CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 21:15 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-58496 New | TH thorvg thorvg | 4.3 | Oct 27 | ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API |
| CVE-2026-118128 New | A2 a2a-js a2aproject | 6.5 | Oct 27 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition |
| CVE-2026-57203 New | AS asterisk asterisk | 6.9 | Oct 27 | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location |
| CVE-2026-57192 New | AS asterisk asterisk | 6.0 | Oct 27 | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch |
| CVE-2026-116774 New | RU russh Eugeny | 4.3 | Oct 27 | russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) |
| CVE-2026-116773 New | RU russh Eugeny | 4.3 | Oct 27 | russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets |
| CVE-2026-116695 New | CR crass rgrove | 5.3 | Oct 27 | Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass |
| CVE-2026-116694 New | OP opentelemetry-python open-telemetry | 6.3 | Oct 27 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation |
| CVE-2026-116691 New | ML mlflow mlflow | 6.5 | Oct 27 | MLflow CrewAI autologging records LLM provider API keys in logged trace spans |
| CVE-2026-116689 New | FO follow-redirects follow-redirects | 5.9 | Oct 27 | follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects |
| CVE-2026-116686 New | PY python-sdk modelcontextprotocol | 6.5 | Oct 27 | Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas |
| CVE-2026-116685 New | PY python-sdk modelcontextprotocol | 5.9 | Oct 27 | Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies |
| CVE-2026-116684 New | PY python-sdk modelcontextprotocol | 6.8 | Oct 27 | Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server |
| CVE-2026-118173 New | MI misp-guard MISP | 6.1 | Oct 27 | MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement |
| CVE-2026-117526 New | RE redux-devtools reduxjs | 5.3 | Oct 27 | reduxjs redux-devtools Remotedev Server evalAction code injection |
| CVE-2026-116680 New | HO homebox sysadminsmedia | 6.4 | Oct 27 | Homebox generic notifier SSRF via HTTP redirect after URL validation |
| CVE-2026-102816 New | RV RE305 v3 TP-Link Systems Inc. | 5.3 | Oct 27 | Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 |
| CVE-2026-102815 New | RV RE305 v3 TP-Link Systems Inc. | 6.9 | Oct 27 | Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305 |
| CVE-2026-102813 New | RV RE305 v3 TP-Link Systems Inc. | 6.1 | Oct 27 | Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 |
| CVE-2026-102812 New | AC Archer C7 v5 TP-Link Systems Inc. | 6.9 | Oct 27 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 |
| CVE-2026-108316 New | TS Tanium Server Tanium | 4.3 | Oct 27 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
| CVE-2026-108325 New | RE Reputation Tanium | 6.6 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. |
| CVE-2026-116659 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| CVE-2026-108302 New | CO Comply Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108332 New | EC Endpoint Configuration Toolset Solution Tanium | 6.3 | Oct 27 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. |
| CVE-2026-108301 New | CO Comply Tanium | 6.0 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108309 New | EC Endpoint Configuration Toolset Solution Tanium | 5.5 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. |
| CVE-2026-116658 New | EN Enforce Tanium | 6.5 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-108313 New | TS Tanium Server Tanium | 6.6 | Oct 27 | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. |
| CVE-2026-116660 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Enforce. |
| CVE-2026-108326 New | CX cx-stream Tanium | 6.5 | Oct 27 | Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. |
| CVE-2026-116657 New | EN Enforce Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-116679 New | NE neko m1k1o | 5.4 | Oct 27 | Neko: Authorization bypass in legacy WebRTC input handling |
| CVE-2026-108310 New | TS Tanium Server Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Tanium Server. |
| CVE-2026-87085 New | PR Provision Tanium | 6.3 | Oct 27 | Tanium addressed a SQL injection vulnerability in Provision. |
| CVE-2026-108308 New | PA Patch Tanium | 6.5 | Oct 27 | Tanium addressed a SQL injection vulnerability in Patch. |
| CVE-2026-108328 New | TR Threat Response Tanium | 4.2 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. |
| CVE-2026-116678 New | VA vaultwarden dani-garcia | 5.8 | Oct 27 | Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs |
| CVE-2026-116677 New | OP openwisp-controller openwisp | 5.3 | Oct 27 | OpenWISP Controller CA CRL REST API does not scope requests to managed organizations |
| CVE-2026-16491 New | GR Grafana Grafana | 6.5 | Oct 27 | CVE-2026-16491 CVE Record |
| CVE-2026-57194 New | AS asterisk asterisk | 5.9 | Oct 27 | Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk |
| CVE-2026-116674 New | SY systeminformation sebhildebrandt | 6.5 | Oct 27 | systeminformation: Prototype pollution in `networkStats()` via the interface name |
| CVE-2026-57185 New | AS asterisk asterisk | 6.5 | Oct 27 | Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser |
| CVE-2026-109088 New | LI libXtst X.org | 6.5 | Oct 27 | libXtst RECORD EnableContext Reply Endless Loop |
| CVE-2026-48380 New | AS Adobe Substance 3D Painter Adobe | 5.5 | Oct 27 | Substance3D - Painter | Out-of-bounds Read (CWE-125) |
| CVE-2025-64394 New | BF Backup for Microsoft 365 Veeam | 4.3 | Oct 27 | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to… |
| CVE-2026-108141 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-106078 New | BF Backup for Microsoft 365 Veeam | 6.9 | Oct 27 | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not… |
| CVE-2026-108140 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-82984 New | SE Server Nextcloud | 4.3 | Oct 27 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint… |