CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 06:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114377 | WI wiki-go leomoon-studios | 3.8 | Oct 21 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal |
| CVE-2026-18748 | ZE zephyr zephyrproject | 3.5 | Oct 21 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling |
| CVE-2026-105938 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all |
| CVE-2026-105933 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization |
| CVE-2026-105932 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints |
| CVE-2026-105931 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants |
| CVE-2026-105927 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission |
| CVE-2026-114130 | NU nuxt nuxt | 2.3 | Oct 21 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
| CVE-2026-114127 | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-114124 | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114122 | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-113797 | EL electron electron | 3.1 | Oct 21 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
| CVE-2026-114472 | HM hMailServer Progressive Robot Ltd | 3.7 | Oct 21 | Insufficient Resource Pool in hMailServer |
| CVE-2026-114370 | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 3.7 | Oct 21 | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal |
| CVE-2026-113786 | PY pypdf py-pdf | 2.3 | Oct 21 | pypdf: Unvalidated JPEG image data loading |
| CVE-2026-104949 | WA WarehousePG EnterpriseDB | 2.3 | Oct 21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() |
| CVE-2026-87096 | AC Acronis Cyber Infrastructure Acronis | 3.3 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-35501 | UN Unbound NLnet Labs | 3.7 | Oct 21 | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. |
| CVE-2026-104642 | SS Simple Shopping Cart | 2.7 | Oct 21 | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass |
| CVE-2026-114236 | CC Confidential Compute Attestation Red Hat | 3.3 | Oct 21 | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers |
| CVE-2026-96901 | CA Cart Abandonment Recovery for WooCommerce | 3.7 | Oct 21 | Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token |
| CVE-2026-105257 | AB Appointment Booking Plugin | 2.7 | Oct 21 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR |
| CVE-2026-114040 | BE BerryNet DT42 | 3.5 | Oct 21 | DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal |
| CVE-2026-114115 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection |
| CVE-2026-114071 | TR trigger.dev triggerdotdev | 3.1 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route |
| CVE-2026-114070 | TR trigger.dev triggerdotdev | 3.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records |
| CVE-2026-114049 | VL vllm vllm-project | 3.7 | Oct 21 | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense |
| CVE-2026-114048 | AV AVideo WWBN | 3.5 | Oct 21 | WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints |
| CVE-2020-37289 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values |
| CVE-2020-37288 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops |
| CVE-2026-113735 | DC DCS-6501LH D-Link | 3.7 | Oct 20 | D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials |
| CVE-2026-113706 | A2 a2a-rs a2aproject | 3.5 | Oct 20 | a2aproject a2a-rs inmemory.rs information disclosure |
| CVE-2026-9825 | CY CyberFraud IBM | 3.7 | Oct 20 | IBM Cyber Fraud Reachable Assertion |
| CVE-2026-113731 | DJ djust djust-org | 3.3 | Oct 20 | djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool |
| CVE-2026-91650 | OE Oracle Essbase Oracle Corporation | 3.7 | Oct 20 | Vulnerability in Oracle Essbase (component: Java Based Agent) |
| CVE-2026-91616 | OM Oracle Middleware Common Libraries and Tools Oracle Corporation | 3.7 | Oct 20 | Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent) |
| CVE-2026-91614 | OC Oracle Communications Unified Inventory Management Oracle Corporation | 3.3 | Oct 20 | Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security) |
| CVE-2026-91613 | OC Oracle Communications Unified Inventory Management Oracle Corporation | 3.3 | Oct 20 | Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security) |
| CVE-2026-91612 | OC Oracle Communications Unified Inventory Management Oracle Corporation | 3.3 | Oct 20 | Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security) |
| CVE-2026-91582 | OB Oracle Business Intelligence Enterprise Edition Oracle Corporation | 3.7 | Oct 20 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search) |
| CVE-2026-91485 | PE PeopleSoft Enterprise FIN Cash Management Oracle Corporation | 3.8 | Oct 20 | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management) |
| CVE-2026-91477 | OJ Oracle JavaFX Oracle Corporation | 3.1 | Oct 20 | Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX) |
| CVE-2026-91471 | PE PeopleSoft Enterprise CC Common Application Objects Oracle Corporation | 3.7 | Oct 20 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework) |
| CVE-2026-91461 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 3.7 | Oct 20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-91436 | SC Siebel CRM Deployment Oracle Corporation | 3.9 | Oct 20 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure) |
| CVE-2026-91427 | SC Siebel CRM Deployment Oracle Corporation | 2.3 | Oct 20 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure) |
| CVE-2026-91409 | OJ Oracle Java SE Oracle Corporation | 3.7 | Oct 20 | Vulnerability in Oracle Java SE (component: Networking) |
| CVE-2026-91402 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 3.1 | Oct 20 | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX) |
| CVE-2026-91400 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 3.1 | Oct 20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound) |
| CVE-2026-91397 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 3.6 | Oct 20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability) |