CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87447 | CH Chrome Google | 6.5 | Sep 9 | Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome… |
| CVE-2026-38998 | Product not mapped yet | 6.5 | Sep 9 | A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial… |
| CVE-2026-79514 | GP Gpac Gpac | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request |
| CVE-2026-79522 | GP Gpac Gpac | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP… |
| CVE-2026-79513 | GP Gpac Gpac | 6.5 | Sep 9 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS)… |
| CVE-2026-61908 | CI Cyrus IMAP cyrusimap | 6.5 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-71616 | Product not mapped yet | 6.2 | Sep 9 | An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object() |
| CVE-2026-75307 | Product not mapped yet | 6.1 | Sep 9 | zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint |
| CVE-2026-75308 | Product not mapped yet | 6.1 | Sep 9 | yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2026-57825 | OP opam OCaml | 5.7 | Sep 9 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files |
| CVE-2025-51619 | Product not mapped yet | 5.5 | Sep 9 | A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems |
| CVE-2026-39020 | Product not mapped yet | 5.5 | Sep 9 | An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file |
| CVE-2026-71803 | Product not mapped yet | 5.4 | Sep 9 | money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability |
| CVE-2026-71802 | Product not mapped yet | 5.4 | Sep 9 | A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3 |
| CVE-2026-61910 | CI Cyrus IMAP cyrusimap | 5.0 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61909 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61907 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61911 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-79387 | Product not mapped yet | 4.3 | Sep 9 | SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via… |
| CVE-2026-79515 | Product not mapped yet | 4.3 | Sep 9 | An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file |
| CVE-2026-71807 | Product not mapped yet | 4.3 | Sep 9 | In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether… |
| CVE-2026-79516 | Product not mapped yet | 4.0 | Sep 9 | An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted… |
| CVE-2026-53937 | IO io.modelcontextprotocol:kotlin-sdk modelcontextprotocol | 6.2 | Sep 8 | MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS) |
| CVE-2026-47680 | SO source-controller fluxcd | 5.3 | Sep 8 | Source controller: Improper path handling allows traversal |
| CVE-2026-18090 | RH Red Hat Enterprise Linux 10 Red Hat | 6.1 | Sep 8 | Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block |
| CVE-2026-53637 | SY Sylius Sylius | 6.5 | Sep 8 | Sylius: Cart FormComponent allows modification or deletion of an already-completed order |
| CVE-2026-53638 | SY Sylius Sylius | 4.3 | Sep 8 | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint |
| CVE-2026-53639 | SY Sylius Sylius | 6.3 | Sep 8 | Sylius: IDOR on Shop Payment Request API endpoints |
| CVE-2026-53933 | MA maravel-framework macropay-solutions | 6.9 | Sep 8 | Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing |
| CVE-2026-81904 | CC Concrete CMS Concrete CMS | 6.3 | Sep 8 | Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration |
| CVE-2026-86077 | N8 n8n n8n-io | 6.5 | Sep 8 | n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket |
| CVE-2026-86078 | N8 n8n n8n-io | 6.5 | Sep 8 | n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service |
| CVE-2026-86079 | N8 n8n n8n-io | 6.5 | Sep 8 | n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers |
| CVE-2026-86080 | N8 n8n n8n-io | 5.3 | Sep 8 | n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open |
| CVE-2026-86082 | N8 n8n n8n-io | 6.5 | Sep 8 | n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node |
| CVE-2026-86084 | N8 n8n n8n-io | 5.5 | Sep 8 | n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions |
| CVE-2026-86085 | N8 n8n n8n-io | 4.9 | Sep 8 | n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints |
| CVE-2026-86993 | N8 n8n n8n-io | 4.9 | Sep 8 | n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check |
| CVE-2026-86994 | N8 n8n n8n-io | 4.3 | Sep 8 | n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter |
| CVE-2026-86995 | N8 n8n n8n-io | 4.3 | Sep 8 | n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read |
| CVE-2026-86996 | N8 n8n n8n-io | 5.4 | Sep 8 | n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy |
| CVE-2026-81984 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-81991 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Out-of-bounds Read (CWE-125) |
| CVE-2026-79910 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Out-of-bounds Read (CWE-125) |
| CVE-2026-81993 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-80159 | A2 Acrobat 2024 Adobe | 4.0 | Sep 8 | Acrobat Reader | Untrusted Search Path (CWE-426) |
| CVE-2026-81977 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191) |
| CVE-2026-80162 | A2 Acrobat 2024 Adobe | 5.5 | Sep 8 | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-81997 | A2 Acrobat 2024 Adobe | 6.3 | Sep 8 | Acrobat Reader | Incorrect Authorization (CWE-863) |
| CVE-2026-81994 | A2 Acrobat 2024 Adobe | 6.3 | Sep 8 | Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) |