CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106339 | CH Chrome Google | 3.1 | Oct 6 | Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data… |
| CVE-2026-106399 | CH Chrome Google | 3.3 | Oct 6 | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file |
| CVE-2026-106210 | CH Chrome Google | 3.1 | Oct 6 | Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension |
| CVE-2026-106180 | CH Chrome Google | 3.1 | Oct 6 | Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page |
| CVE-2026-106224 | CH Chrome Google | 3.1 | Oct 6 | Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a… |
| CVE-2026-106101 | QU quasar quasarframework | 3.1 | Oct 6 | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service |
| CVE-2026-105950 | FO formwork getformwork | 3.5 | Oct 6 | getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting |
| CVE-2026-105800 | I1 i18next-http-backend i18next | 3.7 | Oct 6 | i18next-http-backend incomplete URL validation permits SSRF |
| CVE-2026-105799 | RE redis @langchain | 2.3 | Oct 6 | LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values |
| CVE-2026-105795 | KI kiota microsoft | 3.1 | Oct 6 | Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests |
| CVE-2026-106026 | TF tftp-hpa H. Peter Anvin | 3.7 | Oct 6 | tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule |
| CVE-2026-56596 | HB HCL BigFix Service Management HCL Software | 3.5 | Oct 6 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-75820 | AS Aspell GNU | 1.8 | Oct 6 | Integer Truncation Leading to Heap Corruption in GNU Aspell |
| CVE-2026-75819 | AS Aspell GNU | 1.8 | Oct 6 | Out-of-bounds Read in GNU Aspell |
| CVE-2026-75818 | AS Aspell GNU | 1.8 | Oct 6 | Heap Buffer Overflow in GNU Aspell's prezip utility |
| CVE-2026-105808 | SS Simple Student Information System SourceCodester | 3.5 | Oct 6 | SourceCodester Simple Student Information System searchresults.php clean cross site scripting |
| CVE-2026-105611 | SP SpringBlade chillzhuang | 2.7 | Oct 6 | chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization |
| CVE-2026-105752 | VL vllm vllm-project | 3.1 | Oct 5 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle |
| CVE-2026-105767 | CA Chainguard Academy (edu) Chainguard | 3.3 | Oct 5 | Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands |
| CVE-2026-105766 | CA Chainguard Academy (edu) Chainguard | 3.1 | Oct 5 | Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP |
| CVE-2026-105683 | GH Ghost TryGhost | 3.8 | Oct 5 | Ghost: Path Traversal Vulnerability in Ghost ImageSize Service |
| CVE-2026-105682 | GH Ghost TryGhost | 2.7 | Oct 5 | Ghost: Server-Side Request Forgery in Webhook Trigger |
| CVE-2026-105652 | GH Ghost TryGhost | 3.1 | Oct 5 | Ghost: Password Hash Ordering Disclosure in Ghost Admin API |
| CVE-2026-105326 | RH Red Hat Enterprise Linux 10 Red Hat | 2.5 | Oct 5 | Cups: cups: argument injection in mailto notifier via notify-recipient-uri |
| CVE-2026-105712 | GN GnuPG GnuPG | 3.6 | Oct 5 | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive |
| CVE-2026-58856 | AN Android Google | 3.3 | Oct 5 | In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check |
| CVE-2026-77803 | PT Progress® Telerik® Fiddler® Classic Progress Software | 3.6 | Oct 5 | Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic |
| CVE-2026-59783 | ZA Zabbix Zabbix | 2.3 | Oct 5 | Server DoS via binary items |
| CVE-2026-105289 | FE feelcrm-os feelec-yishu | 3.5 | Oct 5 | feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting |
| CVE-2026-104808 | MM Mitel MiVoice Office 400 Mitel | 1.9 | Oct 5 | Mitel MiVoice Office 400 stored Cross-Site Scripting |
| CVE-2026-104807 | MM Mitel MiVoice Office 400 Mitel | 1.9 | Oct 5 | Mitel MiVoice Office 400 stored Cross-Site Scripting |
| CVE-2026-105245 | SG sglang sgl-project | 3.7 | Oct 5 | sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission |
| CVE-2026-105237 | LI litemall linlinjava | 3.7 | Oct 5 | linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication |
| CVE-2026-105188 | HR Human Resource Management System code-projects | 3.5 | Oct 5 | code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting |
| CVE-2026-105179 | DR Drug Recommendation System SourceCodester | 2.7 | Oct 5 | SourceCodester Drug Recommendation System Password add_user.php missing encryption |
| CVE-2026-105173 | HR Human Resource Management code-projects | 3.5 | Oct 5 | code-projects Human Resource Management Event Creation EventStore.php cross site scripting |
| CVE-2026-105164 | CF cFS NASA | 2.7 | Oct 4 | NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds |
| CVE-2026-105217 | CO cockpit cockpit-hq | 3.1 | Oct 4 | Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php |
| CVE-2026-105214 | ZI zitadel zitadel | 2.3 | Oct 4 | Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification |
| CVE-2026-105156 | YZ YzmCMS Yzmcms | 3.7 | Oct 4 | YzmCMS MD5 system.func.php password weak password hash |
| CVE-2026-104119 | SS Simple Shopping Cart | 3.5 | Oct 4 | Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials |
| CVE-2026-105099 | CC CoinEx Crypto Omega Solution | 3.5 | Oct 4 | Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting |
| CVE-2026-105130 | LA laradashboard laradashboard | 3.7 | Oct 3 | LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit |
| CVE-2026-105125 | LA laradashboard laradashboard | 3.7 | Oct 3 | LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint |
| CVE-2026-96962 | PR Pie Register | 3.7 | Oct 3 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code |
| CVE-2026-86834 | ME MetForm | 3.7 | Oct 3 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration |
| CVE-2026-80518 | WU WP Ultimate CSV Importer | 3.7 | Oct 3 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path |
| CVE-2026-80517 | WU WP Ultimate CSV Importer | 3.5 | Oct 3 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload |
| CVE-2026-105051 | DA Denuvo Anti-Tamper Irdeto | 1.9 | Oct 2 | Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel) |
| CVE-2026-105043 | SI Simulink MathWorks | 3.6 | Oct 2 | MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution |