CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:50 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42023 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42022 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42021 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42026 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):… |
| CVE-2026-42025 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):… |
| CVE-2026-9660 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9659 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9814 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9817 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9827 | TO Totolink totolink | 9.1 | Oct 20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9869 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10131 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10132 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10133 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10135 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10136 | TO Totolink totolink | 9.1 | Oct 20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10137 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10138 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10139 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10141 | TO Totolink totolink | 9.1 | Oct 20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-87866 | CU curl curl | 9.1 | Oct 20 | wolfSSL public-key pinning bypass |
| CVE-2026-112380 | KC Kiro Crew Amazon | 9.9 | Oct 20 | Missing authorization in the WhatsApp channel in Kiro Crew |
| CVE-2026-86411 | CU curl curl | 9.1 | Oct 20 | FTP connection reuse inherits client-certificate |
| CVE-2026-113867 | Product not mapped yet | 9.1 | Oct 20 | Stanza injection in XMPP chat |
| CVE-2026-97406 | CA Console API Xerj | 9.1 | Oct 20 | Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting |
| CVE-2026-113709 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Kustomize Helm config home can run commands in the repo-server |
| CVE-2026-113708 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Kustomize remote ref can run commands in the repo-server |
| CVE-2026-113672 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Jsonnet import can read files from the repo-server |
| CVE-2026-113802 | WL WL-WN530BE1-A Wavlink | 9.8 | Oct 20 | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler |
| CVE-2026-105772 | AT ADK TypeScript (@google/adk) Google | 9.1 | Oct 20 | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId |
| CVE-2026-113506 | AA aaPanel Aapanel | 9.9 | Oct 20 | aaPanel File Manager common.py ExecShell os command injection |
| CVE-2026-113703 | SU SuggestArr giuseppe99barchetta | 9.3 | Oct 20 | SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing |
| CVE-2026-113678 | FR froxlor froxlor | 9.9 | Oct 20 | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron |
| CVE-2026-86471 | AC Apache CouchDB Apache Software Foundation | 9.3 | Oct 20 | Apache CouchDB: Admin credentials leading to code execution as operating system user |
| CVE-2026-93475 | ET Eclipse ThreadX - NetX Duo Eclipse Foundation | 9.3 | Oct 20 | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 |
| CVE-2026-103119 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: AJP response mix-up |
| CVE-2026-101356 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing |
| CVE-2026-101296 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms |
| CVE-2026-113399 | Product not mapped yet | 9.8 | Oct 20 | Incorrect boundary conditions in the SVG component |
| CVE-2026-113391 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection |
| CVE-2026-113620 | EI Eclipse ioFog Eclipse Foundation | 9.8 | Oct 20 | Eclipse ioFog operator WebSocket accepts an unverified JWT |
| CVE-2026-113390 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection |
| CVE-2026-113389 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection |
| CVE-2026-105312 | SF streams for Apache Kafka 2 Red Hat | 9.9 | Oct 20 | Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation |
| CVE-2026-9589 | US Unblu Spark Unblu inc. | 9.3 | Oct 20 | Unblu Spark Authorization Bypass in Configuration Cascade Operations |
| CVE-2026-43845 | AD ADAM-3600 Advantech | 9.2 | Oct 20 | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism |
| CVE-2026-43844 | AD ADAM-3600 Advantech | 9.3 | Oct 20 | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism |
| CVE-2026-43838 | AD ADAM-3600 Advantech | 9.2 | Oct 20 | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution |
| CVE-2026-43836 | AD ADAM-3600 Advantech | 9.3 | Oct 20 | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges |
| CVE-2026-113380 | RI RingRTC Signal | 9.3 | Oct 20 | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and… |