CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 17:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87948 | DR Drupal Drupal | 3.5 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 |
| CVE-2026-87949 | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 |
| CVE-2026-87951 | DR Drupal Drupal | 3.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 |
| CVE-2026-87952 | DR Drupal Drupal | 3.1 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 |
| CVE-2026-87953 | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 |
| CVE-2026-96360 | DR Drupal Drupal | 3.5 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 |
| CVE-2026-96369 | DR Drupal Drupal | 3.1 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 |
| CVE-2026-96373 | DR Drupal Drupal | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 |
| CVE-2026-96384 | DR Drupal Drupal | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 |
| CVE-2026-96387 | DR Drupal Drupal | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 |
| CVE-2026-96392 | DR Drupal Drupal | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 |
| CVE-2026-14288 | GI GitLab GitLab | 3.1 | Oct 21 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-103515 | GI GitLab GitLab | 2.7 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105711 | GI GitLab GitLab | 3.5 | Oct 21 | Use of Cache Containing Sensitive Information in GitLab |
| CVE-2026-112326 | GI GitLab GitLab | 3.1 | Oct 21 | Improper Cleanup on Thrown Exception in GitLab |
| CVE-2026-114377 | WI wiki-go leomoon-studios | 3.8 | Oct 21 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal |
| CVE-2026-18748 | ZE zephyr zephyrproject | 3.5 | Oct 21 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling |
| CVE-2026-105938 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all |
| CVE-2026-105933 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization |
| CVE-2026-105932 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints |
| CVE-2026-105931 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants |
| CVE-2026-105927 | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission |
| CVE-2026-114130 | NU nuxt nuxt | 2.3 | Oct 21 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
| CVE-2026-114127 | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-114124 | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114122 | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-113797 | EL electron electron | 3.1 | Oct 21 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
| CVE-2026-114472 | HM hMailServer Progressive Robot Ltd | 3.7 | Oct 21 | Insufficient Resource Pool in hMailServer |
| CVE-2026-114370 | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 3.7 | Oct 21 | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal |
| CVE-2026-113786 | PY pypdf py-pdf | 2.3 | Oct 21 | pypdf: Unvalidated JPEG image data loading |
| CVE-2026-104949 | WA WarehousePG EnterpriseDB | 2.3 | Oct 21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() |
| CVE-2026-87096 | AC Acronis Cyber Infrastructure Acronis | 3.3 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-35501 | UN Unbound NLnet Labs | 3.7 | Oct 21 | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. |
| CVE-2026-104642 | SS Simple Shopping Cart | 2.7 | Oct 21 | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass |
| CVE-2026-114236 | CC Confidential Compute Attestation Red Hat | 3.3 | Oct 21 | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers |
| CVE-2026-96901 | CA Cart Abandonment Recovery for WooCommerce | 3.7 | Oct 21 | Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token |
| CVE-2026-105257 | AB Appointment Booking Plugin | 2.7 | Oct 21 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR |
| CVE-2026-114040 | BE BerryNet DT42 | 3.5 | Oct 21 | DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal |
| CVE-2026-114115 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection |
| CVE-2026-114071 | TR trigger.dev triggerdotdev | 3.1 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route |
| CVE-2026-114070 | TR trigger.dev triggerdotdev | 3.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records |
| CVE-2026-114049 | VL vllm vllm-project | 3.7 | Oct 21 | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense |
| CVE-2026-114048 | AV AVideo WWBN | 3.5 | Oct 21 | WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints |
| CVE-2020-37289 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values |
| CVE-2020-37288 | VY vyper vyperlang | 3.7 | Oct 21 | Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops |
| CVE-2026-113735 | DC DCS-6501LH D-Link | 3.7 | Oct 20 | D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials |
| CVE-2026-113706 | A2 a2a-rs a2aproject | 3.5 | Oct 20 | a2aproject a2a-rs inmemory.rs information disclosure |
| CVE-2026-9825 | CY CyberFraud IBM | 3.7 | Oct 20 | IBM Cyber Fraud Reachable Assertion |
| CVE-2026-113731 | DJ djust djust-org | 3.3 | Oct 20 | djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool |
| CVE-2026-91650 | OE Oracle Essbase Oracle Corporation | 3.7 | Oct 20 | Vulnerability in Oracle Essbase (component: Java Based Agent) |