CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:01 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112559 New | MA macOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112471 New | MA macOS Apple | 4.3 | Oct 26 | A buffer overflow was addressed with improved bounds checking |
| CVE-2026-84496 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-65397 New | MA macOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112556 New | MA macOS Apple | 4.8 | Oct 26 | A race condition was addressed with additional validation |
| CVE-2026-86920 New | MA macOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112701 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112629 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-112609 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | This issue was addressed with improved checks |
| CVE-2026-112633 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-113896 New | MA macOS Apple | 4.7 | Oct 26 | A race condition was addressed with additional validation |
| CVE-2026-112415 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds write was addressed with improved input validation |
| CVE-2026-112706 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | A permissions issue was addressed with additional restrictions |
| CVE-2026-112614 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112675 New | MA macOS Apple | 5.5 | Oct 26 | This issue was addressed with additional entitlement checks |
| CVE-2026-112634 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-112618 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | An access issue was addressed with improved access restrictions |
| CVE-2026-112658 New | MA macOS Apple | 5.5 | Oct 26 | This issue was addressed with improved input validation |
| CVE-2026-86971 New | MA macOS Apple | 6.5 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-113907 New | MA macOS Apple | 6.1 | Oct 26 | A buffer overflow issue was addressed with improved memory handling |
| CVE-2026-112455 New | MA macOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112547 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | A type confusion issue was addressed with improved checks |
| CVE-2026-112678 New | MA macOS Apple | 5.5 | Oct 26 | A permissions issue was addressed with additional restrictions |
| CVE-2026-112506 New | MA macOS Apple | 5.5 | Oct 26 | A permissions issue was addressed with improved validation |
| CVE-2026-116579 New | AU autobahn-python crossbario | 5.9 | Oct 26 | Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) |
| CVE-2026-116577 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding |
| CVE-2026-116502 New | EX ExLlamaV2 turboderp-org | 4.4 | Oct 26 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write |
| CVE-2026-116575 New | ME mem0 mem0ai | 6.3 | Oct 26 | Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) |
| CVE-2026-70382 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 4.1 | Oct 26 | Stored Cross-Site Scripting in Web Interface |
| CVE-2026-65630 New | JO jose potatosalad | 5.9 | Oct 26 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose |
| CVE-2026-65632 New | JO jose potatosalad | 5.1 | Oct 26 | ECDSA signature length is not validated in jose, allowing signature malleability |
| CVE-2026-65631 New | JO jose potatosalad | 6.9 | Oct 26 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service |
| CVE-2026-65628 New | JO jose potatosalad | 5.9 | Oct 26 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types |
| CVE-2026-65627 New | JO jose potatosalad | 6.9 | Oct 26 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 |
| CVE-2026-57184 New | AS asterisk asterisk | 6.3 | Oct 26 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) |
| CVE-2026-65626 New | JO jose potatosalad | 5.9 | Oct 26 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose |
| CVE-2026-65625 New | JO jose potatosalad | 5.9 | Oct 26 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose |
| CVE-2026-70381 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Unauthorized Access to Internal Web Resources |
| CVE-2026-57193 New | AS asterisk asterisk | 6.9 | Oct 26 | Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure) |
| CVE-2026-70380 New | CP Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Resource Exhaustion in MICE Service |
| CVE-2026-116479 New | A2 a2a-java a2aproject | 4.3 | Oct 26 | a2aproject a2a-java JSON-RPC Error getMessage information exposure |
| CVE-2026-115927 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks |
| CVE-2026-116478 New | A2 a2a-go a2aproject | 5.3 | Oct 26 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure |
| CVE-2026-116477 New | A2 a2a-dotnet a2aproject | 4.3 | Oct 26 | a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure |
| CVE-2026-116476 New | A2 a2a-dotnet a2aproject | 5.4 | Oct 26 | a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition |
| CVE-2026-116631 New | Product not mapped yet | 5.4 | Oct 26 | External protocol handler (tel:) address bar spoof |
| CVE-2026-116632 New | Product not mapped yet | 5.4 | Oct 26 | Facetime protocol handler enabled spoofing |
| CVE-2026-116471 New | DE Decoy BKWLD | 4.3 | Oct 26 | BKWLD Decoy Authorization Policy Policy.php privileges management |
| CVE-2026-116467 New | LL llama.cpp ggml-org | 5.3 | Oct 26 | ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion |
| CVE-2026-115804 New | CO Consul HashiCorp | 6.4 | Oct 26 | Consul vulnerable to an authorization bypass in health check registration |