CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114220 New | NO NT OneAPP NewType Infortech | 9.1 | Oct 22 | NewType Infortech｜NT OneAPP - Improper Certificate Validation |
| CVE-2026-96355 New | DR Drupal Drupal | 9.1 | Oct 22 | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 |
| CVE-2026-114575 New | A9 A950RG TOTOLINK | 10.0 | Oct 22 | TOTOLINK A950RG product.so UploadCustomModule command injection |
| CVE-2026-110264 New | GI GitLab GitLab | 10.0 | Oct 22 | Integer Overflow or Wraparound in GitLab |
| CVE-2026-78846 New | Product not mapped yet | 9.8 | Oct 22 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing |
| CVE-2026-76531 New | SS Splunk SOAR Splunk | 9.9 | Oct 21 | Files or Directories Accessible to External Parties in Splunk SOAR |
| CVE-2026-76302 New | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76301 New | SE Splunk Enterprise Splunk | 9.8 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76299 New | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-114509 New | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114383 New | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow |
| CVE-2026-114382 New | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 New | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-96639 New | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-114139 New | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-111812 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 New | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |
| CVE-2026-111809 New | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling |
| CVE-2026-111815 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement |
| CVE-2026-111814 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin |
| CVE-2026-114268 New | BP BE3L Pro Tenda | 9.9 | Oct 21 | Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow |
| CVE-2026-111816 New | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out |
| CVE-2026-111813 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration |
| CVE-2026-105944 New | AP Apache Pulsar Manager Apache Software Foundation | 10.0 | Oct 21 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life |
| CVE-2026-105869 New | AP Apache Pulsar Apache Software Foundation | 9.2 | Oct 21 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role |
| CVE-2026-111183 New | GS GStreamer GStreamer | 9.8 | Oct 21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-76475 New | CE Cisco Emergency Responder Cisco | 9.3 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities |
| CVE-2026-76474 New | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities |
| CVE-2026-76473 New | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. |
| CVE-2026-76466 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 9.8 | Oct 21 | Cisco Expressway Series Remote Code Execution Vulnerability |
| CVE-2026-20043 New | CC Cisco Cyber Vision Cisco | 9.0 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-113788 New | LA lagoon uselagoon | 9.4 | Oct 21 | Lagoon core ssh service vulnerable to remote code execution |
| CVE-2026-111832 New | WM WP Mailster WP Mailster | 10.0 | Oct 21 | WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability |
| CVE-2026-111834 New | MB Mang Board WP Kitae Park | 9.9 | Oct 21 | WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability |
| CVE-2026-111852 New | AS Ajax Search Lite WPdreams | 9.3 | Oct 21 | WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability |
| CVE-2026-109618 In wildKEVNew | PH PHP PHP | 9.8 | Oct 21 | RCE via OOM corruption |