CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 06:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114509 | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114383 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow |
| CVE-2026-114382 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-96639 | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-114139 | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-111812 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |
| CVE-2026-111809 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling |
| CVE-2026-111815 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement |
| CVE-2026-111814 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin |
| CVE-2026-114268 | BP BE3L Pro Tenda | 9.9 | Oct 21 | Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow |
| CVE-2026-111816 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out |
| CVE-2026-111813 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration |
| CVE-2026-105944 | AP Apache Pulsar Manager Apache Software Foundation | 10.0 | Oct 21 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life |
| CVE-2026-105869 | AP Apache Pulsar Apache Software Foundation | 9.2 | Oct 21 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role |
| CVE-2026-111183 | GS GStreamer GStreamer | 9.8 | Oct 21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-76475 | CE Cisco Emergency Responder Cisco | 9.3 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities |
| CVE-2026-76474 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities |
| CVE-2026-76473 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. |
| CVE-2026-76466 | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 9.8 | Oct 21 | Cisco Expressway Series Remote Code Execution Vulnerability |
| CVE-2026-20043 | CC Cisco Cyber Vision Cisco | 9.0 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-113788 | LA lagoon uselagoon | 9.4 | Oct 21 | Lagoon core ssh service vulnerable to remote code execution |
| CVE-2026-111832 | WM WP Mailster WP Mailster | 10.0 | Oct 21 | WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability |
| CVE-2026-111834 | MB Mang Board WP Kitae Park | 9.9 | Oct 21 | WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability |
| CVE-2026-111852 | AS Ajax Search Lite WPdreams | 9.3 | Oct 21 | WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability |
| CVE-2026-109618 In wildKEV | PH PHP PHP | 9.8 | Oct 21 | RCE via OOM corruption |
| CVE-2026-87095 | AC Acronis Cyber Infrastructure Acronis | 9.1 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-71195 | MA Manila OpenStack | 9.9 | Oct 21 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share |
| CVE-2026-113744 | AC AC19 Tenda | 10.0 | Oct 21 | Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow |
| CVE-2026-114119 | BP Bp Premier Best Practice Software | 9.8 | Oct 21 | Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential |
| CVE-2026-114108 | VI Vibe-Trading HKUDS | 9.8 | Oct 21 | HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE |
| CVE-2026-113736 | DH DHP-W610AV D-Link | 9.8 | Oct 21 | D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password |
| CVE-2026-81212 | DO DataStage on Cloud Pak for Data IBM | 10.0 | Oct 20 | DataStage on Cloud Pak for Data Improper Authorization |
| CVE-2026-92559 | AC App Connect Enterprise IBM | 9.8 | Oct 20 | IBM App Connect Enterprise is vulnerable to a credential exposure |
| CVE-2026-91665 | OE Oracle Essbase Oracle Corporation | 9.8 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91663 | OE Oracle Essbase Oracle Corporation | 9.9 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91658 | OE Oracle Essbase Oracle Corporation | 9.9 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91656 | OE Oracle Essbase Oracle Corporation | 9.1 | Oct 20 | Vulnerability in Oracle Essbase (component: Federated Partitions) |
| CVE-2026-91655 | OE Oracle Essbase Oracle Corporation | 9.1 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91644 | OE Oracle Essbase Oracle Corporation | 9.3 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91638 | OE Oracle Essbase Oracle Corporation | 9.9 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91637 | OE Oracle Essbase Oracle Corporation | 9.9 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |
| CVE-2026-91624 | OA Oracle Agile Product Lifecycle Management for Process Oracle Corporation | 9.1 | Oct 20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management) |
| CVE-2026-91622 | OA Oracle Agile Product Lifecycle Management for Process Oracle Corporation | 9.3 | Oct 20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management) |
| CVE-2026-91495 | OW Oracle WebCenter Content Oracle Corporation | 9.8 | Oct 20 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server) |
| CVE-2026-91491 | OI Oracle Identity Manager Connector Oracle Corporation | 9.8 | Oct 20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway) |
| CVE-2026-91490 | OI Oracle Identity Manager Connector Oracle Corporation | 9.1 | Oct 20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway) |
| CVE-2026-91408 | OI Oracle Identity Manager Oracle Corporation | 9.8 | Oct 20 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service) |
| CVE-2026-91354 | OO Oracle Outside In Technology Oracle Corporation | 9.9 | Oct 20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK) |