CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:18 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86929 New | MA macOS Apple | 8.8 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-112637 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112457 New | MA macOS Apple | 7.1 | Oct 26 | A double free issue was addressed with improved memory management |
| CVE-2026-116581 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) |
| CVE-2026-112427 New | MA macOS Apple | 8.1 | Oct 26 | An authentication issue was addressed with improved state management |
| CVE-2026-112688 New | MA macOS Apple | 8.8 | Oct 26 | A memory corruption issue was addressed with improved memory handling |
| CVE-2026-112626 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112651 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112484 New | MA macOS Apple | 7.8 | Oct 26 | This issue was addressed with improved file handling |
| CVE-2026-86916 New | MA macOS Apple | 7.8 | Oct 26 | A use after free issue was addressed with improved memory management |
| CVE-2026-116580 New | SE seroval lxsmnsyc | 7.3 | Oct 26 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check |
| CVE-2026-113947 New | MA macOS Apple | 8.8 | Oct 26 | This issue was addressed with improved access restrictions |
| CVE-2026-112655 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112659 New | MA macOS Apple | 8.8 | Oct 26 | A type confusion issue was addressed with improved memory handling |
| CVE-2025-13833 New | SE SecureConnector Forescout Technologies | 7.7 | Oct 26 | Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution |
| CVE-2026-112623 New | MA macOS Apple | 8.8 | Oct 26 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-112438 New | MA macOS Apple | 8.8 | Oct 26 | A logic issue was addressed with improved state management |
| CVE-2026-64759 New | MA macOS Apple | 8.8 | Oct 26 | An integer overflow was addressed with improved input validation |
| CVE-2026-116576 New | SY systeminformation sebhildebrandt | 7.8 | Oct 26 | systeminformation: Windows command injection in services() through Unicode quotation marks |
| CVE-2026-65629 New | JO jose potatosalad | 7.4 | Oct 26 | Weak PBKDF2 parameters for password-encrypted private-key export in jose |
| CVE-2026-57187 New | AS asterisk asterisk | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing |
| CVE-2026-115924 New | RE rembg danielgatis | 8.6 | Oct 26 | Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs |
| CVE-2014-125135 New | OC OctoPrint Octoprint | 7.3 | Oct 26 | OctoPrint Flask Secret Key hard-coded key |
| CVE-2026-33521 New | AS ArcGIS Server Esri | 7.5 | Oct 26 | BUG-000186514 - ArcGIS Server has a security vulnerability. |
| CVE-2026-105626 New | CO Consul HashiCorp | 7.5 | Oct 26 | Consul vulnerable to a denial of service in HTTP APIs |
| CVE-2026-105608 New | CO Consul HashiCorp | 8.8 | Oct 26 | Consul vulnerable to an authorization bypass in service mesh registration |
| CVE-2026-105765 New | CO Consul HashiCorp | 7.5 | Oct 26 | Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API |
| CVE-2026-72758 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator may exit on malformed ranges |
| CVE-2026-72756 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator exits on malformed rsync URIs |
| CVE-2026-72754 New | RO Routinator NLnet Labs | 7.5 | Oct 26 | Routinator exits when parsing an incorrect or very large CRL file |
| CVE-2026-72753 New | RO Routinator NLnet Labs | 8.2 | Oct 26 | Routinator incorrectly handles delta updates |
| CVE-2026-115912 New | VL vllm vllm-project | 8.8 | Oct 26 | vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |
| CVE-2026-116612 New | GS gst-editing-services GStreamer project | 7.8 | Oct 26 | A flaw was found in GStreamer Editing Services (gst-editing-services) |
| CVE-2026-115418 New | AW aws-cdk/aws-redshift-alpha AWS | 7.3 | Oct 26 | SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha |
| CVE-2026-115909 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction |
| CVE-2026-115908 New | ZI zip2 zip-rs | 7.4 | Oct 26 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) |
| CVE-2026-115907 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size |
| CVE-2026-71456 New | KE Kantech Entrapass Johnson Controls | 8.5 | Oct 26 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack |
| CVE-2026-81038 New | ZE zephyr zephyrproject | 7.1 | Oct 26 | Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses |
| CVE-2026-112343 New | SS Syncplify Server! Syncplify, Inc. | 8.1 | Oct 26 | Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing |
| CVE-2026-116368 New | HA Harness DeepSeek | 7.3 | Oct 26 | DeepSeek Harness Browser Auth browser-auth.ts improper authorization |
| CVE-2026-115748 New | AV Apache Vysper Apache Software Foundation | 8.8 | Oct 26 | Apache Vysper: Authorization bypass |
| CVE-2026-115721 New | AV Apache Vysper Apache Software Foundation | 7.5 | Oct 26 | Apache Vysper: Unbounded allocation |
| CVE-2026-116543 New | OP open5gs open5gs | 7.5 | Oct 26 | Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser |
| CVE-2026-116489 New | PG pgvectorscale timescale | 7.5 | Oct 26 | Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes |
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-90885 New | AC Apache Camel Apache Software Foundation | 7.5 | Oct 26 | Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved |
| CVE-2026-77059 New | BO boneIO boneIO | 8.8 | Oct 26 | TOCTOU Race Condition in boneIO |
| CVE-2026-77056 New | BL black_debian_images boneIO | 7.1 | Oct 26 | Use of Default Credentials in boneIO |
| CVE-2026-77053 New | BO boneIO boneIO | 8.7 | Oct 26 | Missing Authentication in Default Configuration in boneIO |