CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85498 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 29 | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow |
| CVE-2026-115303 New | CF Contact Form by Supsystic | 3.7 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping |
| CVE-2026-118585 New | IN inventariobasico configuroweb | 3.5 | Oct 28 | configuroweb inventariobasico Add Product addlist.php cross site scripting |
| CVE-2026-118691 New | XI xianyu-auto-reply-fix GuDong2003 | 3.7 | Oct 28 | xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message |
| CVE-2026-3583 New | WA WSO2 API Control Plane WSO2 | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] |
| CVE-2026-118681 New | CH chi go-chi | 3.7 | Oct 28 | go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware |
| CVE-2026-118258 New | I1 i18next-http-backend i18next | 3.7 | Oct 28 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string |
| CVE-2026-118256 New | VU vue-i18n intlify | 2.1 | Oct 28 | Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list |
| CVE-2026-105615 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats |
| CVE-2026-105612 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles |
| CVE-2026-118608 New | IL iLX-F511 Alpine | 3.5 | Oct 28 | Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2026-103394 New | SS Session Smart Router Juniper Networks | 3.7 | Oct 28 | Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. |
| CVE-2026-21830 New | BA BigFix AEX HCL Software | 3.7 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-101272 New | Product not mapped yet | 2.3 | Oct 28 | Incorrect session validation for API-created shredder exports |
| CVE-2026-87100 New | AC Acronis Cyber Protect 17 Acronis | 3.6 | Oct 28 | Protection mechanism failure due to missing binary hardening in Linux executables |
| CVE-2026-87098 New | AC Acronis Cyber Protect 17 Acronis | 3.1 | Oct 28 | Sensitive information disclosure due to improper authorization |
| CVE-2026-86401 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90719 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90721 New | PD PowerProtect Data Domain Dell | 3.4 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90723 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90724 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-113494 New | GE GeoDirectory | 2.7 | Oct 28 | GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode |
| CVE-2026-111961 New | RM Royal MCP | 3.8 | Oct 28 | Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page |
| CVE-2026-111032 New | WE Welcart e-Commerce | 3.8 | Oct 28 | Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax |
| CVE-2026-110507 New | PB Page Builder by SiteOrigin | 2.7 | Oct 28 | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments |
| CVE-2026-106647 New | RA Royal Addons for Elementor | 3.8 | Oct 28 | Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision |
| CVE-2026-118276 New | A2 a2ui a2ui-project | 3.5 | Oct 28 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-57199 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers |
| CVE-2026-116775 New | RU russh Eugeny | 2.3 | Oct 27 | pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) |
| CVE-2026-116696 New | RU russh Eugeny | 3.3 | Oct 27 | russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages |
| CVE-2026-103995 New | CP CPython Python Software Foundation | 2.0 | Oct 27 | Lenient parsing of integers for response body and chunk framing |
| CVE-2026-116687 New | CK ckeditor5 ckeditor | 3.1 | Oct 27 | CKEditor: Cross-site scripting (XSS) in the engine package |
| CVE-2026-108311 New | TS Tanium Server Tanium | 2.7 | Oct 27 | Tanium addressed an insufficient logging vulnerability in Tanium Server. |
| CVE-2026-108330 New | EC Endpoint Configuration Toolset Solution Tanium | 3.6 | Oct 27 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. |
| CVE-2026-108333 New | EC Endpoint Configuration Toolset Solution Tanium | 2.5 | Oct 27 | Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. |
| CVE-2026-108331 New | EC Endpoint Configuration Toolset Solution Tanium | 3.3 | Oct 27 | Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. |
| CVE-2026-57189 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Generation Accumulation OOB Write |
| CVE-2026-57198 New | AS asterisk asterisk | 2.3 | Oct 27 | Asterisk: Possible RED T.140 Heap Buffer Overflow |
| CVE-2026-116673 New | SY systeminformation sebhildebrandt | 3.3 | Oct 27 | systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net |
| CVE-2026-67400 New | RI Richdocuments Nextcloud | 3.5 | Oct 27 | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token |
| CVE-2026-77171 New | CO Collectives Nextcloud | 3.5 | Oct 27 | A public shared collective always allowed recipients of the link to create pages |
| CVE-2026-82983 New | TA Tables Nextcloud | 3.3 | Oct 27 | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning… |
| CVE-2026-109823 New | TI tidewave tidewave-ai | 2.3 | Oct 27 | Host filesystem path disclosure via DNS rebinding |
| CVE-2026-90727 New | PD PowerProtect Data Domain Dell | 3.8 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-107590 New | QT Qt qt | 1.9 | Oct 27 | Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt |
| CVE-2026-117499 New | FA @fastify/session @fastify/session | 3.7 | Oct 27 | @fastify/session vulnerable to session revocation bypass via a logout race condition |
| CVE-2026-117539 New | SV svg-sanitizer darylldoyle | 3.5 | Oct 27 | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass |