CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 17:07 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-72754 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator exits when parsing an incorrect or very large CRL file |
| CVE-2026-72753 New | RO Routinator NLnet Labs | 8.2 | Oct 26 | Routinator incorrectly handles delta updates |
| CVE-2026-115912 New | VL vllm vllm-project | 8.8 | Oct 26 | vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |
| CVE-2026-116612 New | GS gst-editing-services GStreamer project | 7.8 | Oct 26 | A flaw was found in GStreamer Editing Services (gst-editing-services) |
| CVE-2026-115418 New | AW aws-cdk/aws-redshift-alpha AWS | 7.3 | Oct 26 | SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha |
| CVE-2026-115909 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction |
| CVE-2026-115908 New | ZI zip2 zip-rs | 7.4 | Oct 26 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) |
| CVE-2026-115907 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size |
| CVE-2026-71456 New | KE Kantech Entrapass Johnson Controls | 8.5 | Oct 26 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack |
| CVE-2026-81038 New | ZE zephyr zephyrproject | 7.1 | Oct 26 | Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses |
| CVE-2026-112343 New | SS Syncplify Server! Syncplify, Inc. | 8.1 | Oct 26 | Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing |
| CVE-2026-116368 New | HA Harness DeepSeek | 7.3 | Oct 26 | DeepSeek Harness Browser Auth browser-auth.ts improper authorization |
| CVE-2026-115748 New | AV Apache Vysper Apache Software Foundation | 8.8 | Oct 26 | Apache Vysper: Authorization bypass |
| CVE-2026-115721 New | AV Apache Vysper Apache Software Foundation | 7.5 | Oct 26 | Apache Vysper: Unbounded allocation |
| CVE-2026-116543 New | OP open5gs open5gs | 7.5 | Oct 26 | Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser |
| CVE-2026-116489 New | PG pgvectorscale timescale | 7.5 | Oct 26 | Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes |
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-90885 New | AC Apache Camel Apache Software Foundation | 7.5 | Oct 26 | Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved |
| CVE-2026-77059 New | BO boneIO boneIO | 8.8 | Oct 26 | TOCTOU Race Condition in boneIO |
| CVE-2026-77056 New | BL black_debian_images boneIO | 7.1 | Oct 26 | Use of Default Credentials in boneIO |
| CVE-2026-77053 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication in Default Configuration in boneIO |
| CVE-2026-77052 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication for Node-RED in boneIO |
| CVE-2026-112345 New | TT TTLock Sciener | 8.1 | Oct 26 | TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure |
| CVE-2026-116339 New | AS astron-agent iFlytek | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist |
| CVE-2026-97200 New | HA hackney benoitc | 8.2 | Oct 26 | Unbounded response body buffering and decompression in hackney |
| CVE-2026-108529 New | BA bandit mtrudel | 8.7 | Oct 26 | SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit |
| CVE-2026-110499 New | BA bandit mtrudel | 8.7 | Oct 26 | Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit |
| CVE-2026-109584 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit |
| CVE-2026-111103 New | BA bandit mtrudel | 8.2 | Oct 26 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit |
| CVE-2026-111101 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit |
| CVE-2026-113436 New | BA bandit mtrudel | 8.7 | Oct 26 | Quadratic bignum parsing of Content-Length and Host port values in Bandit |
| CVE-2026-114213 New | BA bandit mtrudel | 8.7 | Oct 26 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit |
| CVE-2026-115269 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit |
| CVE-2026-108525 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit |
| CVE-2026-116219 New | DO dolibarr Dolibarr | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter |
| CVE-2026-116218 New | DO dolibarr Dolibarr | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field |
| CVE-2026-115193 New | Product not mapped yet | 8.2 | Oct 26 | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7 |
| CVE-2026-115192 New | Product not mapped yet | 7.1 | Oct 26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}) |
| CVE-2026-115191 New | Product not mapped yet | 7.1 | Oct 26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax) |
| CVE-2026-115190 New | Product not mapped yet | 8.0 | Oct 26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties |
| CVE-2026-115189 New | Product not mapped yet | 8.8 | Oct 26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic |
| CVE-2026-110474 New | AA Agentic AI Call Centre CreditNirvana | 8.7 | Oct 26 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application |
| CVE-2026-115717 New | BU builder frappe | 7.7 | Oct 26 | Frappe Builder before 1.36.1 SSRF via convert_to_webp |
| CVE-2026-94380 New | LM Liman MYS HAVELSAN Inc. | 8.1 | Oct 26 | Host Header Injection in HAVELSAN's Liman MYS |
| CVE-2026-116260 New | LI libimobiledevice Libimobiledevice | 7.3 | Oct 26 | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116469 New | MI misp-guard MISP | 7.1 | Oct 26 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding |
| CVE-2026-116257 New | BI BillaBear Billabear | 7.3 | Oct 26 | BillaBear Installation InstallController.php processInstall missing authentication |
| CVE-2026-115608 New | JE JetEngine Crocoblock | 8.5 | Oct 26 | WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability |
| CVE-2026-116256 New | RH RhaPHP geesondog | 7.3 | Oct 26 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery |
| CVE-2026-115948 New | ML Media LIbrary Assistant David Lingren | 8.5 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability |