CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-76939 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.8 | Oct 27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76936 New | JJ JP1/Automatic Job Management System 3 - Manager Hitachi | 9.4 | Oct 27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76937 New | JJ JP1/Automatic Job Management System 3 - Manager Hitachi | 9.4 | Oct 27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76938 New | JJ JP1/Automatic Job Management System 3 - Manager Hitachi | 9.8 | Oct 27 | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76935 New | JJ JP1/Automatic Job Management System 3 - Manager Hitachi | 9.4 | Oct 27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76934 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.8 | Oct 27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76932 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.4 | Oct 27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-76933 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.4 | Oct 27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
| CVE-2026-86577 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.4 | Oct 27 | Out-of-bounds Write Vulnerability in JP1 Products |
| CVE-2026-86576 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.4 | Oct 27 | Heap-based Buffer Overflow Vulnerability in JP1 Products |
| CVE-2026-86575 New | JJ JP1/Automatic Job Management System 3 - Agent Hitachi | 9.4 | Oct 27 | Stack-based Buffer Overflow Vulnerability in JP1 Products |
| CVE-2026-86574 New | JP JP1/Base Hitachi | 9.8 | Oct 27 | Heap-based Buffer Overflow Vulnerability in JP1/Base |
| CVE-2026-102788 New | GE Gridbox extension for Joomla balbooa.com | 9.3 | Oct 27 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 |
| CVE-2026-102789 New | GE Gridbox extension for Joomla balbooa.com | 9.3 | Oct 27 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 |
| CVE-2026-92885 New | QM Qode Membership Qode Themes | 9.8 | Oct 27 | Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login |
| CVE-2026-18450 New | X1 X12SPI SMCI | 9.8 | Oct 27 | Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability |
| CVE-2026-116508 New | A9 A950RG TOTOLINK | 10.0 | Oct 26 | TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow |
| CVE-2026-116506 New | A9 A950RG TOTOLINK | 9.9 | Oct 26 | TOTOLINK A950RG firewall.so apmib_set command injection |
| CVE-2026-116505 New | A9 A950RG TOTOLINK | 9.1 | Oct 26 | TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection |
| CVE-2026-116504 New | A9 A950RG TOTOLINK | 9.9 | Oct 26 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection |
| CVE-2026-110720 New | TO Tooling HashiCorp | 9.9 | Oct 26 | Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules |
| CVE-2026-10757 New | AS ArcGIS Server Esri | 9.8 | Oct 26 | BUG-000187511 - ArcGIS Server has a security vulnerability. |
| CVE-2026-102649 New | BU burrito padok-team | 9.9 | Oct 26 | Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset |
| CVE-2026-115905 New | ZI zip2 zip-rs | 10.0 | Oct 26 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
| CVE-2026-112346 New | OS OpenHands Software Agent SDK OpenHands | 9.8 | Oct 26 | OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE |
| CVE-2026-77055 New | BL black_debian_images boneIO | 9.3 | Oct 26 | Improper Privilege Assignment in boneIO |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-65184 New | AA Avocent ACS8000 Vertiv | 9.8 | Oct 26 | Avocent ACS8000 wsserver command injection |
| CVE-2026-115693 New | HA hackney benoitc | 9.1 | Oct 26 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
| CVE-2026-107656 New | FO FortiSandbox Fortinet | 9.8 | Oct 26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all… |
| CVE-2026-59107 New | CP Cynap Pro, Cynap Core Pro WolfVision | 9.8 | Oct 26 | Shared SSH Authentication Key in vSolution Matrix File Sharing |
| CVE-2026-59106 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 9.8 | Oct 26 | Unauthenticated RCE Vulnerability in WolfProt interface implementation |
| CVE-2026-116485 New | DA danmu_api huangxd- | 9.8 | Oct 26 | danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints |
| CVE-2026-116214 New | MA maccms10 maccmspro | 9.1 | Oct 26 | MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code |
| CVE-2026-115188 New | Product not mapped yet | 9.9 | Oct 26 | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7 |
| CVE-2026-110475 New | CC CreditNirvana Collections Platform (CollectionWorkz) CreditNirvana | 9.3 | Oct 26 | Improper Authentication Vulnerability in CreditNirvana Collections Platform |
| CVE-2026-116235 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro L2TP Authentication crlf injection |
| CVE-2026-116234 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection |
| CVE-2026-116233 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-116232 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro SNMP snmp_set crlf injection |
| CVE-2026-116231 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro Ser2net crlf injection |
| CVE-2026-107092 New | Product not mapped yet | 9.8 | Oct 26 | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint |
| CVE-2026-116207 New | YE yeswiki YesWiki | 9.1 | Oct 25 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API |
| CVE-2026-115214 New | DP Datawiza Proxy Auth Plugin | 9.8 | Oct 25 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers |
| CVE-2026-115995 New | UG Unitree Go2 Unitree Robotics | 9.6 | Oct 24 | Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection |
| CVE-2026-114820 New | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 24 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-115933 New | PO postiz-app GitroomHQ | 9.9 | Oct 24 | Forged signed tokens let any registered user take over other users and organizations |
| CVE-2026-115557 New | CP CPython Python Software Foundation | 9.4 | Oct 24 | Distrust compromised intermediate certificates in ssl module |
| CVE-2026-115932 New | PO postiz-app GitroomHQ | 9.6 | Oct 24 | Path traversal in post media lets any registered user read server files |
| CVE-2026-114196 New | PA Paytium paytiumsupport | 9.8 | Oct 24 | WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability |