CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 11:20 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105930 New | AP Apache Pulsar Apache Software Foundation | 6.0 | Oct 21 | Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download |
| CVE-2026-112868 New | H5 H5P H5P | 4.3 | Oct 21 | WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-105927 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission |
| CVE-2026-114265 New | AL Advanced Library Management System ProjectWorlds | 6.3 | Oct 21 | ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection |
| CVE-2026-114176 New | ER eRoom DigitalME | 4.3 | Oct 21 | WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-105926 New | AP Apache Pulsar Apache Software Foundation | 5.3 | Oct 21 | Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands |
| CVE-2026-105869 New | AP Apache Pulsar Apache Software Foundation | 9.2 | Oct 21 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role |
| CVE-2026-114493 New | LO LocalAI LocalAI | 8.6 | Oct 21 | LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects |
| CVE-2026-114492 New | GI gin-vue-admin flipped-aurora | 6.5 | Oct 21 | gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint |
| CVE-2026-114491 New | PD pdfmake bpampuch | 5.3 | Oct 21 | pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images |
| CVE-2026-110744 New | MG Multicluster Global Hub Red Hat | 7.2 | Oct 21 | Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide |
| CVE-2026-114133 New | NU nuxt nuxt | 5.4 | Oct 21 | Nuxt server islands render `useHeadSafe` input without sanitisation |
| CVE-2026-114132 New | NU nuxt nuxt | 6.3 | Oct 21 | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
| CVE-2026-114264 New | AL Advanced Library Management System ProjectWorlds | 4.7 | Oct 21 | ProjectWorlds Advanced Library Management System edit_member.php sql injection |
| CVE-2026-114131 New | NU nuxt nuxt | 6.5 | Oct 21 | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes |
| CVE-2026-114130 New | NU nuxt nuxt | 2.3 | Oct 21 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
| CVE-2026-114129 New | ST stream-json uhop | 6.2 | Oct 21 | stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service |
| CVE-2026-114128 New | AS astro withastro | 6.5 | Oct 21 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering |
| CVE-2026-114263 New | AL Advanced Library Management System ProjectWorlds | 7.3 | Oct 21 | ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection |
| CVE-2026-114127 New | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-114126 New | ST storybook storybookjs | 8.7 | Oct 21 | Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files |
| CVE-2026-92202 New | KE KeyShot Luxion | 7.8 | Oct 21 | Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability |
| CVE-2026-92183 New | GI GIMP GIMP | 7.8 | Oct 21 | GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-92207 New | MI MindsDB MindsDB | 8.8 | Oct 21 | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability |
| CVE-2026-92206 New | CR CrewAI CrewAI | 8.8 | Oct 21 | CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability |
| CVE-2026-92205 New | BU BusyBox BusyBox | 6.1 | Oct 21 | BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability |
| CVE-2026-92204 New | AI Airbyte Airbyte | 7.7 | Oct 21 | Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability |
| CVE-2026-92203 New | AI Airbyte Airbyte | 7.7 | Oct 21 | Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability |
| CVE-2026-89035 New | RO RouterOS MikroTik | 7.4 | Oct 21 | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass |
| CVE-2026-92210 New | NO NoMachine NoMachine | 7.2 | Oct 21 | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability |
| CVE-2026-92209 New | NO NoMachine NoMachine | 7.8 | Oct 21 | NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability |
| CVE-2026-92208 New | NO NoMachine NoMachine | 8.8 | Oct 21 | NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-111184 New | NO NoMachine NoMachine | 7.8 | Oct 21 | NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability |
| CVE-2026-111183 New | GS GStreamer GStreamer | 9.8 | Oct 21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-114262 New | FI file-management-system File-management-system | 7.3 | Oct 21 | file-management-system FileController.php store unrestricted upload |
| CVE-2026-114125 New | ST storybook storybookjs | 8.6 | Oct 21 | Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites |
| CVE-2026-114124 New | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114261 New | FI file-management-system MomoTommy | 7.3 | Oct 21 | MomoTommy file-management-system Files API FileController.php destroy missing authentication |
| CVE-2026-53986 New | GC Girafit camera app Girafit | 5.3 | Oct 21 | Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure |
| CVE-2026-114123 New | D3 d365fo-mcp-server dynamics365ninja | 7.5 | Oct 21 | D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet |
| CVE-2026-114260 New | FI file-management-system-php oretnom23 | 6.5 | Oct 21 | oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication |
| CVE-2026-114259 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload |
| CVE-2026-114122 New | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-114121 New | EL electron electron | 5.4 | Oct 21 | Electron: openExternal permission requests can be attributed to the wrong origin |
| CVE-2026-76497 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 6.6 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities |
| CVE-2026-76505 New | CI Cisco IOS XR Software Cisco | 7.5 | Oct 21 | Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability |
| CVE-2026-76524 New | CO Cisco Open Source Snort3 Cisco | 7.8 | Oct 21 | Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability |
| CVE-2026-76496 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.0 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities |
| CVE-2026-76495 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.8 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities |
| CVE-2026-76494 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.8 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities |