CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 11:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116836 New | AM airMAX M Ubiquiti Inc | 8.8 | Oct 27 | A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to… |
| CVE-2026-116620 New | RA RapidJSON Tencent | 7.3 | Oct 27 | Tencent RapidJSON Regex stream.h Take out-of-bounds |
| CVE-2026-111422 New | AA Apache Airflow SSH provider Apache Software Foundation | 8.8 | Oct 26 | Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host |
| CVE-2026-116819 New | OP openpanel Openpanel-dev | 8.5 | Oct 26 | OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query |
| CVE-2026-116818 New | OP openpanel Openpanel-dev | 8.2 | Oct 26 | OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket |
| CVE-2026-116811 New | OP openpanel Openpanel-dev | 8.8 | Oct 26 | OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template |
| CVE-2026-116808 New | OP openpanel Openpanel-dev | 7.2 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values |
| CVE-2026-116591 New | CO compress klauspost | 8.7 | Oct 26 | compress zstd: Panic on two-block frames |
| CVE-2026-116748 New | TR transmission transmission | 8.8 | Oct 26 | Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token |
| CVE-2026-116747 New | KE kener rajnandan1 | 8.1 | Oct 26 | Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret |
| CVE-2026-116738 New | VM vmime kisli | 8.8 | Oct 26 | VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder |
| CVE-2026-116724 New | FL fltk fltk | 7.8 | Oct 26 | FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow |
| CVE-2026-116723 New | FL fltk fltk | 7.8 | Oct 26 | FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field |
| CVE-2026-116589 New | DD dd-trace-py DataDog | 8.2 | Oct 26 | Datadog dd-trace-py: IAST instrumentation can lead to application DOS |
| CVE-2026-116588 New | DD dd-trace-py DataDog | 8.7 | Oct 26 | Datadog dd-trace-py: ReDOS in URL query string obfuscation |
| CVE-2026-116587 New | GO go-jose go-jose | 7.5 | Oct 26 | Go JOSE: DoS when parsing JWKs that contain RSA keys |
| CVE-2026-116584 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length |
| CVE-2026-65327 New | MA macOS Apple | 8.4 | Oct 26 | A logic issue was addressed with improved checks |
| CVE-2026-86929 New | MA macOS Apple | 8.8 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112637 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112457 New | MA macOS Apple | 7.1 | Oct 26 | A double free issue was addressed with improved memory management |
| CVE-2026-116581 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) |
| CVE-2026-112427 New | MA macOS Apple | 8.1 | Oct 26 | An authentication issue was addressed with improved state management |
| CVE-2026-112688 New | MA macOS Apple | 8.8 | Oct 26 | A memory corruption issue was addressed with improved memory handling |
| CVE-2026-112626 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112651 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112484 New | MA macOS Apple | 7.8 | Oct 26 | This issue was addressed with improved file handling |
| CVE-2026-86916 New | MA macOS Apple | 7.8 | Oct 26 | A use after free issue was addressed with improved memory management |
| CVE-2026-116580 New | SE seroval lxsmnsyc | 7.3 | Oct 26 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check |
| CVE-2026-113947 New | MA macOS Apple | 8.8 | Oct 26 | This issue was addressed with improved access restrictions |
| CVE-2026-112655 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112659 New | MA macOS Apple | 8.8 | Oct 26 | A type confusion issue was addressed with improved memory handling |
| CVE-2025-13833 New | SE SecureConnector Forescout Technologies | 7.7 | Oct 26 | Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution |
| CVE-2026-112623 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112438 New | MA macOS Apple | 8.8 | Oct 26 | A logic issue was addressed with improved state management |
| CVE-2026-64759 New | MA macOS Apple | 8.8 | Oct 26 | An integer overflow was addressed with improved input validation |
| CVE-2026-116576 New | SY systeminformation sebhildebrandt | 7.8 | Oct 26 | systeminformation: Windows command injection in services() through Unicode quotation marks |
| CVE-2026-65629 New | JO jose potatosalad | 7.4 | Oct 26 | Weak PBKDF2 parameters for password-encrypted private-key export in jose |
| CVE-2026-57187 New | AS asterisk asterisk | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing |
| CVE-2026-115924 New | RE rembg danielgatis | 8.6 | Oct 26 | Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs |
| CVE-2014-125135 New | OC OctoPrint Octoprint | 7.3 | Oct 26 | OctoPrint Flask Secret Key hard-coded key |
| CVE-2026-33521 New | AS ArcGIS Server Esri | 7.5 | Oct 26 | BUG-000186514 - ArcGIS Server has a security vulnerability. |
| CVE-2026-105626 New | CO Consul HashiCorp | 7.5 | Oct 26 | Consul vulnerable to a denial of service in HTTP APIs |
| CVE-2026-105608 New | CO Consul HashiCorp | 8.8 | Oct 26 | Consul vulnerable to an authorization bypass in service mesh registration |
| CVE-2026-105765 New | CO Consul HashiCorp | 7.5 | Oct 26 | Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API |
| CVE-2026-72758 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator may exit on malformed ranges |
| CVE-2026-72756 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator exits on malformed rsync URIs |
| CVE-2026-72754 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator exits when parsing an incorrect or very large CRL file |
| CVE-2026-72753 New | RO Routinator NLnet Labs | 8.2 | Oct 26 | Routinator incorrectly handles delta updates |
| CVE-2026-115912 New | VL vllm vllm-project | 8.8 | Oct 26 | vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |