CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42025 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):… |
| CVE-2026-9660 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9659 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9814 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9817 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9827 | TO Totolink totolink | 9.1 | Oct 20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9869 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10131 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10132 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10133 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10135 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10136 | TO Totolink totolink | 9.1 | Oct 20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10137 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10138 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10139 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10141 | TO Totolink totolink | 9.1 | Oct 20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-112380 | KC Kiro Crew Amazon | 9.9 | Oct 20 | Missing authorization in the WhatsApp channel in Kiro Crew |
| CVE-2026-113709 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Kustomize Helm config home can run commands in the repo-server |
| CVE-2026-113708 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Kustomize remote ref can run commands in the repo-server |
| CVE-2026-113672 | AR argo-cd argoproj | 9.9 | Oct 20 | Argo CD: A Jsonnet import can read files from the repo-server |
| CVE-2026-113802 | WL WL-WN530BE1-A Wavlink | 9.8 | Oct 20 | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler |
| CVE-2026-105772 | AT ADK TypeScript (@google/adk) Google | 9.1 | Oct 20 | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId |
| CVE-2026-113506 | AA aaPanel Aapanel | 9.9 | Oct 20 | aaPanel File Manager common.py ExecShell os command injection |
| CVE-2026-113703 | SU SuggestArr giuseppe99barchetta | 9.3 | Oct 20 | SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing |
| CVE-2026-113678 | FR froxlor froxlor | 9.9 | Oct 20 | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron |
| CVE-2026-86471 | AC Apache CouchDB Apache Software Foundation | 9.3 | Oct 20 | Apache CouchDB: Admin credentials leading to code execution as operating system user |
| CVE-2026-93475 | ET Eclipse ThreadX - NetX Duo Eclipse Foundation | 9.3 | Oct 20 | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 |
| CVE-2026-103119 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: AJP response mix-up |
| CVE-2026-101356 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing |
| CVE-2026-101296 | TO Tomcat Apache | 9.1 | Oct 20 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms |
| CVE-2026-113391 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection |
| CVE-2026-113620 | EI Eclipse ioFog Eclipse Foundation | 9.8 | Oct 20 | Eclipse ioFog operator WebSocket accepts an unverified JWT |
| CVE-2026-113390 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection |
| CVE-2026-113389 | VI Vigor2960 DrayTek | 9.9 | Oct 20 | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection |
| CVE-2026-105312 | SF streams for Apache Kafka 2 Red Hat | 9.9 | Oct 20 | Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation |
| CVE-2026-9589 | US Unblu Spark Unblu inc. | 9.3 | Oct 20 | Unblu Spark Authorization Bypass in Configuration Cascade Operations |
| CVE-2026-43845 | AD ADAM-3600 Advantech | 9.2 | Oct 20 | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism |
| CVE-2026-43844 | AD ADAM-3600 Advantech | 9.3 | Oct 20 | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism |
| CVE-2026-43838 | AD ADAM-3600 Advantech | 9.2 | Oct 20 | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution |
| CVE-2026-43836 | AD ADAM-3600 Advantech | 9.3 | Oct 20 | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges |
| CVE-2026-113380 | RI RingRTC Signal | 9.3 | Oct 20 | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and… |
| CVE-2026-77936 | LE letta letta-ai | 9.8 | Oct 20 | Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access |
| CVE-2026-77933 | DB DB-GPT eosphoros-ai | 9.8 | Oct 20 | DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment |
| CVE-2026-77932 | DB DB-GPT eosphoros-ai | 9.8 | Oct 20 | DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent |
| CVE-2026-77930 | EV EvoScientist EvoScientist | 9.8 | Oct 20 | EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents |
| CVE-2026-75128 | LA Langchain-Chatchat chatchat-space | 9.8 | Oct 20 | Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint |
| CVE-2026-109444 | OP opensre Tracer-Cloud | 9.8 | Oct 20 | OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection |
| CVE-2026-109442 | PI piflow cas-bigdatalab | 9.8 | Oct 20 | piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell |
| CVE-2026-109395 | CO compress-lzf ning | 9.1 | Oct 20 | Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder |
| CVE-2026-112371 | MN Magic NX15 H3C | 9.9 | Oct 19 | H3C Magic NX15 RPC esps write code injection |