CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 09:56 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115774 New | TW twisted twisted | 4.9 | Oct 23 | Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH |
| CVE-2026-79981 New | ZE zephyr zephyrproject | 6.5 | Oct 23 | DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing |
| CVE-2026-79980 New | ZE zephyr zephyrproject | 5.6 | Oct 23 | Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS |
| CVE-2026-115796 New | F6 F6 Tenda | 4.3 | Oct 23 | Tenda F6 Web Management cross-site request forgery |
| CVE-2026-115845 New | AM AWS MCP Server AWS | 6.4 | Oct 23 | Incomplete validation in the run_script Python sandbox in AWS MCP Server |
| CVE-2026-115813 New | MU multi-model-server AWS | 5.8 | Oct 23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server |
| CVE-2026-115567 New | TO tokio tokio-rs | 5.8 | Oct 23 | Tokio: Race condition in `tokio::time::Interval` |
| CVE-2026-105481 New | NO node nodejs | 6.5 | Oct 23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request |
| CVE-2026-106074 New | NO node nodejs | 4.8 | Oct 23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup… |
| CVE-2026-106072 New | NO node nodejs | 6.7 | Oct 23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling,… |
| CVE-2026-49442 New | CA cacti Cacti | 5.3 | Oct 23 | Cacti: User Enumeration via Error Messages |
| CVE-2026-46531 New | CA cacti Cacti | 5.5 | Oct 23 | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) |
| CVE-2026-55222 New | IS isar ilbers | 5.1 | Oct 23 | Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap |
| CVE-2026-55465 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: Solr injection via unvalidated region parameter in spatial search |
| CVE-2026-55463 New | GO goobi-viewer-core intranda | 6.5 | Oct 23 | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation |
| CVE-2026-112333 New | GA GFI Archiver GFI Software | 5.4 | Oct 23 | GFI Archiver < 15.14 Stored XSS via MailInsights.aspx |
| CVE-2026-55444 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters |
| CVE-2026-46347 New | GO goobi-viewer-core intranda | 6.8 | Oct 23 | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset |
| CVE-2026-46346 New | GO goobi-viewer-core intranda | 6.5 | Oct 23 | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset |
| CVE-2026-55442 New | GO goobi-viewer-core intranda | 5.3 | Oct 23 | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection |
| CVE-2026-115786 New | CO Collaboration Zimbra | 6.5 | Oct 23 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion |
| CVE-2026-115785 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address |
| CVE-2026-114623 New | BA basercms baserproject | 6.5 | Oct 23 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure |
| CVE-2026-57207 New | NE netbox-mcp-server netboxlabs | 5.9 | Oct 23 | NetBox MCP Server: HTTP transport exposes all NetBox data without authentication |
| CVE-2026-57208 New | CL cli entireio | 6.2 | Oct 23 | Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind |
| CVE-2026-115480 New | BA basercms baserproject | 5.3 | Oct 23 | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA |
| CVE-2026-115479 New | BA basercms baserproject | 5.3 | Oct 23 | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients |
| CVE-2026-93638 New | CO Collaboration Zimbra | 6.1 | Oct 23 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter |
| CVE-2026-93636 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name |
| CVE-2026-93634 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records |
| CVE-2026-93633 New | CO Collaboration Zimbra | 5.4 | Oct 23 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters |
| CVE-2026-93630 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization |
| CVE-2026-55606 New | OD odhcpd openwrt | 6.5 | Oct 23 | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() |
| CVE-2026-115754 New | SE serialize-javascript yahoo | 4.7 | Oct 23 | serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body |
| CVE-2026-93629 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity |
| CVE-2026-93628 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response |
| CVE-2026-93627 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer |
| CVE-2026-115752 New | SI signalk-server SignalK | 4.2 | Oct 23 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon |
| CVE-2026-115729 New | CO common pdfme | 6.8 | Oct 23 | @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass |
| CVE-2026-55190 New | EV eventschedule eventschedule | 6.5 | Oct 23 | Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import |
| CVE-2026-55422 New | CO conda-forge.github.io conda-forge | 4.6 | Oct 23 | conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard |
| CVE-2026-115725 New | CH chatwoot chatwoot | 4.2 | Oct 23 | Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id |
| CVE-2026-115722 New | RP rply diegonehab | 6.1 | Oct 23 | RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header |
| CVE-2026-94263 New | AC Advanced Custom Fields: Extended | 4.8 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message |
| CVE-2026-111965 New | PB Profile Builder | 4.3 | Oct 23 | Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass |
| CVE-2026-105963 New | PL plug elixir-plug | 5.1 | Oct 23 | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments |
| CVE-2026-89319 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation |
| CVE-2026-89318 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) |
| CVE-2026-89317 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) |
| CVE-2026-89316 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion |