Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.3 CRITICAL
CVE-2026-100133 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may b…

magento_open_source commerce commerce_b2b | Remote | Cross-Site Scripting
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
5.3 MEDIUM
CVE-2026-95502 — Git Sync memory exhaustion via a malicious Git server

A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploi…

grafana | Remote | Denial of Service
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
6.3 MEDIUM
CVE-2026-93294 — Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager…

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended p…

grafana | Remote | Authorization
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
9.0 CRITICAL
CVE-2026-92892 — Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution, under specific configurations.

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
9.1 CRITICAL
CVE-2026-52394 — DeepSeek Incorrect Access Control

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

Remote | Authorization
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
9.8 CRITICAL
CVE-2026-37107 — HTMLy Privilege Escalation

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component

Remote | Authentication
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
6.5 MEDIUM
CVE-2026-33374 — Unbounded memory allocation in the Prometheus rule conversion API

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-m…

grafana | Remote | Denial of Service
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
7.2 HIGH
CVE-2026-23707 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
6.5 MEDIUM
CVE-2026-23706 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
7.2 HIGH
CVE-2026-23705 — Fortinet FortiAnalyzer and FortiManager SQL Injection Vulnerability

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

Oct 13, 2026 Oct 14, 2026
Oct 13, 2026
Oct 14, 2026
6.5 MEDIUM
CVE-2026-15577 — Git Sync connection configuration can be modified with read-only access

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.…

grafana | Remote | Authorization
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108385 — dataclasses-avroschema enum symbols can inject statements through generated member names

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108384 — dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bar…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Injection
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108383 — dataclasses-avroschema enum field defaults can inject statements into generated modules

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldReprese…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108382 — dataclasses-avroschema allows code injection through generated enum-symbol string literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresen…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108381 — dataclasses-avroschema pydantic-class metadata allows code injection in generated annotat…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108380 — dataclasses-avroschema field documentation allows code injection in generated Pydantic de…

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFiel…

Remote | Supply Chain
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108379 — dataclasses-avroschema fixed namespaces allow code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerato…

Remote | Misconfiguration
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108378 — dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassReprese…

Remote | Information Disclosure
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
8.8 HIGH
CVE-2026-108377 — dataclasses-avroschema allows code injection through generated Meta.schema_name

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassReprese…

Remote | Injection
Oct 13, 2026 Oct 16, 2026
Oct 13, 2026
Oct 16, 2026
Showing 20 of 15145 Results