CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116385 New | G2 Garage 24 Garage Management Software Bdtask | 3.5 | Oct 26 | Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting |
| CVE-2026-72755 New | RO Routinator NLnet Labs | 3.8 | Oct 26 | Routinator stores TA certificate in cache without validation |
| CVE-2026-82390 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver |
| CVE-2026-19742 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key |
| CVE-2026-93846 New | MA Mattermost Mattermost | 3.8 | Oct 26 | Team admin can escalate a team member's permissions via the team member roles endpoint |
| CVE-2026-116544 New | OP open5gs open5gs | 3.7 | Oct 26 | Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output |
| CVE-2026-77057 New | BO boneIO boneIO | 2.3 | Oct 26 | Improper Restriction of Excessive Authentication Attempts in boneIO |
| CVE-2026-93848 New | MA Mattermost Mattermost | 2.7 | Oct 26 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator |
| CVE-2026-93847 New | MA Mattermost Mattermost | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints |
| CVE-2026-112880 New | HA hackney benoitc | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
| CVE-2026-116215 New | MA maccms10 maccmspro | 3.1 | Oct 26 | MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption |
| CVE-2026-116281 New | KA Kameleo Kameleo | 3.3 | Oct 26 | Kameleo Profile Controller t.cs ListProfiles information disclosure |
| CVE-2026-107157 New | QT Qt qt | 2.0 | Oct 26 | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework |
| CVE-2026-96432 New | QT qt qt | 2.1 | Oct 26 | Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt |
| CVE-2026-116261 New | LI libimobiledevice Libimobiledevice | 3.5 | Oct 26 | libimobiledevice AFC File afc.c afc_file_open out-of-bounds |
| CVE-2026-116229 New | FT FFXIV Teamcraft ffxiv-teamcraft | 3.5 | Oct 26 | ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting |
| CVE-2026-116228 New | AG agent-teams-ai 777genius | 3.3 | Oct 26 | 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication |
| CVE-2026-116227 New | BR BR-6208AC Edimax | 2.4 | Oct 26 | Edimax BR-6208AC Virtual Server cross site scripting |
| CVE-2026-116123 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB signup validatePassword excessive authentication |
| CVE-2026-116122 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure |
| CVE-2026-116121 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Registration users.service.ts race condition |
| CVE-2026-116115 New | GC GM8135S Camera Yoosee | 3.1 | Oct 26 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization |
| CVE-2026-116114 New | GC GM8135S Camera Yoosee | 3.7 | Oct 26 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission |
| CVE-2026-116105 New | HA HeyCyan App Heycyan App | 3.7 | Oct 26 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission |
| CVE-2026-116100 New | GO gougucms Gougucms | 2.4 | Oct 26 | gougucms User Level Level.php add cross site scripting |
| CVE-2026-116054 New | SH SH3 Sh3 | 2.2 | Oct 25 | SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash |
| CVE-2026-116186 New | CO core openremote | 2.3 | Oct 25 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116184 New | CO core openremote | 2.1 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-116197 New | CO contrast edgelesssys | 2.6 | Oct 25 | Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection |
| CVE-2026-116190 New | RC rclone rclone | 3.7 | Oct 25 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect |
| CVE-2026-116162 New | PA parse-server parse-community | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login |
| CVE-2026-116160 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate |
| CVE-2026-116159 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option |
| CVE-2026-116158 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in magick compare |
| CVE-2026-116157 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading |
| CVE-2026-116156 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option |
| CVE-2026-116153 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit |
| CVE-2026-116151 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder |
| CVE-2026-116150 New | IM ImageMagick ImageMagick | 3.1 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder |
| CVE-2026-116148 New | IM ImageMagick ImageMagick | 3.6 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options |
| CVE-2026-116147 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder |
| CVE-2026-116146 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder |
| CVE-2026-116145 New | IM ImageMagick ImageMagick | 3.9 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix |
| CVE-2026-116144 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder |
| CVE-2026-116143 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders |
| CVE-2026-116142 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box |
| CVE-2026-116140 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing |
| CVE-2026-116137 New | AD adm-zip cthackers | 3.7 | Oct 25 | adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names |
| CVE-2026-115183 New | QA Qi Addons For Elementor | 2.4 | Oct 25 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget |
| CVE-2026-114743 New | IC InstaWP Connect | 3.1 | Oct 25 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings |