CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:12 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116489 New | PG pgvectorscale timescale | 7.5 | Oct 26 | Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes |
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-90885 New | AC Apache Camel Apache Software Foundation | 7.5 | Oct 26 | Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved |
| CVE-2026-77059 New | BO boneIO boneIO | 8.8 | Oct 26 | TOCTOU Race Condition in boneIO |
| CVE-2026-77056 New | BL black_debian_images boneIO | 7.1 | Oct 26 | Use of Default Credentials in boneIO |
| CVE-2026-77053 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication in Default Configuration in boneIO |
| CVE-2026-77052 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication for Node-RED in boneIO |
| CVE-2026-112345 New | TT TTLock Sciener | 8.1 | Oct 26 | TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure |
| CVE-2026-116339 New | AS astron-agent iFlytek | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist |
| CVE-2026-97200 New | HA hackney benoitc | 8.2 | Oct 26 | Unbounded response body buffering and decompression in hackney |
| CVE-2026-108529 New | BA bandit mtrudel | 8.7 | Oct 26 | SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit |
| CVE-2026-110499 New | BA bandit mtrudel | 8.7 | Oct 26 | Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit |
| CVE-2026-109584 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit |
| CVE-2026-111103 New | BA bandit mtrudel | 8.2 | Oct 26 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit |
| CVE-2026-111101 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit |
| CVE-2026-113436 New | BA bandit mtrudel | 8.7 | Oct 26 | Quadratic bignum parsing of Content-Length and Host port values in Bandit |
| CVE-2026-114213 New | BA bandit mtrudel | 8.7 | Oct 26 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit |
| CVE-2026-115269 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit |
| CVE-2026-108525 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit |
| CVE-2026-116219 New | DO dolibarr Dolibarr | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter |
| CVE-2026-116218 New | DO dolibarr Dolibarr | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field |
| CVE-2026-115193 New | Product not mapped yet | 8.2 | Oct 26 | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7 |
| CVE-2026-115192 New | Product not mapped yet | 7.1 | Oct 26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}) |
| CVE-2026-115191 New | Product not mapped yet | 7.1 | Oct 26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax) |
| CVE-2026-115190 New | Product not mapped yet | 8.0 | Oct 26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties |
| CVE-2026-115189 New | Product not mapped yet | 8.8 | Oct 26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic |
| CVE-2026-110474 New | AA Agentic AI Call Centre CreditNirvana | 8.7 | Oct 26 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application |
| CVE-2026-115717 New | BU builder frappe | 7.7 | Oct 26 | Frappe Builder before 1.36.1 SSRF via convert_to_webp |
| CVE-2026-94380 New | LM Liman MYS HAVELSAN Inc. | 8.1 | Oct 26 | Host Header Injection in HAVELSAN's Liman MYS |
| CVE-2026-116260 New | LI libimobiledevice Libimobiledevice | 7.3 | Oct 26 | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116469 New | MI misp-guard MISP | 7.1 | Oct 26 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding |
| CVE-2026-116257 New | BI BillaBear Billabear | 7.3 | Oct 26 | BillaBear Installation InstallController.php processInstall missing authentication |
| CVE-2026-115608 New | JE JetEngine Crocoblock | 8.5 | Oct 26 | WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability |
| CVE-2026-116256 New | RH RhaPHP geesondog | 7.3 | Oct 26 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery |
| CVE-2026-115948 New | ML Media LIbrary Assistant David Lingren | 8.5 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability |
| CVE-2026-116253 New | DE DedeCMS Dedecms | 7.3 | Oct 26 | DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection |
| CVE-2026-116237 New | PX Pugongying X5 Pro Oray | 8.4 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-116236 New | PX Pugongying X5 Pro Oray | 7.2 | Oct 26 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload |
| CVE-2026-82947 New | SO SOEM RT-Labs AB | 7.1 | Oct 26 | Multiple Out-of-Bounds Reads in Frame Processing |
| CVE-2026-82944 New | SO SOEM RT-Labs AB | 8.8 | Oct 26 | Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers |
| CVE-2026-111841 New | FA FunnelKit Automations Aman | 8.8 | Oct 26 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-116372 New | MI misp-guard MISP | 7.7 | Oct 26 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules |
| CVE-2026-70388 New | SO SOEM RT-Labs AB | 8.3 | Oct 26 | Memory Corruption via Integer Underflow in Message Length Validation |
| CVE-2026-96581 New | AS ash ash-project | 7.6 | Oct 26 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records |
| CVE-2026-107900 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107899 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107898 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107897 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107896 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107895 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |