CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:49 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112921 New | Product not mapped yet | – | Oct 21 | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request |
| CVE-2026-114382 New | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 New | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-94423 New | Product not mapped yet | – | Oct 21 | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts |
| CVE-2026-94140 New | Product not mapped yet | – | Oct 21 | Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no |
| CVE-2026-114501 New | PI Pillow python-pillow | 5.3 | Oct 21 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 |
| CVE-2026-114381 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System orderdetail.php sql injection |
| CVE-2026-96639 New | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-96636 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) |
| CVE-2026-29001 New | TA TastyIgniter tastyigniter | 7.2 | Oct 21 | TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization |
| CVE-2026-96640 New | PI Pillow python-pillow | 7.5 | Oct 21 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion |
| CVE-2026-96637 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS |
| CVE-2026-114380 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System inserttrans.php sql injection |
| CVE-2026-113811 New | Product not mapped yet | – | Oct 21 | Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search |
| CVE-2026-96778 New | PI Pillow python-pillow | 8.8 | Oct 21 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer |
| CVE-2026-114406 New | RH Red Hat Advanced Cluster Security 4 Red Hat | 6.8 | Oct 21 | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns |
| CVE-2026-96643 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time |
| CVE-2026-96644 New | PI Pillow python-pillow | 8.1 | Oct 21 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) |
| CVE-2026-96641 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise |
| CVE-2026-96642 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: TarIO negative size field causes infinite CPU-spin loop |
| CVE-2026-82987 New | VC vCast Viewsonic | – | Oct 21 | No description published yet |
| CVE-2026-96638 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode |
| CVE-2026-114379 New | EK ekko-studio EKKOLearnAI | 5.4 | Oct 21 | EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion |
| CVE-2026-114145 New | GI GitPython gitpython-developers | 7.5 | Oct 21 | GitPython validates a submodule's ".git" path only after cloning into it (RCE) |
| CVE-2026-114144 New | TO toml-node BinaryMuse | 7.5 | Oct 21 | toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() |
| CVE-2026-114143 New | TO toml-node BinaryMuse | 8.7 | Oct 21 | toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() |
| CVE-2026-114378 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System deleteproduct.php sql injection |
| CVE-2026-114142 New | TO toml-node BinaryMuse | 8.8 | Oct 21 | toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype |
| CVE-2026-114141 New | TO toml-node BinaryMuse | 8.7 | Oct 21 | toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() |
| CVE-2026-114140 New | NB nbconvert jupyter | 8.8 | Oct 21 | nbconvert: File write via path traversal in cell output filenames |
| CVE-2026-114377 New | WI wiki-go leomoon-studios | 3.8 | Oct 21 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal |
| CVE-2026-114139 New | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-114138 New | DJ django-rest-framework encode | 7.5 | Oct 21 | Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation |
| CVE-2026-114137 New | DJ django-rest-framework encode | 7.4 | Oct 21 | Django REST framework: TokenProxy.delete() reports success and revokes nothing |
| CVE-2026-114136 New | DJ django-rest-framework encode | 7.5 | Oct 21 | Django REST framework: JSONParser applies an attacker-named codec to the request stream |
| CVE-2026-114376 New | WI wiki-go leomoon-studios | 6.3 | Oct 21 | leomoon-studios wiki-go API editor.go SourceHandler path traversal |
| CVE-2026-114135 New | JU jupyter_server jupyter-server | 8.8 | Oct 21 | Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization |
| CVE-2026-114375 New | WI wiki-go leomoon-studios | 6.3 | Oct 21 | leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal |
| CVE-2026-85518 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.1 | Oct 21 | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition |
| CVE-2026-112408 New | AS Amazon SageMaker Python SDK AWS | 8.1 | Oct 21 | Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() |
| CVE-2026-114438 New | RH Red Hat Build of Keycloak Red Hat | 4.2 | Oct 21 | Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering |
| CVE-2026-114374 New | WI wiki-go leomoon-studios | 4.3 | Oct 21 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery |
| CVE-2026-112381 New | AT Apache Traffic Server Apache Software Foundation | 5.9 | Oct 21 | Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response |
| CVE-2026-111817 New | AT Apache Traffic Server Apache Software Foundation | 5.3 | Oct 21 | Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout |
| CVE-2026-111812 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 New | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |
| CVE-2026-111809 New | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling |
| CVE-2026-114362 New | HA HarnessRouter Harnessrouter | 6.3 | Oct 21 | HarnessRouter Targets Test Endpoint app.py server-side request forgery |
| CVE-2026-111810 New | AT Apache Traffic Server Apache Software Foundation | 7.5 | Oct 21 | Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service |
| CVE-2026-111815 New | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement |