CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:55 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-61529 New | EN endatix endatix | 4.7 | Oct 28 | Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`) |
| CVE-2026-118653 New | EC echo labstack | 5.3 | Oct 28 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration |
| CVE-2026-118652 New | EC echo labstack | 6.1 | Oct 28 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob |
| CVE-2026-115415 New | ST strands-agents-tools amazon | 6.5 | Oct 28 | Secret masking bypass in the environment tool in Strands Agents Tools |
| CVE-2026-118651 New | EC echo labstack | 5.3 | Oct 28 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-118266 New | EC echo labstack | 5.3 | Oct 28 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-11854 New | WA WSO2 API Control Plane WSO2 | 6.1 | Oct 28 | Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products |
| CVE-2026-118265 New | EC echo labstack | 5.3 | Oct 28 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118263 New | EC echo labstack | 6.3 | Oct 28 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118687 New | CO coder coder | 6.5 | Oct 28 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication |
| CVE-2026-118685 New | TO ToolJet ToolJet | 6.5 | Oct 28 | ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard |
| CVE-2026-118684 New | MO MONAI Project-MONAI | 5.9 | Oct 28 | MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads |
| CVE-2026-118680 New | SI siyuan siyuan-note | 4.4 | Oct 28 | SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias |
| CVE-2026-118677 New | N8 n8n n8n-io | 5.9 | Oct 28 | n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance |
| CVE-2026-118646 New | N8 n8n n8n-io | 6.5 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node |
| CVE-2026-118640 New | N8 n8n n8n-io | 5.4 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass |
| CVE-2026-118259 New | OP opentelemetry-java open-telemetry | 5.3 | Oct 28 | opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing |
| CVE-2026-106484 New | CH chrome-devtools-mcp Google | 4.4 | Oct 28 | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file |
| CVE-2026-118248 New | DA dashboards @highcharts | 6.9 | Oct 28 | Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype |
| CVE-2026-118247 New | DA dashboards @highcharts | 6.9 | Oct 28 | Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. |
| CVE-2026-118243 New | HI highcharts highcharts | 5.3 | Oct 28 | Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` |
| CVE-2026-110183 New | PA PostgreSQL Anonymizer DALIBO | 4.3 | Oct 28 | PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking |
| CVE-2026-110182 New | PA PostgreSQL Anonymizer DALIBO | 4.3 | Oct 28 | PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data |
| CVE-2026-110181 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data |
| CVE-2026-105620 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query |
| CVE-2026-105619 New | PA PostgreSQL Anonymizer DALIBO | 4.8 | Oct 28 | PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views |
| CVE-2026-105618 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent |
| CVE-2026-105617 New | PA PostgreSQL Anonymizer DALIBO | 6.5 | Oct 28 | PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule |
| CVE-2026-105616 New | PA PostgreSQL Anonymizer DALIBO | 5.7 | Oct 28 | PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting |
| CVE-2026-105614 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur() |
| CVE-2026-105613 New | PA PostgreSQL Anonymizer DALIBO | 4.7 | Oct 28 | PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions |
| CVE-2026-79656 New | GR Grafana Grafana | 6.0 | Oct 28 | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors |
| CVE-2026-58458 New | DS Don't Starve Together Klei Entertainment | 6.5 | Oct 28 | Don't Starve Together Memory Corruption via world_gen_data |
| CVE-2026-82962 New | ZE zephyr zephyrproject | 6.5 | Oct 28 | Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet |
| CVE-2026-118581 New | MO MongoDB MongoDB | 6.5 | Oct 28 | NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol |
| CVE-2026-118611 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118609 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118607 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 diagapp Command Injection Vulnerability |
| CVE-2026-88858 New | GR Grafana Grafana | 6.5 | Oct 28 | Server-side expression parser denial of service |
| CVE-2026-118604 New | IL iLX-F511 Alpine | 6.8 | Oct 28 | Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118601 New | IL iLX-F511 Alpine | 6.3 | Oct 28 | Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability |
| CVE-2026-103405 New | SS Session Smart Conductor Juniper Networks | 5.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting |
| CVE-2026-103404 New | SS Session Smart Conductor Juniper Networks | 6.8 | Oct 28 | Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials |
| CVE-2026-103400 New | SS Session Smart Conductor Juniper Networks | 5.5 | Oct 28 | Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup |
| CVE-2026-103393 New | SS Session Smart Router Juniper Networks | 4.3 | Oct 28 | Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing |
| CVE-2026-103392 New | SS Session Smart Router Juniper Networks | 4.8 | Oct 28 | Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled |
| CVE-2026-93536 New | XO xorg-x11-server x.org | 5.3 | Oct 28 | X.Org Server GestureBuildSprite Use-After-Free |
| CVE-2026-103391 New | SS Session Smart Router Juniper Networks | 5.3 | Oct 28 | Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature |
| CVE-2026-103390 New | SS Session Smart Conductor Juniper Networks | 5.3 | Oct 28 | Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification |
| CVE-2026-93524 New | XO xorg-x11-server x.org | 6.9 | Oct 28 | X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read |