CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 00:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117616 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission… |
| CVE-2026-117615 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and… |
| CVE-2026-117614 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without… |
| CVE-2026-117613 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API… |
| CVE-2026-117612 New | JE Jenkins Jenkins | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization |
| CVE-2026-114349 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches |
| CVE-2026-112375 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs |
| CVE-2026-116593 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint |
| CVE-2026-115644 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions |
| CVE-2026-111551 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation |
| CVE-2026-111496 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation |
| CVE-2026-111115 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing |
| CVE-2026-111108 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers |
| CVE-2026-111073 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service |
| CVE-2026-106079 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration |
| CVE-2026-110985 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured |
| CVE-2026-103411 New | SS Session Smart Router Juniper Networks | 7.1 | Oct 28 | Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing |
| CVE-2026-110952 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default |
| CVE-2026-83525 New | AK Apache Kafka Apache Software Foundation | – | Oct 28 | Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. |
| CVE-2026-103410 New | SS Session Smart Router Juniper Networks | 7.5 | Oct 28 | Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection |
| CVE-2026-103409 New | SS Session Smart Router Juniper Networks | 9.8 | Oct 28 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed |
| CVE-2026-103408 New | SS Session Smart Router Juniper Networks | 8.8 | Oct 28 | Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options |
| CVE-2026-103407 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management |
| CVE-2026-103406 New | SS Session Smart Conductor Juniper Networks | 9.8 | Oct 28 | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. |
| CVE-2026-103405 New | SS Session Smart Conductor Juniper Networks | 5.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting |
| CVE-2026-103404 New | SS Session Smart Conductor Juniper Networks | 6.8 | Oct 28 | Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials |
| CVE-2026-103403 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules |
| CVE-2026-103402 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation |
| CVE-2026-103401 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root |
| CVE-2026-103400 New | SS Session Smart Conductor Juniper Networks | 5.5 | Oct 28 | Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup |
| CVE-2026-103394 New | SS Session Smart Router Juniper Networks | 3.7 | Oct 28 | Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. |
| CVE-2026-103393 New | SS Session Smart Router Juniper Networks | 4.3 | Oct 28 | Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing |
| CVE-2026-103392 New | SS Session Smart Router Juniper Networks | 4.8 | Oct 28 | Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled |
| CVE-2026-93536 New | XO xorg-x11-server x.org | 5.3 | Oct 28 | X.Org Server GestureBuildSprite Use-After-Free |
| CVE-2026-103391 New | SS Session Smart Router Juniper Networks | 5.3 | Oct 28 | Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature |
| CVE-2026-103390 New | SS Session Smart Conductor Juniper Networks | 5.3 | Oct 28 | Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification |
| CVE-2026-93524 New | XO xorg-x11-server x.org | 6.9 | Oct 28 | X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read |
| CVE-2026-93523 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write |
| CVE-2026-118510 New | MO MongoDB MongoDB | 8.8 | Oct 28 | Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs |
| CVE-2026-93522 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server Glamor CopyArea Heap Buffer Overflow |
| CVE-2026-116778 New | FO fogproject FOGProject | 8.8 | Oct 28 | FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution |
| CVE-2026-116776 New | US usb-test n-romanovich | 7.0 | Oct 28 | USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS |
| CVE-2026-56828 New | SH shopper shopperlabs | 8.8 | Oct 28 | Shopper: read-only team permissions allow administrator creation and permission escalation |
| CVE-2026-47235 New | SI simc simulationcraft | 7.5 | Oct 28 | SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array |
| CVE-2026-93521 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow |
| CVE-2026-59979 New | YO Yosemite-Crew YosemiteCrew | 8.3 | Oct 28 | YosemiteCrew: Missing organization authorization on service and PMS library/template routes |
| CVE-2026-44179 New | XW xwiki-pro-macros xwikisas | 9.9 | Oct 28 | XWiki Pro Macros: excerpt-include title and content injection executes code |
| CVE-2026-50542 New | XI xibo-cms xibosignage | 5.4 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure |
| CVE-2026-118029 New | AW aws-sdk-pandas aws | 5.9 | Oct 28 | Unverified ownership of the default Athena query result location in AWS SDK for pandas |
| CVE-2026-50543 New | XI xibo-cms xibosignage | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices |