CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:38 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117494 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-117493 New | CB Cloud BI Platform Sisense | 8.3 | Oct 27 | Multiple vulnerabilities in Sisense’s Cloud BI Platform |
| CVE-2026-85299 New | CE Compute Engine Google Cloud | 8.3 | Oct 27 | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration |
| CVE-2026-65211 New | MB MBD-X12SPI SMCI | 7.2 | Oct 27 | Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability |
| CVE-2026-65220 New | MB MBD-X12SPI SMCI | 8.8 | Oct 27 | Supermicro BMC IPMI feature contains a Privilege escalation vulnerability |
| CVE-2026-65219 New | MB MBD-X12SPI SMCI | 7.4 | Oct 27 | Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability |
| CVE-2026-18449 New | X1 X12SPI SMCI | 7.5 | Oct 27 | Supermicro BMC contains a SMCRAKP Fixed Key vulnerability |
| CVE-2026-16521 New | MB MBD-X12STW-F SMCI | 7.2 | Oct 27 | Supermicro BMC's syslog feature contains a command injection vulnerability |
| CVE-2026-111461 New | OG OnCell G3150A-LTE Series Moxa | 7.5 | Oct 27 | SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series |
| CVE-2026-111460 New | OG OnCell G3150A-LTE Series Moxa | 7.7 | Oct 27 | Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series |
| CVE-2026-111459 New | MR Moxa Remote Connect Suite (MRC Client) Moxa | 7.6 | Oct 27 | Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) |
| CVE-2026-106174 New | FO FortiOS Fortinet | 7.5 | Oct 27 | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial… |
| CVE-2026-75891 New | KF Kirki – Freeform Page Builder, Website Builder & Customizer themeum | 8.8 | Oct 27 | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint |
| CVE-2026-111820 New | AI Analytics Insights – Google Analytics Dashboard for WordPress deconf | 7.2 | Oct 27 | Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title |
| CVE-2026-116839 New | AM airMAX M Ubiquiti Inc | 7.1 | Oct 27 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make… |
| CVE-2026-116838 New | AM airMAX M Ubiquiti Inc | 8.8 | Oct 27 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a… |
| CVE-2026-116623 New | SC Simple Content Management System code-projects | 7.3 | Oct 27 | code-projects Simple Content Management System Admin welcome.php authorization |
| CVE-2026-116837 New | AM airMAX M Ubiquiti Inc | 8.8 | Oct 27 | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to… |
| CVE-2026-116843 New | MI mistral-vibe mistralai | 8.8 | Oct 27 | Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode |
| CVE-2026-116816 New | LL llama.cpp ggml-org | 7.8 | Oct 27 | llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer |
| CVE-2024-58400 New | LL llama.cpp ggml-org | 8.2 | Oct 27 | llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs |
| CVE-2026-116836 New | AM airMAX M Ubiquiti Inc | 8.8 | Oct 27 | A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to… |
| CVE-2026-116620 New | RA RapidJSON Tencent | 7.3 | Oct 27 | Tencent RapidJSON Regex stream.h Take out-of-bounds |
| CVE-2026-116819 New | OP openpanel Openpanel-dev | 8.5 | Oct 26 | OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query |
| CVE-2026-116818 New | OP openpanel Openpanel-dev | 8.2 | Oct 26 | OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket |
| CVE-2026-116811 New | OP openpanel Openpanel-dev | 8.8 | Oct 26 | OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template |
| CVE-2026-116808 New | OP openpanel Openpanel-dev | 7.2 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values |
| CVE-2026-116591 New | CO compress klauspost | 8.7 | Oct 26 | compress zstd: Panic on two-block frames |
| CVE-2026-116748 New | TR transmission transmission | 8.8 | Oct 26 | Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token |
| CVE-2026-116747 New | KE kener rajnandan1 | 8.1 | Oct 26 | Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret |
| CVE-2026-116738 New | VM vmime kisli | 8.8 | Oct 26 | VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder |
| CVE-2026-116724 New | FL fltk fltk | 7.8 | Oct 26 | FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow |
| CVE-2026-116723 New | FL fltk fltk | 7.8 | Oct 26 | FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field |
| CVE-2026-116589 New | DD dd-trace-py DataDog | 8.2 | Oct 26 | Datadog dd-trace-py: IAST instrumentation can lead to application DOS |
| CVE-2026-116588 New | DD dd-trace-py DataDog | 8.7 | Oct 26 | Datadog dd-trace-py: ReDOS in URL query string obfuscation |
| CVE-2026-116587 New | GO go-jose go-jose | 7.5 | Oct 26 | Go JOSE: DoS when parsing JWKs that contain RSA keys |
| CVE-2026-116584 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length |
| CVE-2026-65327 New | MA macOS Apple | 8.4 | Oct 26 | A logic issue was addressed with improved checks |
| CVE-2026-86929 New | MA macOS Apple | 8.8 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112637 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112457 New | MA macOS Apple | 7.1 | Oct 26 | A double free issue was addressed with improved memory management |
| CVE-2026-116581 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) |
| CVE-2026-112427 New | MA macOS Apple | 8.1 | Oct 26 | An authentication issue was addressed with improved state management |
| CVE-2026-112688 New | MA macOS Apple | 8.8 | Oct 26 | A memory corruption issue was addressed with improved memory handling |
| CVE-2026-112626 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112651 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112484 New | MA macOS Apple | 7.8 | Oct 26 | This issue was addressed with improved file handling |
| CVE-2026-86916 New | MA macOS Apple | 7.8 | Oct 26 | A use after free issue was addressed with improved memory management |
| CVE-2026-116580 New | SE seroval lxsmnsyc | 7.3 | Oct 26 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check |
| CVE-2026-113947 New | MA macOS Apple | 8.8 | Oct 26 | This issue was addressed with improved access restrictions |