CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 23:34 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92374 New | FC Full Client TeamViewer | 7.8 | Oct 27 | Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS |
| CVE-2026-92372 New | FC Full Client TeamViewer | 8.8 | Oct 27 | Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution |
| CVE-2026-117604 New | GR grav getgrav | 7.5 | Oct 27 | Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback |
| CVE-2026-118008 New | Product not mapped yet | 8.8 | Oct 27 | Privilege escalation in the DOM: Navigation component |
| CVE-2026-94347 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 27 | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0… |
| CVE-2026-94346 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 27 | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0… |
| CVE-2026-117602 New | EL electrum spesmilo | 8.4 | Oct 27 | Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution |
| CVE-2026-117601 New | EL electrum spesmilo | 7.5 | Oct 27 | Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions |
| CVE-2026-117573 New | HA hagent masc-ucsc | 7.8 | Oct 27 | hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools |
| CVE-2026-117569 New | KA kali-gpt alishahid74 | 7.8 | Oct 27 | Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters |
| CVE-2026-117568 New | MC mcp-ffmpeg bitscorp-mcp | 7.0 | Oct 27 | mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir |
| CVE-2026-117567 New | ES esp-mcp horw | 7.8 | Oct 27 | esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters |
| CVE-2026-117561 New | SF sf-mcp codefriar | 7.8 | Oct 27 | sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values |
| CVE-2026-117560 New | GE gemini-cli-extension atxp | 7.8 | Oct 27 | ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools |
| CVE-2026-117559 New | DR droidmind hyperb1iss | 7.8 | Oct 27 | DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass |
| CVE-2026-117558 New | AI ai-sdlc ai-sdlc-framework | 7.8 | Oct 27 | ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status |
| CVE-2026-117553 New | UM Umbraco-CMS umbraco | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning |
| CVE-2026-92546 New | AA Agentic AI / Agentic Ally Keepnet Labs Cybersecurity Inc. | 7.5 | Oct 27 | Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally |
| CVE-2026-47486 New | PH PhysX NVIDIA | 7.8 | Oct 27 | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write |
| CVE-2026-65151 New | NA NeMo Agent Toolkit NVIDIA | 8.4 | Oct 27 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue |
| CVE-2026-65120 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-24269 New | TE TensorRT-LLM NVIDIA | 7.1 | Oct 27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery |
| CVE-2026-65119 New | TE TensorRT-LLM NVIDIA | 8.4 | Oct 27 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted… |
| CVE-2026-100164 New | AG Agentis Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. | 7.5 | Oct 27 | User Enumeration in Rolantis Information Technologies' Agentis |
| CVE-2026-106087 New | TS TRO600 Series Firmware Hitachi Energy | 8.7 | Oct 27 | TRO600 contains an arbitrary file read vulnerability |
| CVE-2026-10756 New | TS TRO600 Series Firmware Hitachi Energy | 7.7 | Oct 27 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost |
| CVE-2026-13162 New | C4 CoreTec 4 Hitachi Energy | 7.7 | Oct 27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device |
| CVE-2026-109995 New | AV Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode wplakeorg | 7.2 | Oct 27 | Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
| CVE-2026-41021 New | EA easyE4 Eaton | 7.5 | Oct 27 | Eaton easyE4 uses an insufficiently strong password policy |
| CVE-2026-102800 New | DE DJ-HelpfulArticles extension for Joomla dj-extensions.com | 8.7 | Oct 27 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 |
| CVE-2026-41020 New | EA easyE4 Eaton | 7.5 | Oct 27 | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid… |
| CVE-2026-4337 New | PU PuMuKIT PuMuKIT | 8.8 | Oct 27 | Unrestricted Upload of File in PuMuKIT application |
| CVE-2026-117540 New | SV svg-sanitizer darylldoyle | 7.5 | Oct 27 | svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop |
| CVE-2026-117536 New | CO core redaxo | 8.8 | Oct 27 | REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation |
| CVE-2026-116898 New | CO core redaxo | 7.1 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move |
| CVE-2026-116896 New | CO core redaxo | 7.5 | Oct 27 | REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables |
| CVE-2026-117466 New | OS Octopus Server Octopus Deploy | 8.6 | Oct 27 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator |
| CVE-2026-117341 New | OS Octopus Server Octopus Deploy | 7.7 | Oct 27 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log |
| CVE-2026-116870 New | OS Octopus Server Octopus Deploy | 8.7 | Oct 27 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently |
| CVE-2026-116890 New | SE SemanticMediaWiki SemanticMediaWiki | 7.3 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API |
| CVE-2026-116880 New | SE SemanticMediaWiki SemanticMediaWiki | 7.1 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions |
| CVE-2026-116878 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity |
| CVE-2026-116876 New | SE SemanticMediaWiki SemanticMediaWiki | 7.1 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected |
| CVE-2026-116873 New | SE SemanticMediaWiki SemanticMediaWiki | 7.3 | Oct 27 | Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update |
| CVE-2026-116872 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters |
| CVE-2026-116871 New | SE SemanticMediaWiki SemanticMediaWiki | 7.5 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask |
| CVE-2026-82121 New | HS HiRDB Server Version 10 Hitachi | 7.5 | Oct 27 | Origin Validation Error Vulnerability in HiRDB |
| CVE-2026-117494 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-117493 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-85299 New | CE Compute Engine Google Cloud | 8.3 | Oct 27 | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration |