CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:38 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-90458 New | IR Ironic OpenStack | 5.4 | Oct 23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-54615 New | PA Part-DB-server Part-DB | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) |
| CVE-2026-89419 New | IR Ironic OpenStack | 5.0 | Oct 23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific… |
| CVE-2026-115638 New | IR Ironic OpenStack | 4.3 | Oct 23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb |
| CVE-2026-115547 New | OA Okta Access Gateway Okta | 9.1 | Oct 23 | Command Execution via Admin Console Input in Okta Access Gateway |
| CVE-2026-115546 New | OA Okta Access Gateway Okta | 8.1 | Oct 23 | Authentication Source Verification Issue in Okta Access Gateway |
| CVE-2026-115537 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect |
| CVE-2026-19678 New | OF onPhase Forms onPhase | 8.7 | Oct 23 | Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure |
| CVE-2026-19677 New | OF onPhase Forms onPhase | 9.3 | Oct 23 | Authentication Bypass Leading to Server-Side Command Execution |
| CVE-2026-115536 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting |
| CVE-2026-115486 New | RH Red Hat Enterprise Linux 10 Red Hat | 7.1 | Oct 23 | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning |
| CVE-2026-115485 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.3 | Oct 23 | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio |
| CVE-2026-115484 New | RH Red Hat Enterprise Linux 10 Red Hat | 7.6 | Oct 23 | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg |
| CVE-2026-115535 New | HO HospitalManagement gedelumbung | 2.4 | Oct 23 | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting |
| CVE-2026-52356 New | Product not mapped yet | 8.8 | Oct 23 | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting… |
| CVE-2026-106765 New | Product not mapped yet | 7.5 | Oct 23 | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function |
| CVE-2026-106763 New | Product not mapped yet | 7.5 | Oct 23 | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions |
| CVE-2026-50787 New | Product not mapped yet | 7.5 | Oct 23 | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php |
| CVE-2026-106764 New | Product not mapped yet | 7.5 | Oct 23 | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function |
| CVE-2025-45528 New | Product not mapped yet | 7.3 | Oct 23 | An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF |
| CVE-2026-115534 New | HO HospitalManagement gedelumbung | 4.3 | Oct 22 | gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting |
| CVE-2026-110825 New | EF E3 Firmware Kiloview | 7.5 | Oct 22 | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-92450 New | EF E3 Firmware Kiloview | 7.5 | Oct 22 | Kiloview E3 NDI Encoder Use of Hard-coded Credentials |
| CVE-2026-110243 New | EF E3 Firmware Kiloview | 9.9 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-107861 New | EF E3 Firmware Kiloview | 9.9 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110491 New | EF E3 Firmware Kiloview | 7.5 | Oct 22 | Kiloview E3 NDI Encoder NULL Pointer Dereference |
| CVE-2026-105265 New | EF E3 Firmware Kiloview | 5.3 | Oct 22 | Kiloview E3 NDI Encoder Path Traversal |
| CVE-2026-96616 New | EF E3 Firmware Kiloview | 6.5 | Oct 22 | Kiloview E3 NDI Encoder Insufficient Session Expiration |
| CVE-2026-111100 New | EF E3 Firmware Kiloview | 5.3 | Oct 22 | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-109122 New | EF E3 Firmware Kiloview | 9.1 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110063 New | VI VM Inspector for Azure Virtual Machines Microsoft | 10.0 | Oct 22 | VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability |
| CVE-2026-83938 New | AK Azure Kubernetes Configuration Service Microsoft | 10.0 | Oct 22 | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability |
| CVE-2026-96185 New | ME Microsoft Exchange Online Microsoft | 7.5 | Oct 22 | Microsoft Exchange Online Remote Code Execution Vulnerability |
| CVE-2026-97785 New | ME Microsoft Entra application proxy Microsoft | 10.0 | Oct 22 | AAD App Proxy Elevation of Privilege Vulnerability |
| CVE-2026-108456 New | AA Azure AI Foundry Microsoft | 7.7 | Oct 22 | Azure AI Foundry Elevation of Privilege Vulnerability |
| CVE-2026-105014 New | AP Azure Pipelines Microsoft | 9.1 | Oct 22 | Azure Pipelines Remote Code Execution Vulnerability |
| CVE-2026-111594 New | IF IRIS for Health InterSystems | 8.1 | Oct 22 | InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information |
| CVE-2026-114620 New | AU authlib authlib | 5.4 | Oct 22 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF |
| CVE-2026-114619 New | AU authlib authlib | 4.6 | Oct 22 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens |
| CVE-2026-114618 New | AU authlib authlib | 6.8 | Oct 22 | Authlib: Default JWT bearer grant accepts assertions for the wrong audience |
| CVE-2026-114617 New | AU authlib authlib | 4.2 | Oct 22 | Authlib: ID token can disable its own nonce validation via the nonce_supported claim |
| CVE-2026-115449 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 22 | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest |
| CVE-2026-114616 New | AU authlib authlib | 7.4 | Oct 22 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) |
| CVE-2026-115221 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.4 | Oct 22 | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership |