CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:51 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105618 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent |
| CVE-2026-105617 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule |
| CVE-2026-105616 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting |
| CVE-2026-105615 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats |
| CVE-2026-105614 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur() |
| CVE-2026-105613 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions |
| CVE-2026-105612 New | PA PostgreSQL Anonymizer DALIBO | 3.5 | Oct 28 | PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles |
| CVE-2026-118242 New | GR grid-lite @highcharts | 8.5 | Oct 28 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` |
| CVE-2026-84725 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 8.1 | Oct 28 | Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap |
| CVE-2026-116797 New | DA dashboards @highcharts | 8.5 | Oct 28 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` |
| CVE-2026-79656 New | GR Grafana Grafana | 6.0 | Oct 28 | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors |
| CVE-2026-116796 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts |
| CVE-2026-58458 New | DS Don't Starve Together Klei Entertainment | 6.5 | Oct 28 | Don't Starve Together Memory Corruption via world_gen_data |
| CVE-2026-117501 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies |
| CVE-2026-117500 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload |
| CVE-2026-116531 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk |
| CVE-2026-116285 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies |
| CVE-2026-116135 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them |
| CVE-2026-116134 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block |
| CVE-2026-116133 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary |
| CVE-2026-116132 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk |
| CVE-2026-116131 New | Product not mapped yet | – | Oct 28 | HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts |
| CVE-2026-116795 New | RE re2js le0pard | 7.5 | Oct 28 | RE2JS: Quadratic-time denial of service in re2js lookbehind matching |
| CVE-2026-116794 New | RU russh Eugeny | 8.3 | Oct 28 | russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation |
| CVE-2026-82962 New | ZE zephyr zephyrproject | 6.5 | Oct 28 | Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet |
| CVE-2026-82961 New | ZE zephyr zephyrproject | 7.8 | Oct 28 | Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode |
| CVE-2026-118619 New | UL Ultralytics Ultralytics | 8.8 | Oct 28 | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability |
| CVE-2026-118618 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118617 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118616 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118615 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability |
| CVE-2026-118614 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118613 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118581 New | MO MongoDB MongoDB | 6.5 | Oct 28 | NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol |
| CVE-2026-118611 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118610 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118609 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118608 New | IL iLX-F511 Alpine | 3.5 | Oct 28 | Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2026-118607 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 diagapp Command Injection Vulnerability |
| CVE-2026-103506 New | GR Grafana Grafana | 8.9 | Oct 28 | SSO settings authorization bypass |
| CVE-2026-118606 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability |
| CVE-2026-118605 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-88858 New | GR Grafana Grafana | 6.5 | Oct 28 | Server-side expression parser denial of service |
| CVE-2026-118604 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118603 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118602 New | IL iLX-F511 Alpine | 7.8 | Oct 28 | Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability |
| CVE-2026-118601 New | IL iLX-F511 Alpine | 6.3 | Oct 28 | Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability |
| CVE-2026-88967 New | GR Grafana Grafana | 7.7 | Oct 28 | Azure Monitor access token disclosure via SSRF |
| CVE-2026-100105 New | GR Grafana Grafana | 7.7 | Oct 28 | Alerting contact point authorization bypass via schema downgrade |
| CVE-2026-117626 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/,… |