CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 09:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117526 New | RE redux-devtools reduxjs | 5.3 | Oct 27 | reduxjs redux-devtools Remotedev Server evalAction code injection |
| CVE-2026-116680 New | HO homebox sysadminsmedia | 6.4 | Oct 27 | Homebox generic notifier SSRF via HTTP redirect after URL validation |
| CVE-2026-102816 New | RV RE305 v3 TP-Link Systems Inc. | 5.3 | Oct 27 | Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 |
| CVE-2026-102815 New | RV RE305 v3 TP-Link Systems Inc. | 6.9 | Oct 27 | Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305 |
| CVE-2026-102813 New | RV RE305 v3 TP-Link Systems Inc. | 6.1 | Oct 27 | Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 |
| CVE-2026-102812 New | AC Archer C7 v5 TP-Link Systems Inc. | 6.9 | Oct 27 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 |
| CVE-2026-108316 New | TS Tanium Server Tanium | 4.3 | Oct 27 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
| CVE-2026-108325 New | RE Reputation Tanium | 6.6 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. |
| CVE-2026-116659 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| CVE-2026-108302 New | CO Comply Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108332 New | EC Endpoint Configuration Toolset Solution Tanium | 6.3 | Oct 27 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. |
| CVE-2026-108301 New | CO Comply Tanium | 6.0 | Oct 27 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-108309 New | EC Endpoint Configuration Toolset Solution Tanium | 5.5 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. |
| CVE-2026-116658 New | EN Enforce Tanium | 6.5 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-108313 New | TS Tanium Server Tanium | 6.6 | Oct 27 | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. |
| CVE-2026-116660 New | EN Enforce Tanium | 4.3 | Oct 27 | Tanium addressed an improper access controls vulnerability in Enforce. |
| CVE-2026-108326 New | CX cx-stream Tanium | 6.5 | Oct 27 | Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. |
| CVE-2026-116657 New | EN Enforce Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Enforce. |
| CVE-2026-116679 New | NE neko m1k1o | 5.4 | Oct 27 | Neko: Authorization bypass in legacy WebRTC input handling |
| CVE-2026-108310 New | TS Tanium Server Tanium | 5.3 | Oct 27 | Tanium addressed a denial of service vulnerability in Tanium Server. |
| CVE-2026-87085 New | PR Provision Tanium | 6.3 | Oct 27 | Tanium addressed a SQL injection vulnerability in Provision. |
| CVE-2026-108308 New | PA Patch Tanium | 6.5 | Oct 27 | Tanium addressed a SQL injection vulnerability in Patch. |
| CVE-2026-108328 New | TR Threat Response Tanium | 4.2 | Oct 27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. |
| CVE-2026-116678 New | VA vaultwarden dani-garcia | 5.8 | Oct 27 | Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs |
| CVE-2026-116677 New | OP openwisp-controller openwisp | 5.3 | Oct 27 | OpenWISP Controller CA CRL REST API does not scope requests to managed organizations |
| CVE-2026-16491 New | GR Grafana Grafana | 6.5 | Oct 27 | CVE-2026-16491 CVE Record |
| CVE-2026-57194 New | AS asterisk asterisk | 5.9 | Oct 27 | Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk |
| CVE-2026-116674 New | SY systeminformation sebhildebrandt | 6.5 | Oct 27 | systeminformation: Prototype pollution in `networkStats()` via the interface name |
| CVE-2026-57185 New | AS asterisk asterisk | 6.5 | Oct 27 | Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser |
| CVE-2026-109088 New | LI libXtst X.org | 6.5 | Oct 27 | libXtst RECORD EnableContext Reply Endless Loop |
| CVE-2026-48380 New | AS Adobe Substance 3D Painter Adobe | 5.5 | Oct 27 | Substance3D - Painter | Out-of-bounds Read (CWE-125) |
| CVE-2025-64394 New | BF Backup for Microsoft 365 Veeam | 4.3 | Oct 27 | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to… |
| CVE-2026-108141 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-106078 New | BF Backup for Microsoft 365 Veeam | 6.9 | Oct 27 | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not… |
| CVE-2026-108140 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-82984 New | SE Server Nextcloud | 4.3 | Oct 27 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint… |
| CVE-2026-77173 New | FC Files Confidential Nextcloud | 4.3 | Oct 27 | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential |
| CVE-2026-77172 New | SE Server Nextcloud | 5.3 | Oct 27 | App passwords were allowed to bypass password confirmation on sensitive endpoints |
| CVE-2026-87897 New | WH whiteboard Nextcloud | 4.6 | Oct 27 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user |
| CVE-2026-82986 New | TA Tables Nextcloud | 4.6 | Oct 27 | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission |
| CVE-2026-54462 New | PK pkg knative | 6.5 | Oct 27 | knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion |
| CVE-2026-115495 New | MV Mobile VPN with SSL Client WatchGuard | 5.7 | Oct 27 | Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket |
| CVE-2026-113881 New | FO Fireware OS WatchGuard | 6.1 | Oct 27 | Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution |
| CVE-2026-82332 New | FO Fireware OS WatchGuard | 5.7 | Oct 27 | Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking |
| CVE-2026-104381 New | FO Fireware OS WatchGuard | 6.0 | Oct 27 | Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service |
| CVE-2026-117510 New | DE Dexbotic Dexmal | 6.3 | Oct 27 | Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal |
| CVE-2026-117509 New | RA Rasa_NLU_Chi crownpku | 6.3 | Oct 27 | crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal |
| CVE-2026-117507 New | A2 a2a-java a2aproject | 5.4 | Oct 27 | a2aproject a2a-java TaskManager.saveTaskEvent race condition |
| CVE-2026-117506 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption |
| CVE-2026-117505 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java ChildQueue queue.offer resource consumption |