CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 15:38 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-79861 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10 |
| CVE-2026-79860 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 |
| CVE-2026-79859 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 |
| CVE-2026-79858 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8 |
| CVE-2026-79857 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol |
| CVE-2026-79856 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8 |
| CVE-2026-79855 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise |
| CVE-2026-79854 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79853 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10 |
| CVE-2026-79852 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.8 | Oct 22 | Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface |
| CVE-2026-79851 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79850 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-8 |
| CVE-2026-79849 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79848 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 |
| CVE-2026-79847 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 |
| CVE-2026-79846 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Unauthenticated Command Injection Vulnerabilities in AOS-8 |
| CVE-2026-79844 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 10.0 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-10 |
| CVE-2026-114612 New | LI litellm BerriAI | 9.9 | Oct 22 | LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
| CVE-2026-114611 New | OC OCO-Server schorschii | 9.1 | Oct 22 | OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack |
| CVE-2026-114607 New | BE better-auth better-auth | 9.1 | Oct 22 | better-auth: OAuth state can be used as a Magic Link to sign in as another user |
| CVE-2026-97631 New | ED EDK2 TianoCore | 9.5 | Oct 22 | Pre-boot RCE in EDK II PXE driver |
| CVE-2026-85079 | EM EmberZNet Silicon Labs | 9.8 | Oct 22 | Out-of-bounds write in Zigbee Simple_Desc_req handling |
| CVE-2026-94502 | EM EmberZNet Silicon Labs | 9.8 | Oct 22 | Out-of-bounds write in Zigbee Publish Price Matrix handling |
| CVE-2026-85080 | EM EmberZNet Silicon Labs | 9.1 | Oct 22 | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling |
| CVE-2026-111497 In wildKEV | BR Brotli Google | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-102785 | YP YOOtheme Pro extension for Joomla yootheme.com | 10.0 | Oct 22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 |
| CVE-2026-112832 | RO Rootblox CozyThemes | 9.8 | Oct 22 | WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability |
| CVE-2022-51022 | YI YiShaAdmin liukuo362573 | 9.1 | Oct 22 | YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint |
| CVE-2021-48016 | DE DedeCMS DedeCMS | 9.8 | Oct 22 | DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php |
| CVE-2021-48014 | FI FineReport FanRuan | 9.8 | Oct 22 | FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer |
| CVE-2026-112241 | SU SureCart Brainstorm Force | 9.8 | Oct 22 | WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability |
| CVE-2026-112327 | AM Amelia TMS | 9.3 | Oct 22 | WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability |
| CVE-2026-114220 | NO NT OneAPP NewType Infortech | 9.1 | Oct 22 | NewType Infortech｜NT OneAPP - Improper Certificate Validation |
| CVE-2026-96355 | DR Drupal Drupal | 9.1 | Oct 22 | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 |
| CVE-2026-114575 | A9 A950RG TOTOLINK | 10.0 | Oct 22 | TOTOLINK A950RG product.so UploadCustomModule command injection |
| CVE-2026-110264 | GI GitLab GitLab | 10.0 | Oct 22 | Integer Overflow or Wraparound in GitLab |
| CVE-2026-78846 | Product not mapped yet | 9.8 | Oct 22 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing |
| CVE-2025-65200 | Product not mapped yet | 9.6 | Oct 22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the… |
| CVE-2026-76531 | SS Splunk SOAR Splunk | 9.9 | Oct 21 | Files or Directories Accessible to External Parties in Splunk SOAR |
| CVE-2026-76302 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76301 | SE Splunk Enterprise Splunk | 9.8 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76299 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-114509 | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114383 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow |
| CVE-2026-114382 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-96639 | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-114139 | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-111812 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |