CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 04:52 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-78846 | Product not mapped yet | 9.8 | Oct 22 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing |
| CVE-2025-65200 | Product not mapped yet | 9.6 | Oct 22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the… |
| CVE-2026-76531 | SS Splunk SOAR Splunk | 9.9 | Oct 21 | Files or Directories Accessible to External Parties in Splunk SOAR |
| CVE-2026-76529 | SS Splunk SOAR Splunk | 9.8 | Oct 21 | Improper Protection of Alternate Path in Splunk SOAR |
| CVE-2026-76527 | SS Splunk SOAR Splunk | 9.8 | Oct 21 | Improper Check or Handling of Exceptional Conditions in Splunk SOAR |
| CVE-2026-76408 | SS Splunk SOAR Splunk | 9.8 | Oct 21 | Improper Control of a Resource Through its Lifetime in Splunk SOAR |
| CVE-2026-76302 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76301 | SE Splunk Enterprise Splunk | 9.8 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76299 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-114509 | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114383 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow |
| CVE-2026-114382 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-94423 | Product not mapped yet | 9.1 | Oct 21 | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts |
| CVE-2026-94140 | Product not mapped yet | 9.1 | Oct 21 | Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no |
| CVE-2026-96639 | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-114139 | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-111812 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |
| CVE-2026-111809 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling |
| CVE-2026-111815 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement |
| CVE-2026-111814 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin |
| CVE-2026-114268 | BP BE3L Pro Tenda | 9.9 | Oct 21 | Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow |
| CVE-2026-111816 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out |
| CVE-2026-111813 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration |
| CVE-2026-105944 | AP Apache Pulsar Manager Apache Software Foundation | 10.0 | Oct 21 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life |
| CVE-2026-105869 | AP Apache Pulsar Apache Software Foundation | 9.2 | Oct 21 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role |
| CVE-2026-111183 | GS GStreamer GStreamer | 9.8 | Oct 21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-76475 | CE Cisco Emergency Responder Cisco | 9.3 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities |
| CVE-2026-76474 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities |
| CVE-2026-76473 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. |
| CVE-2026-76466 | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 9.8 | Oct 21 | Cisco Expressway Series Remote Code Execution Vulnerability |
| CVE-2026-20043 | CC Cisco Cyber Vision Cisco | 9.0 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-113788 | LA lagoon uselagoon | 9.4 | Oct 21 | Lagoon core ssh service vulnerable to remote code execution |
| CVE-2026-111832 | WM WP Mailster WP Mailster | 10.0 | Oct 21 | WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability |
| CVE-2026-111834 | MB Mang Board WP Kitae Park | 9.9 | Oct 21 | WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability |
| CVE-2026-111852 | AS Ajax Search Lite WPdreams | 9.3 | Oct 21 | WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability |
| CVE-2026-109618 In wildKEV | PH PHP PHP | 9.8 | Oct 21 | RCE via OOM corruption |
| CVE-2026-86249 | AB Apache bRPC Apache Software Foundation | 9.1 | Oct 21 | Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth |
| CVE-2026-78334 | AB Apache bRPC Apache Software Foundation | 9.1 | Oct 21 | Apache bRPC: Missing Authentication for Streaming RPC Frames |
| CVE-2026-56388 | AB Apache bRPC Apache Software Foundation | 9.1 | Oct 21 | Apache bRPC: Out-of-Bounds Write in Redis Command Parser |
| CVE-2026-48830 | AB Apache bRPC Apache Software Foundation | 9.1 | Oct 21 | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests |
| CVE-2026-59562 | AI Apache IoTDB Apache Software Foundation | 9.8 | Oct 21 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC |
| CVE-2026-58663 | AI Apache IoTDB Apache Software Foundation | 9.8 | Oct 21 | Apache IoTDB: Auth Bypass in pipeTransfer() interface |
| CVE-2026-87095 | AC Acronis Cyber Infrastructure Acronis | 9.1 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-71195 | MA Manila OpenStack | 9.9 | Oct 21 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share |
| CVE-2026-113744 | AC AC19 Tenda | 10.0 | Oct 21 | Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow |
| CVE-2026-114119 | BP Bp Premier Best Practice Software | 9.8 | Oct 21 | Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential |
| CVE-2026-114108 | VI Vibe-Trading HKUDS | 9.8 | Oct 21 | HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE |
| CVE-2026-113736 | DH DHP-W610AV D-Link | 9.8 | Oct 21 | D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password |