Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-63410 | Medium CVSS 5.9 |
- Operating systems & software |
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time… | 30 Oct 2026 |
| CVE-2026-63402 | Medium CVSS 5.9 |
- Operating systems & software |
i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js`… | 30 Oct 2026 |
| CVE-2026-63401 | Medium CVSS 5.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and… | 30 Oct 2026 |
| CVE-2026-63400 | Low CVSS 2.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the… | 30 Oct 2026 |
| CVE-2026-63399 | Medium CVSS 6.9 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg`… | 30 Oct 2026 |
| CVE-2026-63398 | High CVSS 7.4 |
- Identity & access |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback… | 30 Oct 2026 |
| CVE-2026-63396 | High CVSS 8.7 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query… | 30 Oct 2026 |
| CVE-2026-63393 | High CVSS 8.7 |
- Applications & supply chain |
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0… | 30 Oct 2026 |
| CVE-2026-63378 | High CVSS 8.8 |
- Identity & access |
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural… | 30 Oct 2026 |
| CVE-2026-63377 | Critical CVSS 9.8 |
- Identity & access |
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural… | 30 Oct 2026 |
| CVE-2026-63346 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter… | 30 Oct 2026 |
| CVE-2026-63345 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object… | 30 Oct 2026 |
| CVE-2026-63344 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in… | 30 Oct 2026 |
| CVE-2026-63341 | High CVSS 7.5 |
- Operating systems & software |
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth… | 30 Oct 2026 |
| CVE-2026-63339 | High CVSS 8.8 |
- Applications & supply chain |
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an… | 30 Oct 2026 |
| CVE-2026-63338 | High CVSS 8.3 |
- Applications & supply chain |
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an… | 30 Oct 2026 |
| CVE-2026-61725 | Medium CVSS 6.1 |
- Operating systems & software |
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z… | 30 Oct 2026 |
| CVE-2026-111477 | Not yet scored | - Operating systems & software |
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 30 Oct 2026 |
| CVE-2026-63224 | High CVSS 7.2 |
- Applications & supply chain |
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV… | 30 Oct 2026 |
| CVE-2026-63201 | High CVSS 7.1 |
- Operating systems & software |
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected… | 30 Oct 2026 |
| CVE-2026-63184 | High CVSS 7.1 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet… | 30 Oct 2026 |
| CVE-2026-63182 | High CVSS 8.1 |
- Identity & access |
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate… | 30 Oct 2026 |
| CVE-2026-63121 | Medium CVSS 6.3 |
- Cloud & SaaS |
Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For… | 30 Oct 2026 |
| CVE-2026-63115 | Medium CVSS 5.3 |
- Operating systems & software |
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo`… | 30 Oct 2026 |
| CVE-2026-62347 | Medium CVSS 5.9 |
- Operating systems & software |
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.