CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 00:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114646 New | MO MongoDB MongoDB | 6.5 | Oct 22 | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-115383 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports |
| CVE-2026-115382 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS |
| CVE-2026-114645 New | MO MongoDB MongoDB | 5.2 | Oct 22 | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping |
| CVE-2026-115381 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes |
| CVE-2026-114644 New | MO MongoDB MongoDB | 5.9 | Oct 22 | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization |
| CVE-2026-115380 New | WA wasmtime bytecodealliance | 4.0 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff |
| CVE-2026-114643 New | MO MongoDB MongoDB | 5.4 | Oct 22 | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-115379 New | WA wasmtime bytecodealliance | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call |
| CVE-2026-115378 New | IN incus lxc | 5.8 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull |
| CVE-2026-115373 New | IN incus lxc | 6.3 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} |
| CVE-2026-115370 New | IN incus lxc | 4.3 | Oct 22 | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh |
| CVE-2026-115365 New | OP openbao openbao | 6.6 | Oct 22 | OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal |
| CVE-2026-115361 New | OP openbao openbao | 4.1 | Oct 22 | OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial |
| CVE-2026-115360 New | OP openbao openbao | 4.7 | Oct 22 | OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI |
| CVE-2026-115356 New | OP openbao openbao | 5.4 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation |
| CVE-2026-115354 New | MI mistune lepture | 6.5 | Oct 22 | Mistune before 3.3.0 Arbitrary Local File Read via Include Directive |
| CVE-2026-115351 New | MI mistune lepture | 4.7 | Oct 22 | Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option |
| CVE-2026-115350 New | MI mistune lepture | 6.1 | Oct 22 | Mistune before 3.3.0 Stored XSS via Include Directive HTML Files |
| CVE-2026-95720 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 4.4 | Oct 22 | Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 |
| CVE-2026-95719 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 4.9 | Oct 22 | Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10 |
| CVE-2026-95718 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 5.3 | Oct 22 | Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8 |
| CVE-2026-95717 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 5.5 | Oct 22 | Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface |
| CVE-2026-95716 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 6.5 | Oct 22 | Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes |
| CVE-2026-95715 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 6.8 | Oct 22 | Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface |
| CVE-2026-95714 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 6.8 | Oct 22 | Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-115517 New | KB KNIME Business Hub KNIME | 6.4 | Oct 22 | Unrestricted network access between execution contexts in KNIME Business Hub |
| CVE-2026-113876 New | HF HAPI FHIR SmileCDR | 4.3 | Oct 22 | SmileCDR HAPI FHIR unauthorized read |
| CVE-2026-77157 New | GI github.com/checkmarx/ast-cli Checkmarx | 6.4 | Oct 22 | ast-cli: Auto-update downloads are not verified against a checksum before execution |
| CVE-2026-77156 New | GI github.com/checkmarx/ast-cli Checkmarx | 6.4 | Oct 22 | ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory |
| CVE-2026-108360 New | PH PhpSpreadsheet PHPOffice | 6.4 | Oct 22 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
| CVE-2026-114610 New | FP fpdf2 py-pdf | 6.5 | Oct 22 | fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' |
| CVE-2026-114609 New | FP fpdf2 py-pdf | 5.8 | Oct 22 | fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content |
| CVE-2026-54532 New | HE helm-charts CloudPirates-io | 6.9 | Oct 22 | CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft |
| CVE-2026-114608 New | PY pylint pylint-dev | 5.4 | Oct 22 | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME |
| CVE-2026-114606 New | DR drawio-desktop jgraph | 5.6 | Oct 22 | draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) |
| CVE-2026-115502 New | KB KNIME Business Hub KNIME | 6.3 | Oct 22 | DataApp links without login expose job information to other user in KNIME Business Hub |
| CVE-2026-115496 New | KB KNIME Business Hub KNIME | 6.9 | Oct 22 | Workflow names may be leaked to unauthenticated users in KNIME Business Hub |
| CVE-2026-115494 New | KB KNIME Business Hub KNIME | 5.3 | Oct 22 | CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub |
| CVE-2026-114603 New | OP opentelemetry-python open-telemetry | 5.3 | Oct 22 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api |
| CVE-2026-115454 New | KB KNIME Business Hub KNIME | 5.3 | Oct 22 | Large tables in data apps can bring down execution services in KNIME Hub |
| CVE-2026-114515 New | OC OCO-Server schorschii | 6.5 | Oct 22 | OCO-Server: Self-Service Portal uninstall-job authorization bypass |
| CVE-2026-89410 New | ZS Z-Wave SDK Silicon Labs | 5.1 | Oct 22 | Out-of-bounds read in Z-Wave NCP SPI Handler |
| CVE-2026-89409 New | ZS Z-Wave SDK Silicon Labs | 5.3 | Oct 22 | Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes |
| CVE-2026-115249 New | ON online-clinic-management-system subhajitkhan | 4.6 | Oct 22 | subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation |
| CVE-2026-66282 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee Publish Billing Period |
| CVE-2026-66281 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee Discover Attributes Handling |
| CVE-2026-85080 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling |
| CVE-2026-115248 New | ON online-clinic-management-system subhajitkhan | 5.4 | Oct 22 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow |
| CVE-2026-115400 New | CR crawlseo crawlseo | 4.4 | Oct 22 | crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens |