Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 309new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-78191 | Not yet scored | - Operating systems & software |
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne… | 31 Oct 2026 |
| CVE-2026-78190 | Not yet scored | - Operating systems & software |
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values,… | 31 Oct 2026 |
| CVE-2026-78188 | Not yet scored | - Operating systems & software |
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite… | 31 Oct 2026 |
| CVE-2026-120194 | High CVSS 7.5 |
- Operating systems & software |
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when… | 31 Oct 2026 |
| CVE-2026-118598 | Medium CVSS 6.5 |
- Operating systems & software |
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the… | 31 Oct 2026 |
| CVE-2026-117681 | High CVSS 8.0 |
- Operating systems & software |
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy… | 31 Oct 2026 |
| CVE-2026-116964 | High CVSS 8.4 |
- Operating systems & software |
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within… | 31 Oct 2026 |
| CVE-2026-116755 | High CVSS 7.4 |
- Operating systems & software |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of… | 31 Oct 2026 |
| CVE-2026-110176 | High CVSS 8.7 |
- Operating systems & software |
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a… | 31 Oct 2026 |
| CVE-2026-77152 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field… | 31 Oct 2026 |
| CVE-2026-117656 | Critical CVSS 9.3 |
- Operating systems & software |
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth… | 31 Oct 2026 |
| CVE-2026-63410 | Medium CVSS 5.9 |
- Operating systems & software |
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time… | 30 Oct 2026 |
| CVE-2026-63402 | Medium CVSS 5.9 |
- Operating systems & software |
i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js`… | 30 Oct 2026 |
| CVE-2026-63341 | High CVSS 7.5 |
- Operating systems & software |
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth… | 30 Oct 2026 |
| CVE-2026-61725 | Medium CVSS 6.1 |
- Operating systems & software |
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z… | 30 Oct 2026 |
| CVE-2026-111477 | Not yet scored | - Operating systems & software |
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 30 Oct 2026 |
| CVE-2026-63201 | High CVSS 7.1 |
- Operating systems & software |
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected… | 30 Oct 2026 |
| CVE-2026-63115 | Medium CVSS 5.3 |
- Operating systems & software |
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo`… | 30 Oct 2026 |
| CVE-2026-62347 | Medium CVSS 5.9 |
- Operating systems & software |
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call… | 30 Oct 2026 |
| CVE-2026-55614 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases… | 30 Oct 2026 |
| CVE-2026-55613 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize… | 30 Oct 2026 |
| CVE-2026-55612 | Low CVSS 3.7 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an… | 30 Oct 2026 |
| CVE-2026-118938 | High CVSS 8.8 |
- Operating systems & software |
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example… | 30 Oct 2026 |
| CVE-2026-62968 | High CVSS 8.7 |
- Operating systems & software |
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled… | 30 Oct 2026 |
| CVE-2026-62958 | High CVSS 7.9 |
- Operating systems & software |
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.