CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-80991 | LI Linux Linux | 7.8 | Sep 11 | net: ravb: serialize PTP clock teardown |
| CVE-2026-80989 | LI Linux Linux | 8.8 | Sep 11 | net: thunderbolt: Mark the connection down when bringing it up fails |
| CVE-2026-80987 | LI Linux Linux | 7.5 | Sep 11 | NTB: ntb_transport: Reject oversized TX buffers |
| CVE-2026-80985 | LI Linux Linux | 8.2 | Sep 11 | net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry |
| CVE-2026-80982 | LI Linux Linux | 7.8 | Sep 11 | net/smc: fix use-after-free in smc_rx_pipe_buf_release() |
| CVE-2026-80979 | LI Linux Linux | 7.8 | Sep 11 | net/smc: unregister the connection before draining the rx tasklet |
| CVE-2026-80978 | LI Linux Linux | 7.8 | Sep 11 | net: cap advertised IP tunnel headroom |
| CVE-2026-80977 | LI Linux Linux | 7.8 | Sep 11 | net: skbuff: don't touch shared zerocopy state in skb_tx_error() |
| CVE-2026-80975 | LI Linux Linux | 7.8 | Sep 11 | mfd: qnap-mcu: keep the reply buffer alive past a command timeout |
| CVE-2026-80971 | LI Linux Linux | 7.8 | Sep 11 | ALSA: bcd2000: clear the URB pointers on disconnect |
| CVE-2026-80967 | LI Linux Linux | 8.4 | Sep 11 | ALSA: pcxhr: initialize mutexes before requesting threaded IRQ |
| CVE-2026-80962 | LI Linux Linux | 7.8 | Sep 11 | dm-pcache: validate geometry fields from on-disk cache_info |
| CVE-2026-80961 | LI Linux Linux | 7.8 | Sep 11 | dm-pcache: validate kset key_num and intra-segment bounds |
| CVE-2026-80959 | LI Linux Linux | 7.8 | Sep 11 | dm-pcache: bound the persisted tail-position offset |
| CVE-2026-80958 | LI Linux Linux | 7.1 | Sep 11 | dm-pcache: clamp the tail kset read to the segment data region |
| CVE-2026-80955 | LI Linux Linux | 7.8 | Sep 11 | dm-pcache: fix use-after-free and invalid seg operations in kset_replay() |
| CVE-2026-80954 | LI Linux Linux | 7.8 | Sep 11 | i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() |
| CVE-2026-80953 | LI Linux Linux | 8.4 | Sep 11 | i3c: master: adi: initialize the lock before enabling interrupts |
| CVE-2026-80952 | LI Linux Linux | 7.8 | Sep 11 | i3c: master: Fix info leak and UAF in device unregister path |
| CVE-2026-80950 | LI Linux Linux | 7.8 | Sep 11 | i3c: renesas: Check that the transfer is valid before accessing it |
| CVE-2026-80947 | LI Linux Linux | 7.8 | Sep 11 | wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop |
| CVE-2026-80944 | LI Linux Linux | 7.8 | Sep 11 | wifi: mwifiex: Detach sync cmd buffer on interrupted wait |
| CVE-2026-80943 | LI Linux Linux | 7.6 | Sep 11 | wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids |
| CVE-2026-80937 | LI Linux Linux | 8.8 | Sep 11 | wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy |
| CVE-2026-80936 | LI Linux Linux | 7.8 | Sep 11 | wifi: mt76: mt7925: cancel mlo_pm_work on stop |
| CVE-2026-80935 | LI Linux Linux | 8.8 | Sep 11 | wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy |
| CVE-2026-80933 | LI Linux Linux | 7.8 | Sep 11 | wifi: mt76: mt7996: validate default EEPROM firmware size |
| CVE-2026-80932 | LI Linux Linux | 8.4 | Sep 11 | vsock/virtio: flush works in dependency order |
| CVE-2026-80931 | LI Linux Linux | 7.8 | Sep 11 | w1: ds28e17: reject an oversize length on an I2C block read |
| CVE-2026-80929 | LI Linux Linux | 7.8 | Sep 11 | sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] |
| CVE-2026-80928 | LI Linux Linux | 7.8 | Sep 11 | smack: fix cred UAF in smack_file_send_sigiotask() |
| CVE-2026-62089 | MA Master Addons for Elementor Pixar Labs | 7.1 | Sep 11 | WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability |
| CVE-2026-62112 | AM Amelia Melograno Venture Studio | 7.6 | Sep 11 | WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability |
| CVE-2026-62109 | SA Sky Addons for Elementor wowDevs | 7.6 | Sep 11 | WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability |
| CVE-2026-62107 | ML Masteriyo - LMS masteriyo | 8.8 | Sep 11 | WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability |
| CVE-2026-62106 | SA SMS Alert Order Notifications Cozy Vision Technologies Pvt. Ltd. | 8.8 | Sep 11 | WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability |
| CVE-2026-62102 | GG Gato GraphQL Gato GraphQL | 8.8 | Sep 11 | WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability |
| CVE-2026-67211 | AO Apache OpenNLP Apache Software Foundation | 7.5 | Sep 11 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer |
| CVE-2026-89099 | MO MongoDB MongoDB | 7.5 | Sep 11 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption |
| CVE-2026-72708 | SP SPIP SPIP | 7.5 | Sep 11 | SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html |
| CVE-2026-89066 | PR projen AWS | 7.8 | Sep 11 | OS command injection in the task synthesis component in projen |
| CVE-2026-89065 | PR projen AWS | 7.1 | Sep 11 | Relative path traversal in the generated file manifest cleanup component in projen |
| CVE-2026-7863 | PS Pardus Software TUBITAK BILGEM Software Technologies Research Institute | 8.4 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus Software |
| CVE-2026-89013 | DO Dolibarr Dolibarr | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php |
| CVE-2026-70341 | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Sep 11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-68497 | JA jackson-databind FasterXML | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service |
| CVE-2026-89262 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89260 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint |
| CVE-2026-38056 | 3T 3315-Series terminals ST Engineering iDirect | 8.8 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Missing Authorization |
| CVE-2026-38058 | 3T 3315-Series terminals ST Engineering iDirect | 8.1 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere |