CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 22:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102319 | CH Chrome Google | 3.4 | Sep 29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a… |
| CVE-2026-102311 | CH Chrome Google | 3.4 | Sep 29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the… |
| CVE-2026-76738 | IO Instant ON Hewlett Packard Enterprise (HPE) | 2.7 | Sep 29 | Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service |
| CVE-2026-76737 | IO Instant ON Hewlett Packard Enterprise (HPE) | 3.0 | Sep 29 | Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On |
| CVE-2026-76736 | IO Instant ON Hewlett Packard Enterprise (HPE) | 3.3 | Sep 29 | Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On |
| CVE-2026-102825 | RU russh Eugeny | 3.7 | Sep 29 | Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path |
| CVE-2026-102822 | RU russh Eugeny | 3.7 | Sep 29 | russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic |
| CVE-2026-95316 | CH Chrome Google | 2.9 | Sep 29 | Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program |
| CVE-2026-95308 | CH Chrome Google | 3.4 | Sep 29 | Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the… |
| CVE-2026-95312 | CH Chrome Google | 3.1 | Sep 29 | Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted… |
| CVE-2026-95317 | CH Chrome Google | 3.1 | Sep 29 | Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted… |
| CVE-2026-95359 | CH Chrome Google | 3.4 | Sep 29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the… |
| CVE-2026-95302 | CH Chrome Google | 2.9 | Sep 29 | Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app |
| CVE-2026-95324 | CH Chrome Google | 3.4 | Sep 29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a… |
| CVE-2026-92223 | JO Joomla Joomla | 3.8 | Sep 29 | Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-90916 | JO Joomla Joomla | 2.7 | Sep 29 | Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 |
| CVE-2026-97711 | SE serialize-javascript yahoo | 2.3 | Sep 29 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies |
| CVE-2026-77696 | OP OpenSSL OpenSSL | 3.7 | Sep 29 | Timing Side-Channel in SM2 Signature Generation |
| CVE-2026-54875 | OP OpenSSL OpenSSL | 3.7 | Sep 29 | Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V |
| CVE-2026-54872 | OP OpenSSL OpenSSL | 3.7 | Sep 29 | Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves |
| CVE-2026-35191 | OP OpenSSL OpenSSL | 3.7 | Sep 29 | QUIC Unvalidated Amplification Credit may be Over Accounted |
| CVE-2026-102601 | FL flysystem thephpleague | 3.5 | Sep 29 | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter |
| CVE-2026-101271 | PR pretix pretix | 2.1 | Sep 29 | OAuth credentials not disabled when application is disabled |
| CVE-2026-101270 | PR pretix pretix | 2.1 | Sep 29 | HTML injection |
| CVE-2026-101269 | PR pretix pretix | 2.3 | Sep 29 | Incorrect session validation for API-uploaded files |
| CVE-2026-101268 | PR pretix pretix | 1.7 | Sep 29 | Customer session fixation |
| CVE-2026-101267 | PR pretix pretix | 2.7 | Sep 29 | Revenue information leak |
| CVE-2026-101266 | PR pretix pretix | 1.3 | Sep 29 | Checkout validation bypass |
| CVE-2026-4523 | GI GitLab GitLab | 3.7 | Sep 29 | Missing Authorization in GitLab |
| CVE-2026-102290 | RL Rocket LMS CodeCanyon | 3.5 | Sep 29 | CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting |
| CVE-2026-102264 | RO robo-cafe-rms mwasikz | 3.5 | Sep 29 | mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting |
| CVE-2026-102414 | PB pbkdf2 browserify | 3.7 | Sep 29 | pbkdf2 rehashes long passwords on every iteration, enabling denial of service |
| CVE-2026-102241 | NA NAP930 Netcore | 2.7 | Sep 29 | Netcore NAP930 Backup/Restore backup_common.sh hard-coded key |
| CVE-2026-102363 | MA mall4j gz-yami | 3.7 | Sep 28 | mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number |
| CVE-2026-101265 | T1 TIP 125i Intelbras | 3.1 | Sep 28 | Intelbras TIP 125i Básico sensitive information in source |