CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 22:53 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-79852 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface |
| CVE-2026-79851 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79850 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-8 |
| CVE-2026-79849 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79848 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79847 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 |
| CVE-2026-79846 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Command Injection Vulnerabilities in AOS-8 |
| CVE-2026-79844 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-10 |
| CVE-2026-115414 New | AW aws-sam-cli AWS | 7.8 | Oct 22 | OS command injection in the Terraform hook in AWS SAM CLI |
| CVE-2026-114613 New | MS msgpack-python msgpack | 7.5 | Oct 22 | MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure |
| CVE-2026-115519 New | KB KNIME Business Hub KNIME | 2.1 | Oct 22 | Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub |
| CVE-2026-115517 New | KB KNIME Business Hub KNIME | 6.4 | Oct 22 | Unrestricted network access between execution contexts in KNIME Business Hub |
| CVE-2026-114612 New | LI litellm BerriAI | 9.9 | Oct 22 | LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
| CVE-2026-113876 New | HF HAPI FHIR SmileCDR | 4.3 | Oct 22 | SmileCDR HAPI FHIR unauthorized read |
| CVE-2026-113875 New | HF HAPI FHIR SmileCDR | 3.1 | Oct 22 | SmileCDR HAPI FHIR unauthorized read via subscription |
| CVE-2026-113874 New | HF HAPI FHIR SmileCDR | 8.1 | Oct 22 | SmileCDR HAPI FHIR trusted tenant partition override |
| CVE-2026-113873 New | HF HAPI FHIR SmileCDR | 7.5 | Oct 22 | SmileCDR HAPI FHIR improper data decompression |
| CVE-2026-97635 New | AZ Agent Zero Agent Zero | 8.1 | Oct 22 | Agent Zero Web UI XSS |
| CVE-2026-77157 New | GI github.com/checkmarx/ast-cli Checkmarx | 6.4 | Oct 22 | ast-cli: Auto-update downloads are not verified against a checksum before execution |
| CVE-2026-77156 New | GI github.com/checkmarx/ast-cli Checkmarx | 6.4 | Oct 22 | ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory |
| CVE-2026-108357 New | PH PhpSpreadsheet PHPOffice | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service |
| CVE-2026-13599 New | AE Ability Edgenius ABB | 7.8 | Oct 22 | ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB |
| CVE-2026-114611 New | OC OCO-Server schorschii | 9.1 | Oct 22 | OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack |
| CVE-2026-108359 New | PH PhpSpreadsheet PHPOffice | 8.7 | Oct 22 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
| CVE-2026-93336 New | JU Juju Canonical | 7.1 | Oct 22 | Missing authorization in the unit resources download route in Juju controllers |
| CVE-2026-108358 New | PH PhpSpreadsheet PHPOffice | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
| CVE-2026-108360 New | PH PhpSpreadsheet PHPOffice | 6.4 | Oct 22 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
| CVE-2026-54238 New | RE realtime supabase | 3.1 | Oct 22 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization |
| CVE-2026-114610 New | FP fpdf2 py-pdf | 6.5 | Oct 22 | fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' |
| CVE-2026-114609 New | FP fpdf2 py-pdf | 5.8 | Oct 22 | fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content |
| CVE-2026-54532 New | HE helm-charts CloudPirates-io | 6.9 | Oct 22 | CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft |
| CVE-2026-115513 New | OP OpenCATS opencats | 8.7 | Oct 22 | OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel |
| CVE-2026-115416 New | AA Amazon Athena AWS | 7.7 | Oct 22 | Incorrect authorization checks in Amazon Athena engine version 3 query processing |
| CVE-2026-114608 New | PY pylint pylint-dev | 5.4 | Oct 22 | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME |
| CVE-2026-114607 New | BE better-auth better-auth | 9.1 | Oct 22 | better-auth: OAuth state can be used as a Magic Link to sign in as another user |
| CVE-2026-114606 New | DR drawio-desktop jgraph | 5.6 | Oct 22 | draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) |
| CVE-2026-97631 New | ED EDK2 TianoCore | 9.5 | Oct 22 | Pre-boot RCE in EDK II PXE driver |
| CVE-2026-115502 New | KB KNIME Business Hub KNIME | 6.3 | Oct 22 | DataApp links without login expose job information to other user in KNIME Business Hub |
| CVE-2026-104068 New | JE JetBackup JetBackup | 7.2 | Oct 22 | JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore |
| CVE-2026-114605 New | DN dnspython rthalley | 7.5 | Oct 22 | dnspython dns.name.from_wire_parser() excessive CPU use |
| CVE-2026-75507 New | GR graphql-core graphql-python | 7.5 | Oct 22 | GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule |
| CVE-2026-75508 New | GR graphql-core graphql-python | 7.5 | Oct 22 | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit |
| CVE-2026-115496 New | KB KNIME Business Hub KNIME | 6.9 | Oct 22 | Workflow names may be leaked to unauthenticated users in KNIME Business Hub |
| CVE-2026-114487 New | SE Server Devolutions | – | Oct 22 | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated… |
| CVE-2026-115494 New | KB KNIME Business Hub KNIME | 5.3 | Oct 22 | CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub |
| CVE-2026-114486 New | SE Server Devolutions | – | Oct 22 | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass… |
| CVE-2026-114485 New | SE Server Devolutions | – | Oct 22 | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view… |
| CVE-2026-114603 New | OP opentelemetry-python open-telemetry | 5.3 | Oct 22 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api |
| CVE-2026-115454 New | KB KNIME Business Hub KNIME | 5.3 | Oct 22 | Large tables in data apps can bring down execution services in KNIME Hub |
| CVE-2026-94482 New | NE next.js vercel | 8.2 | Oct 22 | Next.js: Denial of Service in App Router using Server Actions |