CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 06:13 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-64856 | FI FileRise error311 | 3.7 | Oct 14 | FileRise: Missing Authentication Guard on File Snippet Preview Endpoint |
| CVE-2026-0316 | PA PAN-OS Palo Alto Networks | 1.1 | Oct 14 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability |
| CVE-2026-0317 | PA PAN-OS Palo Alto Networks | 1.2 | Oct 14 | PAN-OS: Denial of Service Vulnerability |
| CVE-2026-110762 | BB bbPress bbPress | 3.7 | Oct 14 | bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream |
| CVE-2026-82153 | OR OS Recovery Tool Dell | 2.2 | Oct 14 | Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability |
| CVE-2026-103930 | CP cpp-httplib yhirose | 3.7 | Oct 14 | cpp-httplib open_stream serializes CRLF in request target into HTTP request line |
| CVE-2026-101946 | JO Junos OS Juniper | 3.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used |
| CVE-2026-93637 | CO Collaboration Zimbra | 3.7 | Oct 14 | Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting |
| CVE-2026-101991 | JO Junos OS Juniper | 3.1 | Oct 14 | Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled |
| CVE-2026-77564 | TA talos siderolabs | 3.3 | Oct 14 | Talos Linux: Support bundle does not redact registry credentials |
| CVE-2026-110736 | GE Godot Engine godotengine | 3.6 | Oct 14 | Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message) |
| CVE-2026-49206 | RA rapidcsv d99kris | 2.9 | Oct 14 | rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access |
| CVE-2026-110735 | GE Godot Engine godotengine | 2.5 | Oct 14 | Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string) |
| CVE-2026-110734 | GE Godot Engine godotengine | 2.5 | Oct 14 | Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp) |
| CVE-2026-77572 | VE VeraCrypt veracrypt | 3.3 | Oct 14 | VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt |
| CVE-2026-110661 | CG CGNS CGNS | 3.3 | Oct 14 | CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header |
| CVE-2026-110660 | VG vgmstream vgmstream | 3.3 | Oct 14 | vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder |
| CVE-2026-110657 | NN nnef Khronos Group | 3.3 | Oct 14 | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label |
| CVE-2026-110656 | MI miniupnpc miniupnp project | 3.1 | Oct 14 | miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt |
| CVE-2026-110655 | MI miniupnpc miniupnp project | 3.1 | Oct 14 | miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt |
| CVE-2026-60008 | GI Gitea Gitea | 3.5 | Oct 14 | Gitea Jupyter notebook UI redress through CSS class injection |
| CVE-2026-110624 | PA papermerge-core papermerge | 3.1 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all |
| CVE-2026-110606 | LI libdxfrw LibreCAD | 3.3 | Oct 14 | LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader |
| CVE-2026-110604 | MI Mini-XML Michael R Sweet | 3.6 | Oct 14 | Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod() |
| CVE-2026-110592 | BO BottleCRM MicroPyramid | 3.5 | Oct 14 | BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template |
| CVE-2026-110262 | AS ASM OW2 | 3.3 | Oct 14 | OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter |
| CVE-2024-58392 | PH PhysicsFS icculus | 3.3 | Oct 14 | PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint |
| CVE-2026-88842 | RH Red Hat Hardened Images Red Hat | 3.3 | Oct 14 | Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption |
| CVE-2026-73792 | HN HPE NonStop Java JToolkit Hewlett Packard Enterprise | 3.8 | Oct 14 | HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability |
| CVE-2026-73791 | HN HPE NonStop Hpjmeter Hewlett Packard Enterprise | 2.0 | Oct 14 | HPE NonStop Hpjmeter - Buffer overflow vulnerability |
| CVE-2026-108066 | W2 WP 2FA | 2.7 | Oct 14 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR |
| CVE-2026-110458 | UP UniFi Protect AI Key Ubiquiti Inc | 3.7 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on… |
| CVE-2026-110457 | UP UniFi Protect AI Key Ubiquiti Inc | 3.7 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about… |
| CVE-2026-77205 | LI libreswan The Libreswan Project | 3.7 | Oct 13 | Denial of Service via sending bogus X.509 certificates |
| CVE-2026-110141 | CH Chrome Google | 3.1 | Oct 13 | Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page |
| CVE-2026-108388 | IN indico indico | 3.5 | Oct 13 | Indico legacy contribution export cache poisoning discloses restricted metadata |
| CVE-2026-110256 | DO dockhand Finsys | 3.7 | Oct 13 | Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth |
| CVE-2026-110232 | FF Fossify File Manager Fossify | 3.3 | Oct 13 | Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity |
| CVE-2026-110225 | SH Shaarli shaarli | 2.7 | Oct 13 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route |
| CVE-2026-110223 | KA Kavita Kareadita | 3.1 | Oct 13 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint |
| CVE-2026-110218 | AE Aureus ERP Webkul | 3.7 | Oct 13 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL |
| CVE-2026-110214 | SN Snowy xiaonuobase | 3.7 | Oct 13 | Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download |
| CVE-2026-110036 | RH Red Hat Enterprise Linux 10 Red Hat | 3.3 | Oct 13 | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices |
| CVE-2026-106175 | FO FortiOS Fortinet | 2.3 | Oct 13 | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6,… |
| CVE-2026-106176 | FO FortiSIEM Fortinet | 3.8 | Oct 13 | A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests |
| CVE-2026-88834 | RH Red Hat Hardened Images Red Hat | 3.7 | Oct 13 | Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds |
| CVE-2026-109526 | TO Toonflow-app HBAI-Ltd | 3.3 | Oct 13 | HBAI-Ltd Toonflow-app exportData Endpoint information disclosure |
| CVE-2026-65200 | OP openBMC Huawei | 3.5 | Oct 13 | Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses |
| CVE-2026-65197 | HF HDM Family-A G5 H3C | 3.1 | Oct 13 | H3C G3/G5 HDM Firmware Verification Key Replacement |
| CVE-2026-109410 | MA mall macrozheng | 2.4 | Oct 13 | macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation |