CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 19:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-95360 | CH Chrome Google | 5.3 | Sep 29 | Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page |
| CVE-2026-95303 | CH Chrome Google | 6.5 | Sep 29 | Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted… |
| CVE-2026-95370 | CH Chrome Google | 5.4 | Sep 29 | Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page |
| CVE-2026-95330 | CH Chrome Google | 6.5 | Sep 29 | Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page |
| CVE-2026-95320 | CH Chrome Google | 5.4 | Sep 29 | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted… |
| CVE-2026-95346 | CH Chrome Google | 4.8 | Sep 29 | UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic |
| CVE-2026-95337 | CH Chrome Google | 5.4 | Sep 29 | UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via… |
| CVE-2026-95294 | CH Chrome Google | 5.4 | Sep 29 | UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page |
| CVE-2026-95375 | CH Chrome Google | 6.3 | Sep 29 | Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a… |
| CVE-2026-95297 | CH Chrome Google | 6.5 | Sep 29 | Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page |
| CVE-2026-95382 | CH Chrome Google | 6.5 | Sep 29 | Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to… |
| CVE-2026-95366 | CH Chrome Google | 6.5 | Sep 29 | Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a… |
| CVE-2026-95287 | CH Chrome Google | 5.4 | Sep 29 | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a… |
| CVE-2026-95293 | CH Chrome Google | 4.7 | Sep 29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page |
| CVE-2026-95291 | CH Chrome Google | 5.4 | Sep 29 | UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page |
| CVE-2026-102759 | ND NetX Duo Eclipse Foundation | 6.3 | Sep 29 | NetX Secure TLS accepts an empty application-data record without verifying its message authentication code |
| CVE-2026-102809 | PX PX4-Autopilot PX4 | 6.5 | Sep 29 | PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command |
| CVE-2026-102808 | PX PX4-Autopilot PX4 | 6.5 | Sep 29 | PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress |
| CVE-2026-102807 | OP OpenClaw OpenClaw | 5.3 | Sep 29 | OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket |
| CVE-2026-102806 | OP OpenClaw OpenClaw | 6.3 | Sep 29 | OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines |
| CVE-2026-102623 | RH Red Hat OpenShift Virtualization 4 Red Hat | 6.5 | Sep 29 | Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume |
| CVE-2026-101126 | BF Balbooa Forms extension for Joomla balbooa.com | 6.5 | Sep 29 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 |
| CVE-2026-101112 | BF Balbooa Forms extension for Joomla balbooa.com | 5.3 | Sep 29 | Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 |
| CVE-2026-100245 | MW Mediawiki - Wikibase Extension Wikimedia Foundation | 6.1 | Sep 29 | Stored XSS on Wikibase Special:SetSiteLink via unescaped system message |
| CVE-2026-102674 | EL electron electron | 6.1 | Sep 29 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
| CVE-2026-90915 | JO Joomla Joomla | 6.5 | Sep 29 | Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-92226 | JO Joomla Joomla | 6.0 | Sep 29 | Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-92224 | JO Joomla Joomla | 6.7 | Sep 29 | Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-90907 | JO Joomla Joomla | 5.3 | Sep 29 | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-100243 | MW Mediawiki - WikiSEO Extension Wikimedia Foundation | 6.1 | Sep 29 | Stored XSS in WikiSEO author and image properties on action=info |
| CVE-2026-90914 | JO Joomla Joomla | 6.4 | Sep 29 | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-92231 | JO Joomla Joomla | 6.7 | Sep 29 | Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-90918 | JO Joomla Joomla | 5.3 | Sep 29 | Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-102673 | EL electron electron | 6.1 | Sep 29 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab |
| CVE-2026-90917 | JO Joomla Joomla | 5.3 | Sep 29 | Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-92225 | JO Joomla Joomla | 6.7 | Sep 29 | Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-92232 | JO Joomla Joomla | 6.5 | Sep 29 | Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-90913 | JO Joomla Joomla | 5.5 | Sep 29 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-100238 | MF Mediawiki - Flow Extension Wikimedia Foundation | 6.1 | Sep 29 | Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS |
| CVE-2026-102635 | IM ImageMagick ImageMagick | 5.3 | Sep 29 | ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder |
| CVE-2026-102633 | LI libexpat libexpat | 5.9 | Sep 29 | libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc |
| CVE-2026-100289 | SE Server Devolutions | 5.0 | Sep 29 | Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan… |
| CVE-2026-102630 | UN unopim unopim | 4.7 | Sep 29 | UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host |
| CVE-2026-100287 | SE Server Devolutions | 5.4 | Sep 29 | Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault… |
| CVE-2026-100286 | SE Server Devolutions | 6.5 | Sep 29 | Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets… |
| CVE-2026-75806 | OP OpenSSL OpenSSL | 5.3 | Sep 29 | Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS |
| CVE-2026-75805 | OP OpenSSL OpenSSL | 5.3 | Sep 29 | NULL Pointer Dereference in CMP Client Revocation Response Handling |
| CVE-2026-75804 | OP OpenSSL OpenSSL | 5.3 | Sep 29 | QUIC Connection-Level Flow Control is Not Enforced for Streams |
| CVE-2026-97688 | UR urllib3 urllib3 | 5.3 | Sep 29 | urllib3: Chunked Deflate streaming can enter an infinite loop |
| CVE-2026-42772 | OP OpenSSL OpenSSL | 5.3 | Sep 29 | Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC |