CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118651 New | EC echo labstack | 5.3 | Oct 28 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-63190 New | FE FearlessCMS fearlessgeekmedia | 9.4 | Oct 28 | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS |
| CVE-2026-118650 New | EC echo labstack | 7.5 | Oct 28 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-118266 New | EC echo labstack | 5.3 | Oct 28 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-78674 New | BP Business Process Server WSO2 | 8.8 | Oct 28 | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution |
| CVE-2026-6647 New | WC WSO2 Carbon OAuth WSO2 | 7.4 | Oct 28 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events |
| CVE-2026-3583 New | WA WSO2 API Control Plane WSO2 | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] |
| CVE-2026-11854 New | WA WSO2 API Control Plane WSO2 | 6.1 | Oct 28 | Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products |
| CVE-2025-14260 New | SS SAML2 SSO Authenticator UI Bundle WSO2 | 8.3 | Oct 28 | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources |
| CVE-2026-109411 New | SA Samba Samba | 8.1 | Oct 28 | Samba: access control bypass via vfs_ceph_rgw case-insensitive open |
| CVE-2026-118265 New | EC echo labstack | 5.3 | Oct 28 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118264 New | EC echo labstack | 9.1 | Oct 28 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-118263 New | EC echo labstack | 6.3 | Oct 28 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118262 New | EC echo labstack | 8.2 | Oct 28 | Echo: WebSocket proxy can retain connections and handlers after client disconnect |
| CVE-2026-118688 New | WA wasmtime bytecodealliance | 7.9 | Oct 28 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename |
| CVE-2026-118687 New | CO coder coder | 6.5 | Oct 28 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication |
| CVE-2026-118686 New | ES espocrm espocrm | 7.5 | Oct 28 | EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex |
| CVE-2026-118685 New | TO ToolJet ToolJet | 6.5 | Oct 28 | ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard |
| CVE-2026-118684 New | MO MONAI Project-MONAI | 5.9 | Oct 28 | MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads |
| CVE-2026-118683 New | MO MONAI Project-MONAI | 8.8 | Oct 28 | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf |
| CVE-2026-118681 New | CH chi go-chi | 3.7 | Oct 28 | go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware |
| CVE-2026-118680 New | SI siyuan siyuan-note | 4.4 | Oct 28 | SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias |
| CVE-2026-118679 New | N8 n8n n8n-io | 7.5 | Oct 28 | n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger |
| CVE-2026-118678 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction |
| CVE-2026-118677 New | N8 n8n n8n-io | 5.9 | Oct 28 | n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance |
| CVE-2026-118676 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass |
| CVE-2026-118675 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow |
| CVE-2026-118649 New | N8 n8n n8n-io | 8.3 | Oct 28 | n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables |
| CVE-2026-118648 New | N8 n8n n8n-io | 7.3 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy |
| CVE-2026-118647 New | N8 n8n n8n-io | 8.2 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data |
| CVE-2026-118646 New | N8 n8n n8n-io | 6.5 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node |
| CVE-2026-118645 New | N8 n8n n8n-io | 8.7 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter |
| CVE-2026-118644 New | N8 n8n n8n-io | 7.7 | Oct 28 | n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance |
| CVE-2026-118643 New | N8 n8n n8n-io | 8.2 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data |
| CVE-2026-118642 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows |
| CVE-2026-118641 New | N8 n8n n8n-io | 7.5 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes |
| CVE-2026-118640 New | N8 n8n n8n-io | 5.4 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass |
| CVE-2026-118261 New | EC echo labstack | 8.2 | Oct 28 | Echo: Decompress permits unbounded gzip expansion in v4 |
| CVE-2026-118260 New | EC echo labstack | 8.2 | Oct 28 | Echo: BodyDump captures request and response bodies without size limits in v4 |
| CVE-2026-118259 New | OP opentelemetry-java open-telemetry | 5.3 | Oct 28 | opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing |
| CVE-2026-118633 New | SU SG UTM Sophos | 8.1 | Oct 28 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining… |
| CVE-2026-118258 New | I1 i18next-http-backend i18next | 3.7 | Oct 28 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string |
| CVE-2026-118257 New | VU vue-i18n intlify | 7.2 | Oct 28 | Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages |
| CVE-2026-118256 New | VU vue-i18n intlify | 2.1 | Oct 28 | Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list |
| CVE-2026-118255 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Grid: javascript: URL in credits.href runs script on click |
| CVE-2026-118254 New | GR grid-lite @highcharts | 8.6 | Oct 28 | Highcharts Grid: pagination language options are parsed as HTML |
| CVE-2026-118253 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: fullscreen labels are parsed as HTML |
| CVE-2026-118252 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: sidebar component labels are parsed as HTML |
| CVE-2026-106484 New | CH chrome-devtools-mcp Google | 4.4 | Oct 28 | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file |
| CVE-2026-118251 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts: javascript: URL in credits.href runs script on click |