CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114438 New | RH Red Hat Build of Keycloak Red Hat | 4.2 | Oct 21 | Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering |
| CVE-2026-114374 New | WI wiki-go leomoon-studios | 4.3 | Oct 21 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery |
| CVE-2026-112381 New | AT Apache Traffic Server Apache Software Foundation | 5.9 | Oct 21 | Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response |
| CVE-2026-111817 New | AT Apache Traffic Server Apache Software Foundation | 5.3 | Oct 21 | Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout |
| CVE-2026-114362 New | HA HarnessRouter Harnessrouter | 6.3 | Oct 21 | HarnessRouter Targets Test Endpoint app.py server-side request forgery |
| CVE-2026-114361 New | HA HarnessRouter Harnessrouter | 5.6 | Oct 21 | HarnessRouter Identity Mode app.py improper authorization |
| CVE-2026-19947 New | ZE zephyr zephyrproject | 5.3 | Oct 21 | Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer |
| CVE-2026-78119 New | ZE zephyr zephyrproject | 6.3 | Oct 21 | Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length |
| CVE-2026-78117 New | ZE zephyr zephyrproject | 4.2 | Oct 21 | Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air |
| CVE-2026-78116 New | ZE zephyr zephyrproject | 5.2 | Oct 21 | Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path |
| CVE-2026-114266 New | AL Advanced Library Management System ProjectWorlds | 6.3 | Oct 21 | ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection |
| CVE-2026-113461 New | CH Checkmk Checkmk GmbH | 5.2 | Oct 21 | mk-oracle: Local privilege escalation via insecure Oracle Home library loading |
| CVE-2026-105936 New | AP Apache Pulsar Apache Software Foundation | 5.3 | Oct 21 | Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint |
| CVE-2026-105935 New | AP Apache Pulsar Apache Software Foundation | 4.9 | Oct 21 | Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission |
| CVE-2026-111401 New | TT Tailored Tools Tailored Media | 6.5 | Oct 21 | WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-105930 New | AP Apache Pulsar Apache Software Foundation | 6.0 | Oct 21 | Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download |
| CVE-2026-112868 New | H5 H5P H5P | 4.3 | Oct 21 | WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-114265 New | AL Advanced Library Management System ProjectWorlds | 6.3 | Oct 21 | ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection |
| CVE-2026-114176 New | ER eRoom DigitalME | 4.3 | Oct 21 | WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-105926 New | AP Apache Pulsar Apache Software Foundation | 5.3 | Oct 21 | Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands |
| CVE-2026-114492 New | GI gin-vue-admin flipped-aurora | 6.5 | Oct 21 | gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint |
| CVE-2026-114491 New | PD pdfmake bpampuch | 5.3 | Oct 21 | pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images |
| CVE-2026-114133 New | NU nuxt nuxt | 5.4 | Oct 21 | Nuxt server islands render `useHeadSafe` input without sanitisation |
| CVE-2026-114132 New | NU nuxt nuxt | 6.3 | Oct 21 | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
| CVE-2026-114264 New | AL Advanced Library Management System ProjectWorlds | 4.7 | Oct 21 | ProjectWorlds Advanced Library Management System edit_member.php sql injection |
| CVE-2026-114131 New | NU nuxt nuxt | 6.5 | Oct 21 | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes |
| CVE-2026-114129 New | ST stream-json uhop | 6.2 | Oct 21 | stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service |
| CVE-2026-114128 New | AS astro withastro | 6.5 | Oct 21 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering |
| CVE-2026-92205 New | BU BusyBox BusyBox | 6.1 | Oct 21 | BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability |
| CVE-2026-53986 New | GC Girafit camera app Girafit | 5.3 | Oct 21 | Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure |
| CVE-2026-114260 New | FI file-management-system-php oretnom23 | 6.5 | Oct 21 | oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication |
| CVE-2026-114121 New | EL electron electron | 5.4 | Oct 21 | Electron: openExternal permission requests can be attributed to the wrong origin |
| CVE-2026-76497 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 6.6 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities |
| CVE-2026-76489 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability |
| CVE-2026-76487 New | CU Cisco Unified Communications Manager Cisco | 5.3 | Oct 21 | Cisco Unified Communications Manager Improper Access Control Vulnerability |
| CVE-2026-113800 New | EL electron electron | 5.4 | Oct 21 | Electron: HID and USB permission checks can be attributed to the wrong origin |
| CVE-2026-113799 New | SL slack-morphism-rust abdolence | 5.3 | Oct 21 | Slack Morphism verifier errors disclose valid HMACs in the logs |
| CVE-2026-76445 New | CO Cisco Open Source Snort3 Cisco | 5.3 | Oct 21 | Multiple Cisco Products Snort 3 Denial of Service Vulnerability |
| CVE-2026-76435 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 5.3 | Oct 21 | Cisco Expressway Series Information Disclosure Vulnerability |
| CVE-2026-76462 New | CS Cisco Secure Client Cisco | 5.5 | Oct 21 | Cisco Secure Client Privilege Escalation Vulnerability |
| CVE-2026-20221 New | CC Cisco Cyber Vision Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities |
| CVE-2026-20197 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability |
| CVE-2026-20218 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability |
| CVE-2026-113798 New | EL electron electron | 5.4 | Oct 21 | Electron: Pointer lock permission requests can be attributed to the wrong frame |
| CVE-2026-20179 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities |
| CVE-2026-20019 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities |
| CVE-2026-20011 New | CO Cisco Open Source Snort3 Cisco | 5.8 | Oct 21 | Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability |
| CVE-2026-113796 New | EL electron electron | 4.2 | Oct 21 | Electron: SameSite cookie restrictions are not applied to windows opened from links |
| CVE-2026-113795 New | PY pypdf py-pdf | 6.0 | Oct 21 | pypdf: Possible large memory usage for streams with multiple filters |
| CVE-2026-113794 New | PY pypdf py-pdf | 6.0 | Oct 21 | pypdf: Possible infinite loop when hitting EOF in standard xref table |