CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:21 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-99099 New | LI Linux Linux | – | Oct 26 | x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
| CVE-2026-99098 New | LI Linux Linux | – | Oct 26 | dm-integrity: fix buffer overflow in inline mode with large tag size |
| CVE-2026-99097 New | LI Linux Linux | – | Oct 26 | tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() |
| CVE-2026-99096 New | LI Linux Linux | – | Oct 26 | io_uring/register: don't exempt disabled rings from task restrictions |
| CVE-2026-99095 New | LI Linux Linux | – | Oct 26 | drm/vc4: drain the hangcheck timer and works on V3D unbind |
| CVE-2026-99094 New | LI Linux Linux | – | Oct 26 | Bluetooth: btintel_pcie: fix TX descriptor bounds check |
| CVE-2026-99093 New | LI Linux Linux | – | Oct 26 | mm: don't schedule deferred kernel page table freeing while booting |
| CVE-2026-99092 New | LI Linux Linux | – | Oct 26 | riscv: patch: fix handling of bpf-jit execmem addresses |
| CVE-2026-99091 New | LI Linux Linux | – | Oct 26 | Bluetooth: MGMT: Fix status of pending commands flushed on power off |
| CVE-2026-99090 New | LI Linux Linux | – | Oct 26 | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99089 New | LI Linux Linux | – | Oct 26 | ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM |
| CVE-2026-99088 New | LI Linux Linux | – | Oct 26 | net: openvswitch: validate transport header presence in set_ipv6_addr |
| CVE-2026-90885 New | AC Apache Camel Apache Software Foundation | 7.5 | Oct 26 | Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved |
| CVE-2026-77062 New | BO boneIO boneIO | 6.9 | Oct 26 | Clickjacking in boneIO |
| CVE-2026-94386 New | AC Apache Camel Apache Software Foundation | 4.8 | Oct 26 | Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache |
| CVE-2026-77061 New | BO boneIO boneIO | 5.3 | Oct 26 | Missing Authentication for Critical Function in boneIO |
| CVE-2026-77060 New | BL black_debian_images boneIO | 6.8 | Oct 26 | Incorrect Permission Assignment for Critical Resource in boneIO |
| CVE-2026-77059 New | BO boneIO boneIO | 8.8 | Oct 26 | TOCTOU Race Condition in boneIO |
| CVE-2026-77058 New | BO boneIO boneIO | 5.1 | Oct 26 | Cross-Site Request Forgery (CSRF) in boneIO |
| CVE-2026-77057 New | BO boneIO boneIO | 2.3 | Oct 26 | Improper Restriction of Excessive Authentication Attempts in boneIO |
| CVE-2026-77056 New | BL black_debian_images boneIO | 7.1 | Oct 26 | Use of Default Credentials in boneIO |
| CVE-2026-77055 New | BL black_debian_images boneIO | 9.3 | Oct 26 | Improper Privilege Assignment in boneIO |
| CVE-2026-77054 New | BO boneIO boneIO | 6.9 | Oct 26 | Cleartext Storage of Sensitive Information in boneIO |
| CVE-2026-77053 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication in Default Configuration in boneIO |
| CVE-2026-77052 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication for Node-RED in boneIO |
| CVE-2026-116340 New | AS astron-agent iFlytek | 4.3 | Oct 26 | iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization |
| CVE-2026-112345 New | TT TTLock Sciener | 8.1 | Oct 26 | TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure |
| CVE-2026-3322 New | LO Lobster_pro Lobster DATA GmbH | 5.6 | Oct 26 | Privilege escalation via request replaying in Lobster_pro |
| CVE-2026-110748 New | AS Apache SIS Apache Software Foundation | – | Oct 26 | Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files |
| CVE-2026-92171 New | RH Red Hat Data Grid 8 Red Hat | 6.5 | Oct 26 | Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store |
| CVE-2026-116497 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.5 | Oct 26 | Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon |
| CVE-2026-116339 New | AS astron-agent iFlytek | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist |
| CVE-2026-93848 New | MA Mattermost Mattermost | 2.7 | Oct 26 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator |
| CVE-2026-93850 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Unbounded memory consumption during PDF text extraction |
| CVE-2026-93849 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-110733 New | AS Apache SIS Apache Software Foundation | 5.4 | Oct 26 | Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store |
| CVE-2026-93847 New | MA Mattermost Mattermost | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints |
| CVE-2026-65184 New | AA Avocent ACS8000 Vertiv | 9.8 | Oct 26 | Avocent ACS8000 wsserver command injection |
| CVE-2026-115930 New | MO mongosh MongoDB, Inc. | 6.8 | Oct 26 | MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-116284 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Local API user-info information disclosure |
| CVE-2026-116516 New | MA Mattermost Mattermost | 6.5 | Oct 26 | Insufficient length validation when parsing Zoom chat transcriptions |
| CVE-2026-97200 New | HA hackney benoitc | 8.2 | Oct 26 | Unbounded response body buffering and decompression in hackney |
| CVE-2026-115693 New | HA hackney benoitc | 9.1 | Oct 26 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
| CVE-2026-113440 New | HA hackney benoitc | 6.0 | Oct 26 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney |
| CVE-2026-115700 New | HA hackney benoitc | 6.9 | Oct 26 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney |
| CVE-2026-112880 New | HA hackney benoitc | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
| CVE-2026-116283 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Local API profiles information disclosure |
| CVE-2026-107656 New | FO FortiSandbox Fortinet | 9.8 | Oct 26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all… |