Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.1 CRITICAL
CVE-2026-52394 — DeepSeek Incorrect Access Control

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

Remote | Authorization
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
9.8 CRITICAL
CVE-2026-37107 — HTMLy Privilege Escalation

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component

Remote | Authentication
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
6.5 MEDIUM
CVE-2026-33374 — Unbounded memory allocation in the Prometheus rule conversion API

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-m…

grafana | Remote | Denial of Service
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
7.2 HIGH
CVE-2026-23707 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
6.5 MEDIUM
CVE-2026-23706 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
7.2 HIGH
CVE-2026-23705 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
6.5 MEDIUM
CVE-2026-15577 — Git Sync connection configuration can be modified with read-only access

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.…

grafana | Remote | Authorization
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108385 — dataclasses-avroschema enum symbols can inject statements through generated member names

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108384 — dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bar…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Injection
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108383 — dataclasses-avroschema enum field defaults can inject statements into generated modules

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldReprese…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108382 — dataclasses-avroschema allows code injection through generated enum-symbol string literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresen…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108381 — dataclasses-avroschema pydantic-class metadata allows code injection in generated annotat…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108380 — dataclasses-avroschema field documentation allows code injection in generated Pydantic de…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFiel…

Remote | Supply Chain
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108379 — dataclasses-avroschema fixed namespaces allow code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108378 — dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassReprese…

Remote | Information Disclosure
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108377 — dataclasses-avroschema allows code injection through generated Meta.schema_name

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassReprese…

Remote | Injection
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108376 — dataclasses-avroschema allows code injection through record names in generated default fa…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldReprese…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108375 — dataclasses-avroschema allows code injection through generated field-default literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldReprese…

Remote | Information Disclosure
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
3.8 LOW
CVE-2026-106176 — Fortinet FortiSIEM Improper Authorization Vulnerability

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

fortisiem | Remote | Authorization
Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
2.3 LOW
CVE-2026-106175 — Fortinet FortiOS, FortiProxy, and FortiSwitch Double Free Vulnerability

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all ver…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
Showing 20 of 15147 Results