CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-101911 | IP ip-address beaugunderson | 6.3 | Sep 28 | ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process |
| CVE-2026-101910 | IP ip-address beaugunderson | 6.9 | Sep 28 | ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass |
| CVE-2026-101101 | AG ag-ui ag-ui-protocol | 4.3 | Sep 28 | ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception |
| CVE-2026-101908 | AX axios axios | 6.9 | Sep 28 | Axios: Prototype pollution gadget in fetch adapter can alter outbound requests |
| CVE-2026-101100 | AG ag-ui ag-ui-protocol | 5.4 | Sep 28 | ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup |
| CVE-2026-101904 | AX axios axios | 6.9 | Sep 28 | Axios: Header Injection via Inherited headers After Minimal Interceptor |
| CVE-2026-96740 | SF streams for Apache Kafka 2 Red Hat | 6.5 | Sep 28 | Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers |
| CVE-2026-101902 | AX axios axios | 6.9 | Sep 28 | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method |
| CVE-2026-101099 | AG ag-ui ag-ui-protocol | 4.3 | Sep 28 | ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition |
| CVE-2026-101900 | AX axios axios | 6.9 | Sep 28 | Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders |
| CVE-2026-101098 | AG ag-ui ag-ui-protocol | 4.3 | Sep 28 | ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption |
| CVE-2026-101083 | PM PMWeb Pmweb | 5.3 | Sep 28 | PMWeb encryptionhelper.dll information disclosure |
| CVE-2026-101082 | PM PMWeb Pmweb | 5.3 | Sep 28 | PMWeb downloader.aspx path traversal |
| CVE-2026-88815 | Product not mapped yet | 6.2 | Sep 28 | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv |
| CVE-2026-101080 | AI AI-Infra-Guard Tencent | 4.8 | Sep 28 | Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal |
| CVE-2026-101861 | LA langflow langflow-ai | 4.1 | Sep 28 | Langflow Code Execution via eval() in Component Input Schema |
| CVE-2026-101078 | DE deepseek-harness deepseek-ai | 6.3 | Sep 28 | deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation |
| CVE-2026-91154 | ET Ecommerce Template MarcosCamara01 | 6.9 | Sep 28 | Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service |
| CVE-2026-93540 | RA Rancher SUSE | 6.5 | Sep 28 | Fleet applies namespace labels and annotations without the bundle's service account privileges |
| CVE-2026-70413 | LO Live Optics Collector Dell | 5.6 | Sep 28 | Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability |
| CVE-2026-80359 | BO Boot Optimized Server Storage (BOSS) Dell | 6.8 | Sep 28 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on… |
| CVE-2026-80358 | BO Boot Optimized Server Storage (BOSS) Dell | 5.1 | Sep 28 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on… |
| CVE-2026-93539 | RA Rancher SUSE | 5.4 | Sep 28 | Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver |
| CVE-2026-101071 | UW Unet Web Service Acrel Electric | 6.3 | Sep 28 | Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload |
| CVE-2026-93537 | RA Rancher SUSE | 6.5 | Sep 28 | Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory |
| CVE-2026-87798 | LX LXD Canonical | 5.8 | Sep 28 | LXD client recursive file pull allows directory escape via malicious VM agent |
| CVE-2026-86335 | LX LXD Canonical | 6.3 | Sep 28 | LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse |
| CVE-2026-86334 | LX LXD Canonical | 4.2 | Sep 28 | CLI Path Traversal via Content-Disposition in LXD Image Export/Copy |
| CVE-2026-15953 | PA Protection and control IED manager (PCM600) ABB | 5.0 | Sep 28 | Path Traversal During Project Archive Import |
| CVE-2026-101070 | DB dbgate Dbgate | 5.3 | Sep 28 | dbgate Files Endpoint runners.js files path traversal |
| CVE-2026-73641 | EE ESS Excelity Dayforce | 5.1 | Sep 28 | Multiple Reflected XSS in Dayforce ESS Excelity |
| CVE-2026-15952 | PA Protection and control IED manager (PCM600) ABB | 6.4 | Sep 28 | Improper Permission Assignment in Scheduler Service |