CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2013-20008 New | WA WAG200G Linksys | 6.8 | Oct 28 | Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password |
| CVE-2026-118272 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure |
| CVE-2026-118271 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-context Resolver data-context.ts resource consumption |
| CVE-2026-118129 New | CH Chitchatter jeremyckahn | 6.3 | Oct 27 | jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication |
| CVE-2026-50571 New | WE websub w3c | 5.7 | Oct 27 | WebSub: Reflected script execution through intent-verification challenges |
| CVE-2026-22063 New | ES E-Series SANtricity OS Controller Software NetApp | 6.0 | Oct 27 | CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products |
| CVE-2026-58496 New | TH thorvg thorvg | 4.3 | Oct 27 | ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API |
| CVE-2026-118128 New | A2 a2a-js a2aproject | 6.5 | Oct 27 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition |
| CVE-2026-57203 New | AS asterisk asterisk | 6.9 | Oct 27 | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location |
| CVE-2026-57192 New | AS asterisk asterisk | 6.0 | Oct 27 | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch |
| CVE-2026-116774 New | RU russh Eugeny | 4.3 | Oct 27 | russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) |
| CVE-2026-116773 New | RU russh Eugeny | 4.3 | Oct 27 | russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets |
| CVE-2026-116695 New | CR crass rgrove | 5.3 | Oct 27 | Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass |
| CVE-2026-116694 New | OP opentelemetry-python open-telemetry | 6.3 | Oct 27 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation |
| CVE-2026-116691 New | ML mlflow mlflow | 6.5 | Oct 27 | MLflow CrewAI autologging records LLM provider API keys in logged trace spans |
| CVE-2026-116689 New | FO follow-redirects follow-redirects | 5.9 | Oct 27 | follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects |
| CVE-2026-116686 New | PY python-sdk modelcontextprotocol | 6.5 | Oct 27 | Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas |
| CVE-2026-116685 New | PY python-sdk modelcontextprotocol | 5.9 | Oct 27 | Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies |
| CVE-2026-116684 New | PY python-sdk modelcontextprotocol | 6.8 | Oct 27 | Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server |
| CVE-2026-118173 New | MI misp-guard MISP | 6.1 | Oct 27 | MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement |
| CVE-2026-117526 New | RE redux-devtools reduxjs | 5.3 | Oct 27 | reduxjs redux-devtools Remotedev Server evalAction code injection |
| CVE-2026-116680 New | HO homebox sysadminsmedia | 6.4 | Oct 27 | Homebox generic notifier SSRF via HTTP redirect after URL validation |
| CVE-2026-102816 New | RV RE305 v3 TP-Link Systems Inc. | 5.3 | Oct 27 | Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 |
| CVE-2026-102815 New | RV RE305 v3 TP-Link Systems Inc. | 6.9 | Oct 27 | Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305 |
| CVE-2026-102813 New | RV RE305 v3 TP-Link Systems Inc. | 6.1 | Oct 27 | Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 |
| CVE-2026-102812 New | AC Archer C7 v5 TP-Link Systems Inc. | 6.9 | Oct 27 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 |
| CVE-2026-108316 New | TS Tanium Server Tanium | 4.3 | Oct 27 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
| CVE-2026-108325 New | RE Reputation Tanium | 6.6 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. |
| CVE-2026-116659 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| CVE-2026-108302 New | CO Comply Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108332 New | EC Endpoint Configuration Toolset Solution Tanium | 6.3 | Oct 27 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. |
| CVE-2026-108301 New | CO Comply Tanium | 6.0 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108309 New | EC Endpoint Configuration Toolset Solution Tanium | 5.5 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. |
| CVE-2026-116658 New | EN Enforce Tanium | 6.5 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-108313 New | TS Tanium Server Tanium | 6.6 | Oct 27 | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. |
| CVE-2026-116660 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Enforce. |
| CVE-2026-108326 New | CX cx-stream Tanium | 6.5 | Oct 27 | Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. |
| CVE-2026-116657 New | EN Enforce Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-116679 New | NE neko m1k1o | 5.4 | Oct 27 | Neko: Authorization bypass in legacy WebRTC input handling |
| CVE-2026-108310 New | TS Tanium Server Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Tanium Server. |
| CVE-2026-87085 New | PR Provision Tanium | 6.3 | Oct 27 | Tanium addressed a SQL injection vulnerability in Provision. |
| CVE-2026-108308 New | PA Patch Tanium | 6.5 | Oct 27 | Tanium addressed a SQL injection vulnerability in Patch. |
| CVE-2026-108328 New | TR Threat Response Tanium | 4.2 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. |
| CVE-2026-116678 New | VA vaultwarden dani-garcia | 5.8 | Oct 27 | Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs |
| CVE-2026-116677 New | OP openwisp-controller openwisp | 5.3 | Oct 27 | OpenWISP Controller CA CRL REST API does not scope requests to managed organizations |
| CVE-2026-16491 New | GR Grafana Grafana | 6.5 | Oct 27 | CVE-2026-16491 CVE Record |
| CVE-2026-57194 New | AS asterisk asterisk | 5.9 | Oct 27 | Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk |
| CVE-2026-116674 New | SY systeminformation sebhildebrandt | 6.5 | Oct 27 | systeminformation: Prototype pollution in `networkStats()` via the interface name |
| CVE-2026-57185 New | AS asterisk asterisk | 6.5 | Oct 27 | Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser |
| CVE-2026-109088 New | LI libXtst X.org | 6.5 | Oct 27 | libXtst RECORD EnableContext Reply Endless Loop |