CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57200 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE |
| CVE-2026-57195 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication |
| CVE-2026-85898 New | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Oct 27 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-83831 New | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Oct 27 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-116693 New | DD dd-trace-js DataDog | 8.7 | Oct 27 | dd-trace: ReDOS in URL query string obfuscation |
| CVE-2026-112351 New | SU SureLine Sunhillo Corporation | 8.8 | Oct 27 | Sunhillo SureLine OS Command Injection via networkDiag.cgi |
| CVE-2026-112350 New | SU SureLine Sunhillo Corporation | 7.5 | Oct 27 | Sunhillo SureLine Path Traversal via radarUpdater.cgi |
| CVE-2026-116690 New | ML mlflow mlflow | 7.5 | Oct 27 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source |
| CVE-2026-116688 New | CK ckeditor5 ckeditor | 8.1 | Oct 27 | CKEditor: Cross-site scripting (XSS) in the engine package |
| CVE-2026-112355 New | ME MembershipWorks MembershipWorks | 7.5 | Oct 27 | MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API |
| CVE-2026-116683 New | TE terraform-provider-ctfd ctfer-io | 7.1 | Oct 27 | CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values |
| CVE-2026-115413 New | AW aws-api-mcp-server AWS | 7.8 | Oct 27 | AWS API MCP Server OAuth Token Audience Validation Bypass |
| CVE-2026-57202 New | AS asterisk asterisk | 8.1 | Oct 27 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes |
| CVE-2026-57188 New | AS asterisk asterisk | 7.1 | Oct 27 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling |
| CVE-2026-116682 New | FI filebrowser gtsteffaniak | 8.6 | Oct 27 | FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory |
| CVE-2026-88812 New | XO xorg-x11-server X.org | 7.8 | Oct 27 | X.Org Server XKB SetGeometry TextDoodad Double Free |
| CVE-2026-102814 New | RV RE305 v3 TP-Link Systems Inc. | 8.7 | Oct 27 | Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305 |
| CVE-2026-108303 New | CM Certificate Manager Tanium | 8.8 | Oct 27 | Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. |
| CVE-2026-116656 New | EN Enforce Tanium | 7.5 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| CVE-2026-108306 New | EN end-user-cx Tanium | 7.8 | Oct 27 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-108329 New | TR Threat Response Tanium | 8.8 | Oct 27 | Tanium addressed an unauthorized code execution vulnerability in Threat Response. |
| CVE-2026-108304 New | EN end-user-cx Tanium | 7.8 | Oct 27 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-87086 New | PR Provision Tanium | 7.5 | Oct 27 | Tanium addressed a denial of service vulnerability in Provision. |
| CVE-2026-116649 New | EN Enforce Tanium | 7.1 | Oct 27 | Tanium addressed an improper output sanitization vulnerability in Enforce. |
| CVE-2026-116647 New | CO Comply Tanium | 7.1 | Oct 27 | Tanium addressed an improper output sanitization vulnerability in Comply. |
| CVE-2026-108307 New | EC Endpoint Configuration Toolset Solution Tanium | 7.8 | Oct 27 | Tanium addressed a heap-based buffer overflow vulnerability in Index. |
| CVE-2026-116662 New | EN Enforce Tanium | 7.5 | Oct 27 | Tanium addressed a compression bomb vulnerability in Enforce. |
| CVE-2026-108305 New | EN end-user-cx Tanium | 7.8 | Oct 27 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-117516 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 27 | oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection |
| CVE-2026-117515 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 27 | oretnom23 php-travel-agency-system traceapplication.php sql injection |
| CVE-2026-116676 New | AT atlantis runatlantis | 8.8 | Oct 27 | Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan |
| CVE-2026-117514 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 27 | oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection |
| CVE-2026-57201 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer |
| CVE-2026-114598 New | EB EPICS Base The EPICS Community | 7.5 | Oct 27 | Access of resource using incompatible type ('type confusion') in EPICS Base |
| CVE-2026-114597 New | EB EPICS Base The EPICS Community | 7.5 | Oct 27 | Improper handling of length parameter inconsistency in EPICS Base |
| CVE-2026-114596 New | EB EPICS Base The EPICS Community | 8.2 | Oct 27 | Integer overflow or wraparound in EPICS Base |
| CVE-2026-116675 New | TI tinymce tinymce | 8.5 | Oct 27 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
| CVE-2026-117513 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 27 | oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection |
| CVE-2026-57197 New | AS asterisk asterisk | 7.7 | Oct 27 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) |
| CVE-2026-109090 New | LI libXi x.org | 7.5 | Oct 27 | libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow |
| CVE-2026-116672 New | AU authlib authlib | 8.8 | Oct 27 | Authlib RFC 7592 examples omit registration-access-token client binding |
| CVE-2026-117512 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 27 | oretnom23 php-travel-agency-system employee_insert.php unrestricted upload |
| CVE-2026-48379 New | AS Adobe Substance 3D Painter Adobe | 7.8 | Oct 27 | Substance3D - Painter | Stack-based Buffer Overflow (CWE-121) |
| CVE-2026-104349 New | CC Creative Cloud Desktop Application Adobe | 7.3 | Oct 27 | Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427) |
| CVE-2026-107671 New | ON ONE Veeam | 8.5 | Oct 27 | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification |
| CVE-2026-106077 New | BF Backup for Microsoft 365 Veeam | 8.3 | Oct 27 | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges |
| CVE-2026-105477 New | AF Agent for Linux Veeam | 7.3 | Oct 27 | A vulnerability in Veeam Agent for Linux allows for local privilege escalation |
| CVE-2026-77167 New | SE server Nextcloud | 7.5 | Oct 27 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table |
| CVE-2026-112353 New | GK GFI KerioConnect GFI USA, LLC | 8.2 | Oct 27 | GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment |
| CVE-2026-113775 New | FU Fusion Autodesk | 7.8 | Oct 27 | Dynamic Library Loading Process Control in Autodesk Fusion Desktop |