CVE Alerts

cvefeed.ioCVE-2026-115522 - Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for PythonExposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root …

18m

CVE-2026-115522 - Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python CVE ID : CVE-2026-115522 Published : Oct. 28, 2026, 4:36 a.m. | 49 minutes ago Description : Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactSe...

cvefeed.ioCVE-2026-104384 - Insufficiently protected credentials in EagleCloud Aquila on-premises versionInsufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets

20m

CVE-2026-104384 - Insufficiently protected credentials in EagleCloud Aquila on-premises version CVE ID : CVE-2026-104384 Published : Oct. 28, 2026, 4:21 a.m. | 1 hour, 4 minutes ago Description : Insufficiently Protected Credentials in tunnel gateway and provisioning int...

cvefeed.ioCVE-2026-104383 - Code injection in EagleCloud Aquila on-premises versionImproper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection

26m

CVE-2026-104383 - Code injection in EagleCloud Aquila on-premises version CVE ID : CVE-2026-104383 Published : Oct. 28, 2026, 4:21 a.m. | 1 hour, 4 minutes ago Description : Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions throug...

cvefeed.ioCVE-2026-99100 - wifi: p54: validate firmware record lengthsIn the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate …

32m

CVE-2026-99100 - wifi: p54: validate firmware record lengths CVE ID : CVE-2026-99100 Published : Oct. 28, 2026, 4:18 a.m. | 1 hour, 7 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record length...

cvefeed.ioCVE-2026-1928 - Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code ExecutionThe Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and …

38m

CVE-2026-1928 - Rank Math SEO CVE ID : CVE-2026-1928 Published : Oct. 28, 2026, 4:18 a.m. | 1 hour, 7 minutes ago Description : The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and...

cvefeed.ioCVE-2026-106013 - Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier ParameterThe Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign …

CVE-2026-106013 - Jupiter X Core CVE ID : CVE-2026-106013 Published : Oct. 28, 2026, 1:30 a.m. | 53 minutes ago Description : The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and i...

cvefeed.ioCVE-2026-104895 - jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceThe asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value >> 25) …

CVE-2026-104895 - jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service CVE ID : CVE-2026-104895 Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 8 minutes ago Description : The asynchronou...

cvefeed.ioCVE-2026-118129 - jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authenticationA vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public …

CVE-2026-118129 - jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication CVE ID : CVE-2026-118129 Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 8 minutes ago Description : A vulnerability was found in jeremyckahn Chitchatter up t...

cvefeed.ioCVE-2026-104016 - jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len)

CVE-2026-104016 - jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError CVE ID : CVE-2026-104016 Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 8 minutes ago Description : ProtobufParser parses...

cvefeed.ioCVE-2026-110879 - jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. …

CVE-2026-110879 - jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) CVE ID : CVE-2026-110879 Published : Oct. 28, 2026, 12:07 a.m. | 1 hour, 17 minute...

cvefeed.ioCVE-2026-110747 - jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len)

CVE-2026-110747 - jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload CVE ID : CVE-2026-110747 Published : Oct. 28, 2026, 12:02 a.m. | 1 hour, 22 minutes ago Description : ProtobufParser._readStr...

cvefeed.ioCVE-2026-85898 - Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-85898 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE ID : CVE-2026-85898 Published : Oct. 27, 2026, 9:19 p.m. | 1 hour, 4 minutes ago Description : Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromi...

cvefeed.ioCVE-2026-83831 - Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityDouble free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-83831 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE ID : CVE-2026-83831 Published : Oct. 27, 2026, 9:19 p.m. | 1 hour, 4 minutes ago Description : Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execu...

cvefeed.ioCVE-2026-116692 - MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module …

CVE-2026-116692 - MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules CVE ID : CVE-2026-116692 Published : Oct. 27, 2026, 9:18 p.m. | 1 hour, 6 minutes ago Description : MLflow is...

cvefeed.ioCVE-2026-116693 - dd-trace: ReDOS in URL query string obfuscationdd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the …

CVE-2026-116693 - dd-trace: ReDOS in URL query string obfuscation CVE ID : CVE-2026-116693 Published : Oct. 27, 2026, 9:18 p.m. | 1 hour, 6 minutes ago Description : dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE...

cvefeed.ioCVE-2026-57200 - Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCEAsterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` …

CVE-2026-57200 - Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE CVE ID : CVE-2026-57200 Published : Oct. 27, 2026, 9:13 p.m. | 10 minutes ago Description : Asterisk is an open source private branch exchange and te...

cvefeed.ioCVE-2026-57195 - Asterisk: NULL Pointer Dereference in HTTP AMI Digest AuthenticationAsterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an unauthenticated attacker to crash Asterisk when `Digest Authentication` is used via `HTTP`. The Asterisk …

CVE-2026-57195 - Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication CVE ID : CVE-2026-57195 Published : Oct. 27, 2026, 9:04 p.m. | 19 minutes ago Description : Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 2...

cvefeed.ioCVE-2026-39928 - Rejected reason: This CVE ID has been rejected or Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-39928 CVE ID : CVE-2026-39928 Published : Oct. 27, 2026, 8:58 p.m. | 24 minutes ago Description : None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... #CVE

cvefeed.ioCVE-2026-116682 - FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directoryFileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable …

11h

CVE-2026-116682 - FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory CVE ID : CVE-2026-116682 Published : Oct. 27, 2026, 5:48 p.m. | 13 minutes ago Description : FileBrowser Quantum is a free, self-hosted, ...

cvefeed.ioCVE-2026-117526 - reduxjs redux-devtools Remotedev Server evalAction code injectionA vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The …

11h

CVE-2026-117526 - reduxjs redux-devtools Remotedev Server evalAction code injection CVE ID : CVE-2026-117526 Published : Oct. 27, 2026, 5:45 p.m. | 16 minutes ago Description : A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is t...

cvefeed.ioCVE-2026-116680 - Homebox generic notifier SSRF via HTTP redirect after URL validationHomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted …

11h

CVE-2026-116680 - Homebox generic notifier SSRF via HTTP redirect after URL validation CVE ID : CVE-2026-116680 Published : Oct. 27, 2026, 5:43 p.m. | 18 minutes ago Description : HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox valid...

cvefeed.ioCVE-2026-88812 - X.Org Server XKB SetGeometry TextDoodad Double FreeA double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

12h

CVE-2026-88812 - X.Org Server XKB SetGeometry TextDoodad Double Free CVE ID : CVE-2026-88812 Published : Oct. 27, 2026, 5:43 p.m. | 18 minutes ago Description : A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by...

cvefeed.ioCVE-2026-102816 - Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or …

12h

CVE-2026-102816 - Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 CVE ID : CVE-2026-102816 Published : Oct. 27, 2026, 5:41 p.m. | 20 minutes ago Description : An authorization vulnerability exists in the country or region configuration interface...

cvefeed.ioCVE-2026-117602 - Electrum before 4.7.2 External Plugin Authorization Bypass Local Code ExecutionElectrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code …

CVE-2026-117602 - Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution CVE ID : CVE-2026-117602 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago Description : Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plug...

cvefeed.ioCVE-2026-117603 - Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit BypassElectrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are …

CVE-2026-117603 - Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass CVE ID : CVE-2026-117603 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago Description : Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr W...

cvefeed.ioCVE-2026-117569 - Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool ParametersKali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP …

CVE-2026-117569 - Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters CVE ID : CVE-2026-117569 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago Description : Kali-GPT through commit a608c74 contains an OS command injection vulnerabili...

cvefeed.ioCVE-2026-117573 - hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Toolshagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute …

CVE-2026-117573 - hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools CVE ID : CVE-2026-117573 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago Description : hagent through commit 761eec6 contains an OS command injection vulnerability t...

cvefeed.ioCVE-2026-117601 - Electrum before 4.8.3 Missing Signature Verification of Mempool TransactionsElectrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

CVE-2026-117601 - Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions CVE ID : CVE-2026-117601 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago Description : Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirm...

cvefeed.ioCVE-2026-90725 - Dell PowerProtect Data Domain, Feature Release verDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of …

CVE-2026-90725 - Dell PowerProtect Data Domain, Feature Release ver CVE ID : CVE-2026-90725 Published : Oct. 27, 2026, 1:47 p.m. | 14 minutes ago Description : Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 ...

cvefeed.ioCVE-2026-117503 - a2aproject a2a-go REST SSE handler rest.go resource consumptionA vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: …

CVE-2026-117503 - a2aproject a2a-go REST SSE handler rest.go resource consumption CVE ID : CVE-2026-117503 Published : Oct. 27, 2026, 1:45 p.m. | 16 minutes ago Description : A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function...

cvefeed.ioCVE-2026-68866 - PowerProtect Data Domain, Feature Release versionsPowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to …

CVE-2026-68866 - PowerProtect Data Domain, Feature Release versions CVE ID : CVE-2026-68866 Published : Oct. 27, 2026, 1:43 p.m. | 18 minutes ago Description : PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 throu...

cvefeed.ioCVE-2026-90726 - Dell PowerProtect Data Domain, Feature Release verDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

CVE-2026-90726 - Dell PowerProtect Data Domain, Feature Release ver CVE ID : CVE-2026-90726 Published : Oct. 27, 2026, 1:37 p.m. | 24 minutes ago Description : Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 ...

cvefeed.ioCVE-2026-90727 - Dell PowerProtect Data Domain, Feature Release verDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

CVE-2026-90727 - Dell PowerProtect Data Domain, Feature Release ver CVE ID : CVE-2026-90727 Published : Oct. 27, 2026, 1:33 p.m. | 28 minutes ago Description : Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 ...

cvefeed.ioCVE-2026-82117 - Authentication Bypass by Spoofing Vulnerability in HiRDBAuthentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function …

CVE-2026-82117 - Authentication Bypass by Spoofing Vulnerability in HiRDB CVE ID : CVE-2026-82117 Published : Oct. 27, 2026, 9:37 a.m. | 24 minutes ago Description : Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: fr...

cvefeed.ioCVE-2026-82116 - Missing Authentication for Critical Function Vulnerability in HiRDBMissing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional …

CVE-2026-82116 - Missing Authentication for Critical Function Vulnerability in HiRDB CVE ID : CVE-2026-82116 Published : Oct. 27, 2026, 9:37 a.m. | 24 minutes ago Description : Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRD...

cvefeed.ioCVE-2026-82118 - Stack-based Buffer Overflow Vulnerability in HiRDBStack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version …

CVE-2026-82118 - Stack-based Buffer Overflow Vulnerability in HiRDB CVE ID : CVE-2026-82118 Published : Oct. 27, 2026, 9:37 a.m. | 24 minutes ago Description : Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 be...

cvefeed.ioCVE-2026-82120 - Heap-based Buffer Overflow Vulnerability in HiRDBHeap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version …

CVE-2026-82120 - Heap-based Buffer Overflow Vulnerability in HiRDB CVE ID : CVE-2026-82120 Published : Oct. 27, 2026, 9:37 a.m. | 24 minutes ago Description : Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 befo...

cvefeed.ioCVE-2026-82119 - OS Command Injection Vulnerability in HiRDBOS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version …

20h

CVE-2026-82119 - OS Command Injection Vulnerability in HiRDB CVE ID : CVE-2026-82119 Published : Oct. 27, 2026, 9:37 a.m. | 24 minutes ago Description : OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01;...

cvefeed.ioCVE-2026-117471 - User-controlled Duo host permits authenticated SSRF in Psono ServerPsono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 …

CVE-2026-117471 - User-controlled Duo host permits authenticated SSRF in Psono Server CVE ID : CVE-2026-117471 Published : Oct. 27, 2026, 5:55 a.m. | 6 minutes ago Description : Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host wh...

cvefeed.ioCVE-2026-117470 - WebAuthn assertion replay permits second-factor bypass in Psono ServerPsono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the …

CVE-2026-117470 - WebAuthn assertion replay permits second-factor bypass in Psono Server CVE ID : CVE-2026-117470 Published : Oct. 27, 2026, 5:53 a.m. | 7 minutes ago Description : Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn ch...

cvefeed.ioCVE-2026-117469 - File-transfer type confusion permits unauthorized repository writes in Psono ServerPsono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and …

CVE-2026-117469 - File-transfer type confusion permits unauthorized repository writes in Psono Server CVE ID : CVE-2026-117469 Published : Oct. 27, 2026, 5:52 a.m. | 9 minutes ago Description : Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the d...

cvefeed.ioCVE-2026-117468 - Device-code claim permits restricted token escalation in Psono ServerPsono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, …

CVE-2026-117468 - Device-code claim permits restricted token escalation in Psono Server CVE ID : CVE-2026-117468 Published : Oct. 27, 2026, 5:41 a.m. | 20 minutes ago Description : Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce tok...

cvefeed.ioCVE-2026-111820 - Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page TitleThe Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …

CVE-2026-111820 - Analytics Insights CVE ID : CVE-2026-111820 Published : Oct. 27, 2026, 5:30 a.m. | 31 minutes ago Description : The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the P...

cvefeed.ioCVE-2026-116640 - Saruf-Ratul HR-Payroll-Management-System chat.php cross site scriptingA flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be …

CVE-2026-116640 - Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting CVE ID : CVE-2026-116640 Published : Oct. 27, 2026, 1:30 a.m. | 31 minutes ago Description : A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843...

cvefeed.ioCVE-2026-97028 - Rejected reason: Maintainers determined it is not Rejected reason: Maintainers determined it is not a vulnerability.

CVE-2026-97028 - Rejected reason: Maintainers determined it is not CVE ID : CVE-2026-97028 Published : Oct. 27, 2026, 1:19 a.m. | 42 minutes ago Description : Rejected reason: Maintainers determined it is not a vulnerability. Severity: 0.0 | NA Visit the link for m...

cvefeed.ioCVE-2026-116842 - DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dupDevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

CVE-2026-116842 - DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup CVE ID : CVE-2026-116842 Published : Oct. 27, 2026, 1:19 a.m. | 42 minutes ago Description : DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in th...

cvefeed.ioCVE-2026-116843 - Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree ModeMistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands …

CVE-2026-116843 - Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode CVE ID : CVE-2026-116843 Published : Oct. 27, 2026, 1:19 a.m. | 42 minutes ago Description : Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attac...

cvefeed.ioCVE-2026-116844 - Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT PFclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, …

CVE-2026-116844 - Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P CVE ID : CVE-2026-116844 Published : Oct. 27, 2026, 1:19 a.m. | 42 minutes ago Description : Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerabi...

cvefeed.ioCVE-2026-116591 - compress zstd: Panic on two-block framescompress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from …

CVE-2026-116591 - compress zstd: Panic on two-block frames CVE ID : CVE-2026-116591 Published : Oct. 26, 2026, 9:54 p.m. | 6 minutes ago Description : compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can pa...