CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 00:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-51871 | Product not mapped yet | 9.8 | Sep 30 | Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by… |
| CVE-2026-51861 | Product not mapped yet | 9.8 | Sep 30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py |
| CVE-2026-51858 | Product not mapped yet | 9.8 | Sep 30 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary |
| CVE-2026-51864 | Product not mapped yet | 9.1 | Sep 30 | DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42) |
| CVE-2026-51859 | Product not mapped yet | 9.1 | Sep 30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290) |
| CVE-2026-51862 | Product not mapped yet | 9.1 | Sep 30 | DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40) |
| CVE-2026-102794 | ZA ZHOME A0101 Ziroom | 9.1 | Sep 29 | Ziroom ZHOME A0101 ping command injection |
| CVE-2026-102793 | ZA ZHOME A0101 Ziroom | 9.1 | Sep 29 | Ziroom ZHOME A0101 set_time_zone command injection |
| CVE-2026-86131 | FO Fireware OS WatchGuard | 9.8 | Sep 29 | Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution |
| CVE-2026-103041 | LI LightLLM ModelTC | 9.8 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service |
| CVE-2026-103040 | LI LightLLM ModelTC | 9.8 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service |
| CVE-2026-103044 | ME Mediawiki - EasyTimeline extension The Wikimedia Foundation | 9.8 | Sep 29 | EasyTimeline should not serve image maps as application/xml |
| CVE-2026-102792 | ZA ZHOME A0101 Ziroom | 9.1 | Sep 29 | Ziroom ZHOME A0101 set_syslog command injection |
| CVE-2026-72507 | TM TMS7 Toptech Systems | 9.0 | Sep 29 | Toptech TMS7 and TopHAT SQL Injection |
| CVE-2026-68068 | TM TMS7 Toptech Systems | 9.0 | Sep 29 | Toptech TMS7 and TopHAT SQL Injection |
| CVE-2026-68954 | TM TMS7 Toptech Systems | 9.0 | Sep 29 | Toptech TMS7 and TopHAT SQL Injection |
| CVE-2026-63713 | TM TMS7 Toptech Systems | 9.0 | Sep 29 | Toptech TMS7 and TopHAT SQL Injection |
| CVE-2026-72510 | TM TMS7 Toptech Systems | 9.0 | Sep 29 | Toptech TMS7 and TopHAT SQL Injection |
| CVE-2026-70356 | TM TMS7 Toptech Systems | 9.1 | Sep 29 | Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type |
| CVE-2026-71379 | TM TMS7 Toptech Systems | 10.0 | Sep 29 | Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties |
| CVE-2026-96587 | DA Dashcam Android Application Viidure | 10.0 | Sep 29 | Use of Hard-coded Credentials in Viidure Dashcam Android Application |
| CVE-2026-53988 | DO dockhand Finsys | 10.0 | Sep 29 | Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints |
| CVE-2026-102308 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-102309 | CH Chrome Google | 9.6 | Sep 29 | Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-102304 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-102316 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-102306 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-102331 | CH Chrome Google | 9.6 | Sep 29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-100291 | YS YSSD-RTMP-H5 Anjvision | 9.8 | Sep 29 | Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5 |
| CVE-2026-76725 | IO Instant ON Hewlett Packard Enterprise (HPE) | 9.6 | Sep 29 | Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs |
| CVE-2026-76724 | IO Instant ON Hewlett Packard Enterprise (HPE) | 9.6 | Sep 29 | Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol |
| CVE-2026-76723 | IO Instant ON Hewlett Packard Enterprise (HPE) | 9.6 | Sep 29 | Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS |
| CVE-2026-76722 | IO Instant ON Hewlett Packard Enterprise (HPE) | 9.8 | Sep 29 | Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs |
| CVE-2026-76721 | IO Instant ON Hewlett Packard Enterprise (HPE) | 9.8 | Sep 29 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs |
| CVE-2026-102829 | GI git-js steveukx | 9.2 | Sep 29 | simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection |
| CVE-2026-102828 | GI git-js steveukx | 9.8 | Sep 29 | simple-git unsafe-operation guard does not block trailer command configuration |
| CVE-2026-102827 | GI git-js steveukx | 9.8 | Sep 29 | simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) |
| CVE-2026-84436 | GD Guardium Data Protection IBM | 9.1 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-102710 | EC eclipse-threadx/threadx Eclipse Foundation | 9.3 | Sep 29 | Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE` |
| CVE-2026-95311 | CH Chrome Google | 9.6 | Sep 29 | Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the… |
| CVE-2026-95347 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic |
| CVE-2026-95325 | CH Chrome Google | 9.6 | Sep 29 | Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95331 | CH Chrome Google | 9.6 | Sep 29 | Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95299 | CH Chrome Google | 9.6 | Sep 29 | Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95318 | CH Chrome Google | 9.6 | Sep 29 | Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95277 | CH Chrome Google | 9.6 | Sep 29 | Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95283 | CH Chrome Google | 9.6 | Sep 29 | Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-95310 | CH Chrome Google | 9.6 | Sep 29 | Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-95356 | CH Chrome Google | 9.6 | Sep 29 | Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the… |
| CVE-2026-95329 | CH Chrome Google | 9.6 | Sep 29 | Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |