CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117567 New | ES esp-mcp horw | 7.8 | Oct 27 | esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters |
| CVE-2026-117561 New | SF sf-mcp codefriar | 7.8 | Oct 27 | sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values |
| CVE-2026-117560 New | GE gemini-cli-extension atxp | 7.8 | Oct 27 | ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools |
| CVE-2026-117559 New | DR droidmind hyperb1iss | 7.8 | Oct 27 | DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass |
| CVE-2026-117558 New | AI ai-sdlc ai-sdlc-framework | 7.8 | Oct 27 | ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status |
| CVE-2026-117553 New | UM Umbraco-CMS umbraco | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning |
| CVE-2026-92546 New | AA Agentic AI / Agentic Ally Keepnet Labs Cybersecurity Inc. | 7.5 | Oct 27 | Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally |
| CVE-2026-47486 New | PH PhysX NVIDIA | 7.8 | Oct 27 | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write |
| CVE-2026-65151 New | NA NeMo Agent Toolkit NVIDIA | 8.4 | Oct 27 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue |
| CVE-2026-65120 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-24269 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-65119 New | TE TensorRT-LLM NVIDIA | 8.4 | Oct 27 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted… |
| CVE-2026-100164 New | AG Agentis Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. | 7.5 | Oct 27 | User Enumeration in Rolantis Information Technologies' Agentis |
| CVE-2026-106087 New | TS TRO600 Series Firmware Hitachi Energy | 8.7 | Oct 27 | TRO600 contains an arbitrary file read vulnerability |
| CVE-2026-10756 New | TS TRO600 Series Firmware Hitachi Energy | 7.7 | Oct 27 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost |
| CVE-2026-13162 New | C4 CoreTec 4 Hitachi Energy | 7.7 | Oct 27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device |
| CVE-2026-109995 New | AV Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode wplakeorg | 7.2 | Oct 27 | Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
| CVE-2026-41021 New | EA easyE4 Eaton | 7.5 | Oct 27 | Eaton easyE4 uses an insufficiently strong password policy |
| CVE-2026-102800 New | DE DJ-HelpfulArticles extension for Joomla dj-extensions.com | 8.7 | Oct 27 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 |
| CVE-2026-41020 New | EA easyE4 Eaton | 7.5 | Oct 27 | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid… |
| CVE-2026-4337 New | PU PuMuKIT PuMuKIT | 8.8 | Oct 27 | Unrestricted Upload of File in PuMuKIT application |
| CVE-2026-117540 New | SV svg-sanitizer darylldoyle | 7.5 | Oct 27 | svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop |
| CVE-2026-117536 New | CO core redaxo | 8.8 | Oct 27 | REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation |
| CVE-2026-116898 New | CO core redaxo | 7.1 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move |
| CVE-2026-116896 New | CO core redaxo | 7.5 | Oct 27 | REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables |
| CVE-2026-117466 New | OS Octopus Server Octopus Deploy | 8.6 | Oct 27 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator |
| CVE-2026-117341 New | OS Octopus Server Octopus Deploy | 7.7 | Oct 27 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log |
| CVE-2026-116870 New | OS Octopus Server Octopus Deploy | 8.7 | Oct 27 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently |
| CVE-2026-116890 New | SE SemanticMediaWiki SemanticMediaWiki | 7.3 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API |
| CVE-2026-116880 New | SE SemanticMediaWiki SemanticMediaWiki | 7.1 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions |
| CVE-2026-116878 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity |
| CVE-2026-116876 New | SE SemanticMediaWiki SemanticMediaWiki | 7.1 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected |
| CVE-2026-116873 New | SE SemanticMediaWiki SemanticMediaWiki | 7.3 | Oct 27 | Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update |
| CVE-2026-116872 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters |
| CVE-2026-116871 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask |
| CVE-2026-82121 New | HS HiRDB Server Version 10 Hitachi | 7.5 | Oct 27 | Origin Validation Error Vulnerability in HiRDB |
| CVE-2026-117494 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-117493 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-85299 New | CE Compute Engine Google Cloud | 8.3 | Oct 27 | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration |
| CVE-2026-65211 New | MB MBD-X12SPI SMCI | 7.2 | Oct 27 | Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability |
| CVE-2026-65220 New | MB MBD-X12SPI SMCI | 8.8 | Oct 27 | Supermicro BMC IPMI feature contains a Privilege escalation vulnerability |
| CVE-2026-65219 New | MB MBD-X12SPI SMCI | 7.4 | Oct 27 | Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability |
| CVE-2026-18449 New | X1 X12SPI SMCI | 7.5 | Oct 27 | Supermicro BMC contains a SMCRAKP Fixed Key vulnerability |
| CVE-2026-16521 New | MB MBD-X12STW-F SMCI | 7.2 | Oct 27 | Supermicro BMC's syslog feature contains a command injection vulnerability |
| CVE-2026-111461 New | OG OnCell G3150A-LTE Series Moxa | 7.5 | Oct 27 | SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series |
| CVE-2026-111460 New | OG OnCell G3150A-LTE Series Moxa | 7.7 | Oct 27 | Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series |
| CVE-2026-111459 New | MR Moxa Remote Connect Suite (MRC Client) Moxa | 7.6 | Oct 27 | Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) |
| CVE-2026-106174 New | FO FortiOS Fortinet | 7.5 | Oct 27 | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial… |
| CVE-2026-75891 New | KF Kirki – Freeform Page Builder, Website Builder & Customizer themeum | 8.8 | Oct 27 | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint |
| CVE-2026-111820 New | AI Analytics Insights – Google Analytics Dashboard for WordPress deconf | 7.2 | Oct 27 | Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title |