CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 13:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112642 New | MA macOS Apple | – | Oct 26 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-113950 New | MA macOS Apple | – | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112707 New | IA iOS and iPadOS Apple | – | Oct 26 | A privacy issue was addressed by moving sensitive data to a protected location |
| CVE-2026-112510 New | MA macOS Apple | – | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112455 New | MA macOS Apple | 5.5 | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112639 New | MA macOS Apple | – | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112547 New | IA iOS and iPadOS Apple | 5.5 | Oct 26 | A type confusion issue was addressed with improved checks |
| CVE-2026-112681 New | IA iOS and iPadOS Apple | – | Oct 26 | This issue was addressed with additional entitlement checks |
| CVE-2026-112551 New | MA macOS Apple | – | Oct 26 | An authorization issue was addressed with improved state management |
| CVE-2026-112414 New | MA macOS Apple | – | Oct 26 | A stack overflow was addressed with improved input validation |
| CVE-2026-112697 New | MA macOS Apple | – | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112678 New | MA macOS Apple | 5.5 | Oct 26 | A permissions issue was addressed with additional restrictions |
| CVE-2026-84599 New | MA macOS Apple | – | Oct 26 | The issue was addressed with improved memory handling |
| CVE-2026-112506 New | MA macOS Apple | 5.5 | Oct 26 | A permissions issue was addressed with improved validation |
| CVE-2026-112443 New | MA macOS Apple | – | Oct 26 | The issue was addressed with improved memory handling |
| CVE-2026-113897 New | MA macOS Apple | – | Oct 26 | This issue was addressed by removing the vulnerable code |
| CVE-2026-116504 New | A9 A950RG TOTOLINK | 9.9 | Oct 26 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection |
| CVE-2026-116579 New | AU autobahn-python crossbario | 5.9 | Oct 26 | Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) |
| CVE-2026-116578 New | TO tornado tornadoweb | 2.1 | Oct 26 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs |
| CVE-2026-116577 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding |
| CVE-2026-116576 New | SY systeminformation sebhildebrandt | 7.8 | Oct 26 | systeminformation: Windows command injection in services() through Unicode quotation marks |
| CVE-2026-116502 New | EX ExLlamaV2 turboderp-org | 4.4 | Oct 26 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write |
| CVE-2026-116575 New | ME mem0 mem0ai | 6.3 | Oct 26 | Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) |
| CVE-2026-116671 New | XP Xpdf Xpdf | 2.1 | Oct 26 | Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder |
| CVE-2026-116482 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 26 | subhajitkhan online-clinic-management-system patientregistration.php cross site scripting |
| CVE-2026-70382 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 4.1 | Oct 26 | Stored Cross-Site Scripting in Web Interface |
| CVE-2026-65630 New | JO jose potatosalad | 5.9 | Oct 26 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose |
| CVE-2026-65632 New | JO jose potatosalad | 5.1 | Oct 26 | ECDSA signature length is not validated in jose, allowing signature malleability |
| CVE-2026-65631 New | JO jose potatosalad | 6.9 | Oct 26 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service |
| CVE-2026-65629 New | JO jose potatosalad | 7.4 | Oct 26 | Weak PBKDF2 parameters for password-encrypted private-key export in jose |
| CVE-2026-65628 New | JO jose potatosalad | 5.9 | Oct 26 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types |
| CVE-2026-65627 New | JO jose potatosalad | 6.9 | Oct 26 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 |
| CVE-2026-57184 New | AS asterisk asterisk | 6.3 | Oct 26 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) |
| CVE-2026-65626 New | JO jose potatosalad | 5.9 | Oct 26 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose |
| CVE-2026-65625 New | JO jose potatosalad | 5.9 | Oct 26 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose |
| CVE-2026-70381 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Unauthorized Access to Internal Web Resources |
| CVE-2026-57193 New | AS asterisk asterisk | 6.9 | Oct 26 | Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure) |
| CVE-2026-70380 New | CP Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Resource Exhaustion in MICE Service |
| CVE-2026-116479 New | A2 a2a-java a2aproject | 4.3 | Oct 26 | a2aproject a2a-java JSON-RPC Error getMessage information exposure |
| CVE-2026-115533 New | LE LeRobot Hugging Face | – | Oct 26 | The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths |
| CVE-2026-115927 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks |
| CVE-2026-57187 New | AS asterisk asterisk | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing |
| CVE-2026-116478 New | A2 a2a-go a2aproject | 5.3 | Oct 26 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure |
| CVE-2026-57196 New | AS asterisk asterisk | 2.3 | Oct 26 | Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages |
| CVE-2026-115924 New | RE rembg danielgatis | 8.6 | Oct 26 | Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs |
| CVE-2026-116477 New | A2 a2a-dotnet a2aproject | 4.3 | Oct 26 | a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure |
| CVE-2014-125135 New | OC OctoPrint Octoprint | 7.3 | Oct 26 | OctoPrint Flask Secret Key hard-coded key |
| CVE-2026-116476 New | A2 a2a-dotnet a2aproject | 5.4 | Oct 26 | a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition |
| CVE-2026-110720 New | TO Tooling HashiCorp | 9.9 | Oct 26 | Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules |
| CVE-2026-116631 New | Product not mapped yet | 5.4 | Oct 26 | External protocol handler (tel:) address bar spoof |