CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 16:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82986 New | TA Tables Nextcloud | 4.6 | Oct 27 | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission |
| CVE-2026-54462 New | PK pkg knative | 6.5 | Oct 27 | knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion |
| CVE-2026-115495 New | MV Mobile VPN with SSL Client WatchGuard | 5.7 | Oct 27 | Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket |
| CVE-2026-113881 New | FO Fireware OS WatchGuard | 6.1 | Oct 27 | Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution |
| CVE-2026-82332 New | FO Fireware OS WatchGuard | 5.7 | Oct 27 | Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking |
| CVE-2026-104381 New | FO Fireware OS WatchGuard | 6.0 | Oct 27 | Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service |
| CVE-2026-117510 New | DE Dexbotic Dexmal | 6.3 | Oct 27 | Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal |
| CVE-2026-117509 New | RA Rasa_NLU_Chi crownpku | 6.3 | Oct 27 | crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal |
| CVE-2026-117507 New | A2 a2a-java a2aproject | 5.4 | Oct 27 | a2aproject a2a-java TaskManager.saveTaskEvent race condition |
| CVE-2026-117506 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption |
| CVE-2026-117505 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java ChildQueue queue.offer resource consumption |
| CVE-2026-105987 New | TV tia Viewer KGS Software | 5.1 | Oct 27 | Stored XSS in KGS Software tia Viewer |
| CVE-2026-117504 New | A2 a2a-go a2aproject | 5.3 | Oct 27 | a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service |
| CVE-2026-90725 New | PD PowerProtect Data Domain Dell | 4.9 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-117503 New | A2 a2a-go a2aproject | 5.3 | Oct 27 | a2aproject a2a-go REST SSE handler rest.go resource consumption |
| CVE-2026-68866 New | PD PowerProtect Data Domain Dell | 6.5 | Oct 27 | PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30,… |
| CVE-2026-90726 New | PD PowerProtect Data Domain Dell | 6.0 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-10537 New | CM Control-M/Enterprise Manager BMC | 5.3 | Oct 27 | Remote unauthenticated information disclosure and denial of service due to unauthenticated service access |
| CVE-2026-16307 New | ED EdoWEB Netiket Information Technologies | 4.3 | Oct 27 | IDOR in Netiket Information Technologies' EdoWEB |
| CVE-2026-12887 New | OS Octopus Server Octopus Deploy | 5.1 | Oct 27 | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent… |
| CVE-2026-117603 New | EL electrum spesmilo | 4.3 | Oct 27 | Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass |
| CVE-2026-117570 New | NM nmap-mcp Vorota-ai | 5.2 | Oct 27 | nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities |
| CVE-2026-117566 New | EA EasyImages2.0 icret | 5.3 | Oct 27 | EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php |
| CVE-2026-117565 New | AR Artalk ArtalkJS | 5.3 | Oct 27 | Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch |
| CVE-2026-117563 New | MR MrDoc zmister2016 | 5.4 | Oct 27 | MrDoc through 1.1.1 Broken Access Control via manage_doc_share |
| CVE-2026-117562 New | RS rssant anyant | 5.3 | Oct 27 | rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint |
| CVE-2026-117557 New | SD SDL_image libsdl-org | 6.1 | Oct 27 | SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader |
| CVE-2026-117556 New | ZC zchunk zchunk | 4.3 | Oct 27 | zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface() |
| CVE-2026-117555 New | CI CImg GreycLab | 6.1 | Oct 27 | GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp() |
| CVE-2026-117554 New | AD admidio admidio | 4.3 | Oct 27 | Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php |
| CVE-2026-15586 New | ON Ontime İdvlabs Software and Consulting Services Inc. | 5.3 | Oct 27 | OTP Brute-Force Account Takeover in Idvlabs Software's Ontime |
| CVE-2026-114409 New | DD Docker Desktop Docker | 5.7 | Oct 27 | Docker Desktop logs can expose stored third-party credentials |
| CVE-2026-115408 New | EK Eclipse KeyPont Eclipse Foundation | 5.5 | Oct 27 | ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets |
| CVE-2026-113644 New | EI Eclipse ioFog Eclipse Foundation | 5.5 | Oct 27 | iofogctl command injection via Controller provisioning response |
| CVE-2026-90728 New | PD PowerProtect Data Domain Dell | 6.3 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-105323 New | KN Kulga News Software Kulga Software and Telecommunications Limited Company | 6.1 | Oct 27 | Reflected XSS in Kulga Software's Kulga News Software |
| CVE-2026-90729 New | PD PowerProtect Data Domain Dell | 6.7 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-41022 New | EA easySoft Eaton | 5.9 | Oct 27 | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices |
| CVE-2026-10752 New | AC Advanced Custom Fields: Extended hwk-fr | 4.8 | Oct 27 | Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field |
| CVE-2026-90730 New | PD PowerProtect Data Domain Dell | 6.5 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90731 New | PD PowerProtect Data Domain Dell | 4.9 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90732 New | PD PowerProtect Data Domain Dell | 4.9 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-56084 New | PD PowerProtect Data Domain Dell | 5.8 | Oct 27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-117541 New | SV svg-sanitizer darylldoyle | 5.3 | Oct 27 | svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() |
| CVE-2026-117538 New | CO core redaxo | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter |
| CVE-2026-117537 New | CO core redaxo | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter |
| CVE-2026-117535 New | CO core redaxo | 6.1 | Oct 27 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool |
| CVE-2026-117534 New | CO core redaxo | 5.4 | Oct 27 | REDAXO before 5.21.3 CSRF in Article History Plugin |
| CVE-2026-117533 New | CO core redaxo | 4.4 | Oct 27 | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads |
| CVE-2026-116900 New | CO core redaxo | 5.4 | Oct 27 | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets |