CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109089 New | LI libXi X.Org | 7.5 | Oct 27 | libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow |
| CVE-2026-102638 New | FU Fusion Autodesk | 7.1 | Oct 27 | Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop |
| CVE-2026-102637 New | FU Fusion Autodesk | 7.1 | Oct 27 | Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop |
| CVE-2026-102636 New | FU Fusion Autodesk | 7.1 | Oct 27 | Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop |
| CVE-2026-107672 New | FP Fusion Post Processor Utility Autodesk | 8.8 | Oct 27 | Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility |
| CVE-2026-117511 New | NO node-tesseract desmondmorris | 7.3 | Oct 27 | desmondmorris node-tesseract Command Builder tesseract.js process os command injection |
| CVE-2026-93862 New | FO Fireware OS WatchGuard | 7.2 | Oct 27 | Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service |
| CVE-2026-90464 New | FO Fireware OS WatchGuard | 7.2 | Oct 27 | Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root |
| CVE-2026-103593 New | FO Fireware OS WatchGuard | 7.1 | Oct 27 | Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution |
| CVE-2026-93434 New | FO Fireware OS WatchGuard | 8.7 | Oct 27 | Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets |
| CVE-2026-90442 New | FO Fireware OS WatchGuard | 8.6 | Oct 27 | Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service |
| CVE-2026-93864 New | FO Fireware OS WatchGuard | 7.1 | Oct 27 | Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root |
| CVE-2026-111107 New | FO Fireware OS WatchGuard | 8.7 | Oct 27 | Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service |
| CVE-2026-104189 New | 3D 3Dviewer-Nextcloud maz1987in | 7.5 | Oct 27 | 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share |
| CVE-2026-111585 New | FC Full Client TeamViewer | 8.8 | Oct 27 | Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow |
| CVE-2026-111584 New | TR TeamViewer Remote - Patch Management TeamViewer | 7.3 | Oct 27 | Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows |
| CVE-2026-111583 New | FC Full Client TeamViewer | 7.3 | Oct 27 | Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows |
| CVE-2026-111582 New | RM Remote Management - Monitoring TeamViewer | 7.3 | Oct 27 | Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows |
| CVE-2026-92377 New | FC Full Client TeamViewer | 7.8 | Oct 27 | Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows |
| CVE-2026-92376 New | RM Remote Management - Monitoring TeamViewer | 7.8 | Oct 27 | Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows |
| CVE-2026-92375 New | FC Full Client TeamViewer | 7.8 | Oct 27 | Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring |
| CVE-2026-92374 New | FC Full Client TeamViewer | 7.8 | Oct 27 | Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS |
| CVE-2026-92372 New | FC Full Client TeamViewer | 8.8 | Oct 27 | Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution |
| CVE-2026-117604 New | GR grav getgrav | 7.5 | Oct 27 | Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback |
| CVE-2026-118008 New | Product not mapped yet | 8.8 | Oct 27 | Privilege escalation in the DOM: Navigation component |
| CVE-2026-94347 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 27 | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0… |
| CVE-2026-94346 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 27 | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0… |
| CVE-2026-117602 New | EL electrum spesmilo | 8.4 | Oct 27 | Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution |
| CVE-2026-117601 New | EL electrum spesmilo | 7.5 | Oct 27 | Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions |
| CVE-2026-117573 New | HA hagent masc-ucsc | 7.8 | Oct 27 | hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools |
| CVE-2026-117569 New | KA kali-gpt alishahid74 | 7.8 | Oct 27 | Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters |
| CVE-2026-117568 New | MC mcp-ffmpeg bitscorp-mcp | 7.0 | Oct 27 | mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir |
| CVE-2026-117567 New | ES esp-mcp horw | 7.8 | Oct 27 | esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters |
| CVE-2026-117561 New | SF sf-mcp codefriar | 7.8 | Oct 27 | sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values |
| CVE-2026-117560 New | GE gemini-cli-extension atxp | 7.8 | Oct 27 | ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools |
| CVE-2026-117559 New | DR droidmind hyperb1iss | 7.8 | Oct 27 | DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass |
| CVE-2026-117558 New | AI ai-sdlc ai-sdlc-framework | 7.8 | Oct 27 | ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status |
| CVE-2026-117553 New | UM Umbraco-CMS umbraco | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning |
| CVE-2026-92546 New | AA Agentic AI / Agentic Ally Keepnet Labs Cybersecurity Inc. | 7.5 | Oct 27 | Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally |
| CVE-2026-47486 New | PH PhysX NVIDIA | 7.8 | Oct 27 | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write |
| CVE-2026-65151 New | NA NeMo Agent Toolkit NVIDIA | 8.4 | Oct 27 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue |
| CVE-2026-65120 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-24269 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-65119 New | TE TensorRT-LLM NVIDIA | 8.4 | Oct 27 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted… |
| CVE-2026-100164 New | AG Agentis Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. | 7.5 | Oct 27 | User Enumeration in Rolantis Information Technologies' Agentis |
| CVE-2026-106087 New | TS TRO600 Series Firmware Hitachi Energy | 8.7 | Oct 27 | TRO600 contains an arbitrary file read vulnerability |
| CVE-2026-10756 New | TS TRO600 Series Firmware Hitachi Energy | 7.7 | Oct 27 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost |
| CVE-2026-13162 New | C4 CoreTec 4 Hitachi Energy | 7.7 | Oct 27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device |
| CVE-2026-109995 New | AV Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode wplakeorg | 7.2 | Oct 27 | Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
| CVE-2026-41021 New | EA easyE4 Eaton | 7.5 | Oct 27 | Eaton easyE4 uses an insufficiently strong password policy |