CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:21 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119281 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing |
| CVE-2026-119279 New | MA mariadb-connector-j mariadb-corporation | 5.9 | Oct 29 | MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths |
| CVE-2026-119201 New | NU nuxt nuxt | 4.8 | Oct 29 | Nuxt dev server exposes generated appSecret through Vite file serving |
| CVE-2026-119200 New | NI nitro-server @nuxt | 6.5 | Oct 29 | Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
| CVE-2026-119193 New | PH phpunit sebastianbergmann | 5.4 | Oct 29 | PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling |
| CVE-2026-119189 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage |
| CVE-2026-119186 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: AES-GCM authentication bypass via unvalidated tagLength option |
| CVE-2026-6877 New | SA ServiceNow AI Platform ServiceNow | 5.3 | Oct 29 | Domain Separation Bypass in ServiceNow AI Platform |
| CVE-2026-118778 New | FO forge digitalbazaar | 5.9 | Oct 29 | Forge: TLS client crash when the server sends no certificate |
| CVE-2026-118777 New | FO forge digitalbazaar | 4.8 | Oct 29 | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie |
| CVE-2026-119251 New | WD WiFiman Desktop for macOS Ubiquiti Inc | 6.7 | Oct 29 | A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the… |
| CVE-2026-118773 New | NO node-glob isaacs | 6.3 | Oct 29 | Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal |
| CVE-2026-102260 New | NO Nomad HashiCorp | 4.3 | Oct 29 | Nomad vulnerable to cross-namespace information disclosure in multiple endpoints |
| CVE-2026-116566 New | CP CPython Python Software Foundation | 5.3 | Oct 29 | socket.getaddrinfo() accepts embedded null bytes in host and port |
| CVE-2026-118768 New | BO botan randombit | 5.9 | Oct 29 | Botan: CLI utility `ocsp_check` accepts unauthenticated responses |
| CVE-2026-118767 New | BO botan randombit | 4.8 | Oct 29 | Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs |
| CVE-2026-118766 New | BO botan randombit | 6.1 | Oct 29 | Botan: Online OCSP redirects enable blind requests to internal HTTP services |
| CVE-2026-118760 New | PI pipelines kubeflow | 6.5 | Oct 29 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads |
| CVE-2025-12523 New | CE Centreon Centreon | 6.5 | Oct 29 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure |
| CVE-2026-118673 New | KE keepassxc keepassxreboot | 4.1 | Oct 29 | KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses |
| CVE-2025-13050 New | CE Centreon Centreon | 5.4 | Oct 29 | Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users |
| CVE-2026-119143 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes |
| CVE-2026-119142 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop |
| CVE-2026-119141 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc |
| CVE-2026-119140 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield |
| CVE-2026-119139 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call |
| CVE-2026-119138 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap |
| CVE-2026-119137 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry |
| CVE-2026-119136 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass |
| CVE-2026-119135 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch |
| CVE-2026-119134 New | WA wasmtime bytecodealliance | 6.2 | Oct 29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles |
| CVE-2026-119132 New | WA wasmtime bytecodealliance | 4.8 | Oct 29 | Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter |
| CVE-2026-119131 New | WA wasmtime bytecodealliance | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http |
| CVE-2026-119122 New | CR crawl4ai unclecode | 5.3 | Oct 29 | Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check |
| CVE-2026-119121 New | CR crawl4ai unclecode | 4.3 | Oct 29 | Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for |
| CVE-2026-119118 New | CR crawl4ai unclecode | 6.5 | Oct 29 | Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags |
| CVE-2026-90872 New | WS WS_FTP Server Progress Software | 6.6 | Oct 29 | Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server |
| CVE-2026-90871 New | WS WS_FTP Server Progress Software | 5.3 | Oct 29 | Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server |
| CVE-2026-90870 New | WS WS_FTP Server Progress Software | 5.3 | Oct 29 | Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server |
| CVE-2026-90862 New | WS WS_FTP Server Progress Software | 4.3 | Oct 29 | Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server |
| CVE-2026-90861 New | WS WS_FTP Server Progress Software | 6.6 | Oct 29 | Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server |
| CVE-2026-84296 New | WS WS_FTP Server Progress Software | 6.8 | Oct 29 | SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server |
| CVE-2026-115795 New | PN P-Net RT-Labs | 5.3 | Oct 29 | Out-of-bounds read of DCP block header in DCP Set and Identify request parsing |
| CVE-2026-118084 New | HB Hotel Booking nicdark | 6.5 | Oct 29 | WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-54865 New | PC Podamibe Custom User Gravatar Podamibe Nepal | 6.5 | Oct 29 | WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-42690 New | LE LearnPress ThimPress | 5.4 | Oct 29 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability |
| CVE-2026-66912 New | ZC Zimbra Collaboration Synacor | 5.3 | Oct 29 | Stored Cross-Site Scripting in Zimbra |
| CVE-2026-66911 New | ZC Zimbra Collaboration Synacor | 5.3 | Oct 29 | Stored Cross-Site Scripting in Zimbra |
| CVE-2026-88078 New | ME Microsoft Edge (Chromium-based) Microsoft | 4.3 | Oct 29 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
| CVE-2026-85330 New | ME Microsoft Edge (Chromium-based) Microsoft | 4.3 | Oct 29 | Microsoft Edge for Android Security Feature Bypass Vulnerability |