CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:18 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-95357 | CH Chrome Google | 9.6 | Sep 29 | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-95350 | CH Chrome Google | 9.6 | Sep 29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-102761 | ND NetX Duo Eclipse Foundation | 9.3 | Sep 29 | NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the… |
| CVE-2026-102560 | RH Red Hat Enterprise Linux 10 Red Hat | 9.8 | Sep 29 | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth |
| CVE-2026-102425 | BF Balbooa Forms extension for Joomla balbooa.com | 10.0 | Sep 29 | Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 |
| CVE-2026-101127 | BF Balbooa Forms extension for Joomla balbooa.com | 9.4 | Sep 29 | Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 |
| CVE-2026-102676 | EL electron electron | 9.8 | Sep 29 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
| CVE-2026-100240 | MT Mediawiki - TemplateSandbox Extension Wikimedia Foundation | 9.1 | Sep 29 | TemplateSandbox does not check read permissions for the page being previewed |
| CVE-2023-54400 | FC Fumeng Cloud Fumasoft | 9.8 | Sep 29 | Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname |
| CVE-2026-49243 | WE webmin webmin | 9.6 | Sep 29 | Webmin: Reflected XSS in the Configuration module |
| CVE-2026-22094 | D8 DC 80 EVbee | 9.3 | Sep 29 | Weak root password in EVbee DC 80 |
| CVE-2026-100829 | FI Firefox Mozilla | 9.6 | Sep 29 | Mitigation bypass in the DOM: Security component |
| CVE-2026-100828 | FI Firefox Mozilla | 9.6 | Sep 29 | Mitigation bypass in the Bookmarks & History component |
| CVE-2026-100819 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to incorrect boundary conditions in the XPCOM component |
| CVE-2026-100818 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the Widget: Gtk component |
| CVE-2026-100811 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component |
| CVE-2026-100810 | FI Firefox Mozilla | 9.8 | Sep 29 | Other issue in the DevTools component |
| CVE-2026-100804 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the Preferences: Backend component |
| CVE-2026-100800 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the Disability Access APIs component |
| CVE-2026-100794 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to incorrect boundary conditions in the Internationalization component |
| CVE-2026-100788 | FI Firefox Mozilla | 9.8 | Sep 29 | Invalid pointer in the JavaScript: WebAssembly component |
| CVE-2026-100787 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape in the XUL component |
| CVE-2026-100786 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the Graphics component |
| CVE-2026-100781 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component |
| CVE-2026-100778 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component |
| CVE-2026-100775 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape in the Graphics component |
| CVE-2026-100770 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the DOM: Content Processes component |
| CVE-2026-100763 | FI Firefox Mozilla | 9.1 | Sep 29 | Incorrect boundary conditions in the Graphics: WebGPU component |
| CVE-2026-100762 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape due to use-after-free in the DOM: Content Processes component |
| CVE-2026-100760 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape in the Security: Process Sandboxing component |
| CVE-2026-100758 | FI Firefox Mozilla | 9.6 | Sep 29 | Sandbox escape in the DOM: Navigation component |
| CVE-2026-82973 | DO docker-mailbox psyb0t | 9.4 | Sep 29 | Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox |
| CVE-2026-7192 | T4 T-CPE301K 4G Mini WiFi Router Shenzhen Dbit Network Equipment | 9.3 | Sep 29 | Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment |
| CVE-2026-73595 | SC Secure Connect Gateway (SCG) Policy Manager Dell | 9.8 | Sep 29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability |
| CVE-2026-85520 | GM Google Merchant Center Feed MyPresta | 9.3 | Sep 29 | Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module |
| CVE-2026-15390 | DU Das U-Boot DENX Software Engineering | 9.0 | Sep 29 | Out-of-bounds write in Das U-Boot |
| CVE-2026-8066 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite… |
| CVE-2026-8065 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary… |
| CVE-2026-96431 | A4 Agentflow 4.0 Flowring Technology Corp | 9.3 | Sep 29 | Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type |
| CVE-2026-91048 | AK Apache Karaf Apache Software Foundation | 9.8 | Sep 29 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create |
| CVE-2026-91012 | AK Apache Karaf Apache Software Foundation | 9.8 | Sep 29 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation |
| CVE-2026-96429 | A4 Agentflow 4.0 Flowring Technology Corp | 9.3 | Sep 29 | Flowring Agentflow 4.0 - SQL Injection |
| CVE-2026-96428 | A4 Agentflow 4.0 Flowring Technology Corp | 9.3 | Sep 29 | Flowring Agentflow 4.0 - SQL Injection |
| CVE-2026-84154 | GG GEOVIA Geospatial Data Manager Dassault Systèmes | 9.9 | Sep 29 | Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x |
| CVE-2026-102240 | NA NAP930 Netcore | 10.0 | Sep 29 | Netcore NAP930 Network Tools CGI network_tools eval os command injection |
| CVE-2026-101354 | FA FAC1203R FAST | 9.6 | Sep 29 | FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow |
| CVE-2024-31026 | Product not mapped yet | 9.8 | Sep 29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module |
| CVE-2026-39117 | Product not mapped yet | 9.8 | Sep 29 | An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php |
| CVE-2026-79538 | Product not mapped yet | 9.8 | Sep 29 | metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO… |
| CVE-2026-77177 | Product not mapped yet | 9.8 | Sep 29 | Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template… |