CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 20:24 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105192 | LM LMCache LMCache | 9.8 | Oct 7 | LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization |
| CVE-2026-103416 | ET Eclipse ThreadX - NetX Duo Eclipse Foundation | 9.3 | Oct 7 | Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it… |
| CVE-2025-64393 | BR Backup & Replication Veeam | 9.4 | Oct 7 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server |
| CVE-2026-97720 | AI Apache Impala Apache Software Foundation | 9.1 | Oct 7 | Apache Impala: Impala Executor Webserver Auth Bypass |
| CVE-2026-107104 | ME Multi-tenant ERP System Manacle Technologies | 9.3 | Oct 7 | Unsafe Deserialization Vulnerability in Manacle Technologies ERP System |
| CVE-2026-107103 | ME Multi-tenant ERP System Manacle Technologies | 9.3 | Oct 7 | SQL Injection Vulnerability in Manacle Technologies ERP System |
| CVE-2026-107102 | ME Multi-tenant ERP System Manacle Technologies | 9.3 | Oct 7 | Account Takeover Vulnerability in Manacle Technologies ERP System |
| CVE-2026-102782 | OS OrdaSoft Simple Membership extension for Joomla ordasoft.com | 9.3 | Oct 7 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 |
| CVE-2026-59346 | VF VMware Fusion VMware | 9.3 | Oct 7 | VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability |
| CVE-2026-19572 | FP FlexNet Publisher Flexera | 9.3 | Oct 7 | FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability |
| CVE-2026-81535 | WO wolfSSH wolfSSL Inc. | 9.1 | Oct 7 | wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check |
| CVE-2026-14911 | RO Router ASUS | 9.3 | Oct 7 | Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router… |
| CVE-2026-19386 | RO Router ASUS | 9.3 | Oct 7 | A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the… |
| CVE-2026-105324 | AD ADM ASUSTOR Inc. | 9.2 | Oct 7 | An HTTP header injection vulnerability was found in the ADM |
| CVE-2026-93675 | LO Langflow OSS IBM | 9.8 | Oct 7 | Langflow OSS is affected by multiple vulnerabilities |
| CVE-2026-93674 | LO Langflow OSS IBM | 9.8 | Oct 7 | Langflow OSS is affected by multiple vulnerabilities |
| CVE-2025-70518 | Product not mapped yet | 10.0 | Oct 7 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely |
| CVE-2025-70520 | Product not mapped yet | 9.8 | Oct 7 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users |
| CVE-2025-70521 | Product not mapped yet | 9.8 | Oct 7 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely |
| CVE-2025-70516 | Product not mapped yet | 9.1 | Oct 7 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users |
| CVE-2026-104334 | LO Langflow OSS IBM | 9.8 | Oct 6 | Langflow OSS is affected by multiple vulnerabilities |
| CVE-2026-101023 | GI Gitea Gitea | 9.1 | Oct 6 | Gitea OAuth2 refresh token grant accepts access tokens |
| CVE-2026-106501 | PL plugin-scaffolder-backend @backstage | 9.6 | Oct 6 | Backstage: Sensitive information exposure in Scaffolder |
| CVE-2026-106486 | PL plugin-scaffolder-backend-module-bitbucket-cloud @backstage | 9.9 | Oct 6 | Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions |
| CVE-2026-105812 | BE bedrock-agentcore-starter-toolkit aws | 9.0 | Oct 6 | Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import |
| CVE-2026-106446 | HA handlebars.js handlebars-lang | 9.8 | Oct 6 | Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) |
| CVE-2026-102159 | CC CloudVision CUE Arista Networks | 9.8 | Oct 6 | An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services |
| CVE-2026-106445 | HA handlebars.js handlebars-lang | 9.2 | Oct 6 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| CVE-2026-101155 | CP CloudVision Portal Arista Networks | 9.1 | Oct 6 | An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads t |
| CVE-2026-73278 | GI Gitea Gitea | 9.8 | Oct 6 | Gitea WebAuthn bypass during OAuth and OIDC sign-in |
| CVE-2026-94205 | GI Gitea Gitea | 9.8 | Oct 6 | Gitea fork workflow approval bypass through maintainer-triggered events |
| CVE-2026-95106 | GI Gitea Gitea | 9.1 | Oct 6 | Gitea review and execution mismatch through duplicate tree entries |
| CVE-2026-103059 | GI Gitea Gitea | 9.1 | Oct 6 | Gitea built-in SSH server authentication bypass through key case folding |
| CVE-2026-79805 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager |
| CVE-2026-79801 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent |
| CVE-2026-79798 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.9 | Oct 6 | Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface |
| CVE-2026-79796 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Authentication Bypass Vulnerabilities in ClearPass Policy Manager |
| CVE-2026-79794 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.1 | Oct 6 | Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface |
| CVE-2026-76754 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager |
| CVE-2026-76753 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager |
| CVE-2026-76752 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access |
| CVE-2026-76751 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution |
| CVE-2026-76750 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager |
| CVE-2026-76747 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.1 | Oct 6 | Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S |
| CVE-2026-76746 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 6 | Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S |
| CVE-2026-76745 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 6 | Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S |
| CVE-2026-76744 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S |
| CVE-2026-76743 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Authentication Bypass Vulnerability in the Management Interface of AOS-S |
| CVE-2026-76742 | AA AOS-Switch (AOS-S) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 6 | Authentication Bypass in the Web Management Interface of AOS-S |
| CVE-2026-106511 | MU multisig-improved MultiversX Labs S.R.L. | 9.8 | Oct 6 | MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a… |