CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 02:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114583 New | CP CPython Python Software Foundation | 6.9 | Oct 22 | tar filter allows writing outside destination via empty-named symlink |
| CVE-2026-114625 In wildKEVNew | VO VeloCloud Orchestrator Arista Networks | 9.9 | Oct 22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host |
| CVE-2026-115417 New | AW aws-c-mqtt AWS | 7.5 | Oct 22 | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt |
| CVE-2026-115419 New | ST strands-agents AWS | 8.1 | Oct 22 | Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server |
| CVE-2026-112332 New | MO motornet GDATASoftwareAG | 7.5 | Oct 22 | Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization |
| CVE-2026-112331 New | MO motornet GDATASoftwareAG | 7.5 | Oct 22 | Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping |
| CVE-2026-112330 New | MO motornet GDATASoftwareAG | 7.5 | Oct 22 | Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers |
| CVE-2026-115509 New | JI jitsu jitsucom | 4.2 | Oct 22 | Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API |
| CVE-2026-115508 New | CR crawl4ai unclecode | 6.5 | Oct 22 | Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields |
| CVE-2026-115507 New | VI vikunja go-vikunja | 3.5 | Oct 22 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header |
| CVE-2026-115506 New | LI libexpat libexpat | 7.5 | Oct 22 | libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay |
| CVE-2026-115505 New | LI libsmb2 sahlberg | 7.6 | Oct 22 | libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum |
| CVE-2026-115504 New | CF cfitsio HEASARC | 7.8 | Oct 22 | CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c |
| CVE-2026-115503 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via Compressed Extension Archive |
| CVE-2026-115398 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount |
| CVE-2026-115397 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via Extension Archive Install |
| CVE-2026-115396 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive |
| CVE-2026-115395 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() |
| CVE-2026-114655 New | MO MongoDB MongoDB | 5.9 | Oct 22 | KMS request injection via unsanitized key vault and provider values in libmongocrypt |
| CVE-2026-115394 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation |
| CVE-2026-114654 New | MO MongoDB MongoDB | 6.5 | Oct 22 | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-115393 New | WA wasmtime bytecodealliance | 3.8 | Oct 22 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion |
| CVE-2026-115392 New | WA wasmtime bytecodealliance | 7.9 | Oct 22 | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes |
| CVE-2026-114653 New | MO MongoDB MongoDB | 6.5 | Oct 22 | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder |
| CVE-2026-115391 New | WA wasmtime bytecodealliance | 5.8 | Oct 22 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams |
| CVE-2026-114652 New | MO MongoDB MongoDB | 6.5 | Oct 22 | Update operator injection via single-element list rewriting in the update builder |
| CVE-2026-114651 New | MO MongoDB MongoDB | 4.0 | Oct 22 | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
| CVE-2026-115390 New | WA wasmtime bytecodealliance | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS |
| CVE-2026-115389 New | WA wasmtime bytecodealliance | 2.3 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API |
| CVE-2026-114650 New | MO MongoDB MongoDB | 5.9 | Oct 22 | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-115388 New | WA wasmtime bytecodealliance | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write |
| CVE-2026-114649 New | MO MongoDB MongoDB | 6.8 | Oct 22 | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache |
| CVE-2026-115387 New | WA wasmtime bytecodealliance | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow |
| CVE-2026-114648 New | MO MongoDB MongoDB | 7.6 | Oct 22 | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys |
| CVE-2026-115386 New | WA wasmtime bytecodealliance | 2.6 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir |
| CVE-2026-115385 New | WA wasmtime bytecodealliance | 6.2 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps |
| CVE-2026-114647 New | MO MongoDB MongoDB | 4.3 | Oct 22 | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-115384 New | WA wasmtime bytecodealliance | 9.9 | Oct 22 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow |
| CVE-2026-114646 New | MO MongoDB MongoDB | 6.5 | Oct 22 | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-115383 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports |
| CVE-2026-115382 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS |
| CVE-2026-114645 New | MO MongoDB MongoDB | 5.2 | Oct 22 | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping |
| CVE-2026-115381 New | WA wasmtime bytecodealliance | 4.8 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes |
| CVE-2026-114644 New | MO MongoDB MongoDB | 5.9 | Oct 22 | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization |
| CVE-2026-115380 New | WA wasmtime bytecodealliance | 4.0 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff |
| CVE-2026-114643 New | MO MongoDB MongoDB | 5.4 | Oct 22 | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-115379 New | WA wasmtime bytecodealliance | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call |
| CVE-2026-115378 New | IN incus lxc | 5.8 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull |
| CVE-2026-115377 New | IN incus lxc | 9.9 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream |
| CVE-2026-115376 New | IN incus lxc | 7.7 | Oct 22 | Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy |