| CVE-2026-111961 New | RM Royal MCP | 3.8 | Oct 28 | Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page |
| CVE-2026-111032 New | WE Welcart e-Commerce | 3.8 | Oct 28 | Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax |
| CVE-2026-110507 New | PB Page Builder by SiteOrigin | 2.7 | Oct 28 | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments |
| CVE-2026-106647 New | RA Royal Addons for Elementor | 3.8 | Oct 28 | Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision |
| CVE-2026-118276 New | A2 a2ui a2ui-project | 3.5 | Oct 28 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-57199 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers |
| CVE-2026-116775 New | RU russh Eugeny | 2.3 | Oct 27 | pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) |
| CVE-2026-116696 New | RU russh Eugeny | 3.3 | Oct 27 | russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages |
| CVE-2026-103995 New | CP CPython Python Software Foundation | 2.0 | Oct 27 | Lenient parsing of integers for response body and chunk framing |
| CVE-2026-116687 New | CK ckeditor5 ckeditor | 3.1 | Oct 27 | CKEditor: Cross-site scripting (XSS) in the engine package |
| CVE-2026-108311 New | TS Tanium Server Tanium | 2.7 | Oct 27 | Tanium addressed an insufficient logging vulnerability in Tanium Server. |
| CVE-2026-108330 New | EC Endpoint Configuration Toolset Solution Tanium | 3.6 | Oct 27 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. |