CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:51 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118261 New | EC echo labstack | 8.2 | Oct 28 | Echo: Decompress permits unbounded gzip expansion in v4 |
| CVE-2026-118260 New | EC echo labstack | 8.2 | Oct 28 | Echo: BodyDump captures request and response bodies without size limits in v4 |
| CVE-2026-118259 New | OP opentelemetry-java open-telemetry | 5.3 | Oct 28 | opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing |
| CVE-2026-118633 New | SU SG UTM Sophos | 8.1 | Oct 28 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining… |
| CVE-2026-118258 New | I1 i18next-http-backend i18next | 3.7 | Oct 28 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string |
| CVE-2026-118257 New | VU vue-i18n intlify | 7.2 | Oct 28 | Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages |
| CVE-2026-118256 New | VU vue-i18n intlify | 2.1 | Oct 28 | Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list |
| CVE-2026-118255 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Grid: javascript: URL in credits.href runs script on click |
| CVE-2026-118254 New | GR grid-lite @highcharts | 8.6 | Oct 28 | Highcharts Grid: pagination language options are parsed as HTML |
| CVE-2026-118253 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: fullscreen labels are parsed as HTML |
| CVE-2026-118252 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: sidebar component labels are parsed as HTML |
| CVE-2026-106484 New | CH chrome-devtools-mcp Google | – | Oct 28 | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file |
| CVE-2026-118251 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts: javascript: URL in credits.href runs script on click |
| CVE-2026-118250 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: dotted series.keys paths write to Object.prototype |
| CVE-2026-118249 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: series column construction writes to Object.prototype |
| CVE-2026-118248 New | DA dashboards @highcharts | 6.9 | Oct 28 | Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype |
| CVE-2026-118247 New | DA dashboards @highcharts | 6.9 | Oct 28 | Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. |
| CVE-2026-118246 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes |
| CVE-2026-118245 New | DA dashboards @highcharts | 8.6 | Oct 28 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace |
| CVE-2026-118244 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print |
| CVE-2026-116273 New | Product not mapped yet | – | Oct 28 | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion |
| CVE-2026-116272 New | Product not mapped yet | – | Oct 28 | MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment |
| CVE-2026-116271 New | Product not mapped yet | – | Oct 28 | MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes |
| CVE-2026-116270 New | Product not mapped yet | – | Oct 28 | MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords |
| CVE-2026-118243 New | HI highcharts highcharts | 5.3 | Oct 28 | Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` |
| CVE-2026-116269 New | Product not mapped yet | – | Oct 28 | MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename |
| CVE-2026-116268 New | Product not mapped yet | – | Oct 28 | MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters |
| CVE-2026-116267 New | Product not mapped yet | – | Oct 28 | MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message |
| CVE-2026-116266 New | Product not mapped yet | – | Oct 28 | MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous |
| CVE-2026-116265 New | Product not mapped yet | – | Oct 28 | MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations |
| CVE-2026-110183 New | PA PostgreSQL Anonymizer DALIBO | 4.3 | Oct 28 | PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking |
| CVE-2026-110182 New | PA PostgreSQL Anonymizer DALIBO | 4.3 | Oct 28 | PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data |
| CVE-2026-110181 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data |
| CVE-2026-116264 New | Product not mapped yet | – | Oct 28 | MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary |
| CVE-2026-105620 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query |
| CVE-2026-105619 New | PA PostgreSQL Anonymizer DALIBO | 4.8 | Oct 28 | PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views |
| CVE-2026-105618 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent |
| CVE-2026-105617 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule |
| CVE-2026-105616 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting |
| CVE-2026-105615 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats |
| CVE-2026-105614 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur() |
| CVE-2026-105613 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions |
| CVE-2026-105612 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles |
| CVE-2026-118242 New | GR grid-lite @highcharts | 8.5 | Oct 28 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` |
| CVE-2026-84725 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 8.1 | Oct 28 | Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap |
| CVE-2026-116797 New | DA dashboards @highcharts | 8.5 | Oct 28 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` |
| CVE-2026-79656 New | GR Grafana Grafana | 6.0 | Oct 28 | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors |
| CVE-2026-116796 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts |
| CVE-2026-58458 New | DS Don't Starve Together Klei Entertainment | 6.5 | Oct 28 | Don't Starve Together Memory Corruption via world_gen_data |
| CVE-2026-117501 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies |