CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116208 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts |
| CVE-2026-116207 New | YE yeswiki YesWiki | 9.1 | Oct 25 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API |
| CVE-2026-116206 New | YE yeswiki YesWiki | 6.4 | Oct 25 | YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax |
| CVE-2026-116205 New | YE yeswiki YesWiki | 5.3 | Oct 25 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax |
| CVE-2026-116204 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki before 4.7.0 CSRF via despam Admin Action |
| CVE-2026-116203 New | YE yeswiki YesWiki | 6.1 | Oct 25 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters |
| CVE-2026-116202 New | YE yeswiki YesWiki | 5.4 | Oct 25 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload |
| CVE-2026-116201 New | SN snipe-it grokability | 8.8 | Oct 25 | Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition |
| CVE-2026-116200 New | SN snipe-it grokability | 5.9 | Oct 25 | Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() |
| CVE-2026-116199 New | SN snipe-it grokability | 8.1 | Oct 25 | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback |
| CVE-2026-116198 New | SN snipe-it grokability | 4.3 | Oct 25 | Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store |
| CVE-2026-116197 New | CO contrast edgelesssys | 2.6 | Oct 25 | Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection |
| CVE-2026-116196 New | RC rclone rclone | 5.3 | Oct 25 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url |
| CVE-2026-116195 New | RC rclone rclone | 6.1 | Oct 25 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim |
| CVE-2026-116194 New | RC rclone rclone | 6.8 | Oct 25 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback |
| CVE-2026-116193 New | RC rclone rclone | 5.3 | Oct 25 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests |
| CVE-2026-116192 New | RC rclone rclone | 5.9 | Oct 25 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots |
| CVE-2026-116191 New | RC rclone rclone | 7.5 | Oct 25 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL |
| CVE-2026-116190 New | RC rclone rclone | 3.7 | Oct 25 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect |
| CVE-2026-116189 New | RC rclone rclone | 7.5 | Oct 25 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS |
| CVE-2026-116188 New | RC rclone rclone | 5.3 | Oct 25 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow |
| CVE-2026-116187 New | RC rclone rclone | 5.0 | Oct 25 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads |
| CVE-2026-116183 New | PH phpMyFAQ thorsten | 7.5 | Oct 25 | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID |
| CVE-2026-116182 New | PH phpMyFAQ thorsten | 5.0 | Oct 25 | phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching |
| CVE-2026-116181 New | VL vllm vllm-project | 6.5 | Oct 25 | vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids |
| CVE-2026-116180 New | VL vllm vllm-project | 7.7 | Oct 25 | vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors |
| CVE-2026-116179 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override |
| CVE-2026-116178 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders |
| CVE-2026-116177 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass |
| CVE-2026-116176 New | VL vllm vllm-project | 8.2 | Oct 25 | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector |
| CVE-2026-116175 New | VL vllm vllm-project | 6.5 | Oct 25 | vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions |
| CVE-2026-116174 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate |
| CVE-2026-116173 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids |
| CVE-2026-116172 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n |
| CVE-2026-116171 New | SI siyuan siyuan-note | 4.4 | Oct 25 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix |
| CVE-2026-116170 New | SI siyuan siyuan-note | 4.9 | Oct 25 | SiYuan before v3.8.7 SQL Injection via History Search op and query |
| CVE-2026-116169 New | SI siyuan siyuan-note | 5.4 | Oct 25 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks |
| CVE-2026-116168 New | SI siyuan siyuan-note | 6.2 | Oct 25 | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool |
| CVE-2026-116167 New | SI siyuan siyuan-note | 6.8 | Oct 25 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter |
| CVE-2026-116166 New | SI siyuan siyuan-note | 6.8 | Oct 25 | SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting |
| CVE-2026-116165 New | PA parse-server parse-community | 8.8 | Oct 25 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB |
| CVE-2026-116164 New | PA parse-server parse-community | 6.3 | Oct 25 | Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes |
| CVE-2026-116163 New | PA parse-server parse-community | 7.4 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses |
| CVE-2026-116162 New | PA parse-server parse-community | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login |
| CVE-2026-116161 New | PA parse-server parse-community | 6.0 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions |
| CVE-2026-116160 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate |
| CVE-2026-116159 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option |
| CVE-2026-116158 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in magick compare |
| CVE-2026-116157 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading |
| CVE-2026-116156 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option |