CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 23:17 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84409 | GS G520 Series Lantronix | 7.5 | Sep 29 | Lantronix G520 Series Cellular Gateway Cross-site Scripting |
| CVE-2026-102937 | VI virtualenv pypa | 7.3 | Sep 29 | virtualenv: Command injection via --prompt in activate.bat (batch activator) |
| CVE-2026-93853 | BA Barman EnterpriseDB | 7.2 | Sep 29 | Barman snapshot backup deletion trusts unverified backup catalog metadata |
| CVE-2026-102930 | VI virtualenv pypa | 7.7 | Sep 29 | virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use |
| CVE-2026-102925 | VI virtualenv pypa | 7.8 | Sep 29 | virtualenv bash and fish activation scripts execute commands embedded in paths |
| CVE-2026-94204 | DA Dashcam Android Application Viidure | 7.5 | Sep 29 | Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application |
| CVE-2026-102253 | IP iperf3 esnet | 7.5 | Sep 29 | iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS |
| CVE-2026-102878 | MC mcp-chrome-bridge hangwin | 8.1 | Sep 29 | mcp-chrome-bridge through 1.0.31 CORS Origin Bypass |
| CVE-2026-102876 | SU surrealdb surrealdb | 8.1 | Sep 29 | SurrealDB before 3.3.0 Cross-Tenant Access via Headers |
| CVE-2026-102875 | VL vlc videolan | 7.8 | Sep 29 | VLC media player before 3.0.24 Path Traversal via skins2 |
| CVE-2026-100298 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100296 | YS YSSD-RTMP-H5 Anjvision | 8.1 | Sep 29 | Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5 |
| CVE-2026-102327 | CH Chrome Google | 7.5 | Sep 29 | Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute… |
| CVE-2026-102321 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102302 | CH Chrome Google | 8.8 | Sep 29 | Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102324 | CH Chrome Google | 8.3 | Sep 29 | Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code… |
| CVE-2026-102301 | CH Chrome Google | 8.3 | Sep 29 | Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside… |
| CVE-2026-102328 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102326 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102323 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102299 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102317 | CH Chrome Google | 8.6 | Sep 29 | Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via… |
| CVE-2026-100294 | YS YSSD-RTMP-H5 Anjvision | 7.5 | Sep 29 | Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100293 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100292 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5 |
| CVE-2026-96274 | N4 Nova 430H eNodeB (model pBS3101SH) Baicells | 7.4 | Sep 29 | Uncaught exception in Baicells Nova 430H |
| CVE-2026-76728 | IO Instant ON Hewlett Packard Enterprise (HPE) | 7.2 | Sep 29 | Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs |
| CVE-2026-76727 | IO Instant ON Hewlett Packard Enterprise (HPE) | 7.2 | Sep 29 | Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON |
| CVE-2026-76726 | IO Instant ON Hewlett Packard Enterprise (HPE) | 8.1 | Sep 29 | Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint |
| CVE-2026-61519 | LC Liberu CRM Liberu Software | 8.8 | Sep 29 | Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember() |
| CVE-2026-102831 | JU jupyterlab jupyterlab | 8.1 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard |
| CVE-2026-102616 | WO WorkFlow-Engine risesoft-y9 | 7.3 | Sep 29 | risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection |
| CVE-2026-102826 | GI git-js steveukx | 8.1 | Sep 29 | simple-git allows command execution through unblocked Git configuration includes |
| CVE-2026-102823 | RU russh Eugeny | 7.5 | Sep 29 | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened |
| CVE-2026-84414 | I i IBM | 7.8 | Sep 29 | IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service [] |
| CVE-2026-102730 | ED eclipse-threadx/levelx(NAND driver) Eclipse Foundation | 8.6 | Sep 29 | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata… |
| CVE-2026-84421 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 29 | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-84422 | GD Guardium Data Protection IBM | 7.2 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-102728 | ND NetX Duo Eclipse Foundation | 7.5 | Sep 29 | Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them |
| CVE-2026-84440 | GD Guardium Data Protection IBM | 8.8 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-84842 | GD Guardium Data Protection IBM | 8.1 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-102242 | MT MCP Toolbox for Databases Google | 8.6 | Sep 29 | Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases |
| CVE-2026-102718 | ND NetX Duo Eclipse Foundation | 8.7 | Sep 29 | hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte… |
| CVE-2026-102716 | EC eclipse-threadx/netxduo Eclipse Foundation | 8.7 | Sep 29 | An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert |
| CVE-2026-102677 | EL electron electron | 8.8 | Sep 29 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
| CVE-2026-102715 | EC eclipse-threadx/netxduo Eclipse Foundation | 7.1 | Sep 29 | mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet |
| CVE-2026-102714 | ND NetX Duo Eclipse Foundation | 7.1 | Sep 29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`) |
| CVE-2026-102713 | ND NetX Duo Eclipse Foundation | 8.8 | Sep 29 | The TFTP server accepts a DATA datagram of any size |
| CVE-2026-102712 | ND NetX Duo Eclipse Foundation | 8.8 | Sep 29 | On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the… |
| CVE-2026-102709 | TH ThreadX Eclipse Foundation | 8.4 | Sep 29 | Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply… |