CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 15:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118374 New | LI LibreSSL OpenBSD | 5.9 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-118370 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes |
| CVE-2026-117610 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser |
| CVE-2026-117609 New | RT rtl_433 merbanan | 7.1 | Oct 28 | rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder |
| CVE-2026-117608 New | AS assimp assimp | 6.1 | Oct 28 | Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow |
| CVE-2026-117607 New | XE xerteonlinetoolkits thexerteproject | 7.2 | Oct 28 | Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import |
| CVE-2026-117606 New | NE NexoPOS Blair2004 | 5.4 | Oct 28 | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions |
| CVE-2026-117605 New | NO nopCommerce nopSolutions | 4.3 | Oct 28 | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers |
| CVE-2015-20129 New | CR CrushFTP CrushFTP | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ |
| CVE-2014-125138 New | CE Cart Engine C97net | 8.8 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields |
| CVE-2014-125137 New | CE Cart Engine C97net | 6.5 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php |
| CVE-2014-125136 New | CE Cart Engine C97net | 5.9 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup |
| CVE-2013-20009 New | WA WAG200G Linksys | 4.8 | Oct 28 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter |
| CVE-2013-20008 New | WA WAG200G Linksys | 6.8 | Oct 28 | Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password |
| CVE-2013-20007 New | WA WAG200G Linksys | 7.2 | Oct 28 | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi |
| CVE-2026-118272 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure |
| CVE-2026-106013 New | JX Jupiter X Core artbees | 9.8 | Oct 28 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter |
| CVE-2026-118271 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-context Resolver data-context.ts resource consumption |
| CVE-2026-110879 New | JA jackson-databind FasterXML | 9.8 | Oct 28 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) |
| CVE-2026-110747 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 28 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload |
| CVE-2026-104895 New | JA jackson-dataformat-smile FasterXML | 7.5 | Oct 28 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service |
| CVE-2026-106971 New | Product not mapped yet | – | Oct 28 | An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input |
| CVE-2026-106972 New | Product not mapped yet | – | Oct 28 | An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input |