Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.7 HIGH
CVE-2026-116591 — compress zstd: Panic on two-block frames

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normaliz…

Remote | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
5.9 MEDIUM
CVE-2026-116590 — snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.r…

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffs…

snappy-java | Remote | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
8.2 HIGH
CVE-2026-116589 — Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string fo…

Remote | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
8.7 HIGH
CVE-2026-116588 — Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronousl…

Remote | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
7.5 HIGH
CVE-2026-116587 — Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Toke…

go-jose | Remote | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
6.9 MEDIUM
CVE-2026-116586 — Go JOSE: Panics in JSON parsing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Toke…

go-jose | Remote | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
6.9 MEDIUM
CVE-2026-116585 — Go JOSE: Panic during CBC-HMAC processing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Toke…

go-jose | Remote | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
6.5 MEDIUM
CVE-2026-116515 — itsourcecode Online Book Store book.php sql injection

A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql…

online_book_store | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
5.0 MEDIUM
CVE-2026-116514 — itsourcecode Airline Reservation System book_flight.php cross site scripting

A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cros…

airline_reservation_system | Remote | Cross-Site Scripting
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
10.0 CRITICAL
CVE-2026-116508 — TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Perf…

a950rg_firmware a950rg a950rg | Remote | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
5.5 MEDIUM
CVE-2026-116507 — TOTOLINK A950RG global.so getLanguageCfg information disclosure

A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token …

a950rg_firmware a950rg a950rg | Remote | Information Disclosure
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86992 — Apple Video Processing Memory Corruption Vulnerability

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2,…

macos iphone_os tvos watchos ipados macos +2 more | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86991 — Apple Operating Systems Buffer Overflow Vulnerability

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe…

macos iphone_os ipados macos visionos | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86990 — Apple iOS/iPadOS/macOS/visionOS Camera Access Authorization Bypass

An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2,…

macos iphone_os ipados macos visionos | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86989 — Apple iOS and iPadOS Authorization Bypass Vulnerability

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.

iphone_os ipados | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86988 — Apple Image Processing Memory Disclosure

The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image m…

macos iphone_os tvos watchos ipados macos +2 more | Information Disclosure
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86987 — Apple iOS and iPadOS Authorization Bypass Vulnerability

An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access sensitive user data.

iphone_os ipados | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86986 — Apple Safari Use-After-Free Vulnerability

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2…

macos iphone_os safari ipados safari macos +1 more | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86985 — Apple WebKit Input Validation Denial of Service

This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing mali…

macos iphone_os tvos safari ipados safari +1 more | Denial of Service
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
0.0 NA
CVE-2026-86984 — Apple macOS Contact Information Unauthorized Access Vulnerability

A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7…

macos macos | Path Traversal
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
Showing 20 of 16238 Results