Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

Type

Severity

Period

1,056 alerts · page 44 of 53

Critical (CVSS 9+) Published 2026-10-28 11:02 · updated 2026-10-30 20:18

CVE-2026-86397 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ver...

CriticalCVSS 9.8 EPSS 0.34%

Exploit status: No public exploit known

Affects: Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability...
Critical (CVSS 9+) Published 2026-10-28 10:50 · updated 2026-10-30 20:18

CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ver...

CriticalCVSS 9.8 EPSS 0.90%

Exploit status: No public exploit known

Affects: Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability...
Critical (CVSS 9+) Published 2026-10-28 10:42 · updated 2026-11-02 21:18

CVE-2026-90717 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, L...

CriticalCVSS 9.1 EPSS 0.23%

Exploit status: No public exploit known

Affects: Dell PowerProtect Data Domain Management Center

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypa...
Critical (CVSS 9+) Published 2026-10-28 08:45 · updated 2026-10-29 04:16

CVE-2026-109218 Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

CriticalCVSS 9.8 EPSS 0.64%

Exploit status: No public exploit known

Affects: Kleor Contact Manager, wordpress contact-manager

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the exte...
Critical (CVSS 9+) Published 2026-10-28 08:00

CVE-2026-103688 Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

CriticalCVSS 9.8 EPSS 0.61%

Exploit status: No public exploit known

Affects: wordpress checkout-files-upload-woocommerce

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including...
Critical (CVSS 9+) Published 2026-10-28 06:21 · updated 2026-11-05 19:17

CVE-2026-104383 Code injection in EagleCloud Aquila on-premises version

CriticalCVSS 9.4 EPSS 0.37%

Exploit status: No public exploit known

Affects: EagleCloud Aquila

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
Critical (CVSS 9+) Published 2026-10-28 05:55 · updated 2026-11-13 15:01

CVE-2026-99100 wifi: p54: validate firmware record lengths

CriticalCVSS 9.8 EPSS 0.17%

Exploit status: No public exploit known

Affects: azure linux kernel, redhat/kernel, redhat/kernel-rt and 8 more

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can ther...
Critical (CVSS 9+) Published 2026-10-28 04:29 · updated 2026-10-29 04:16

CVE-2026-84999 Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

CriticalCVSS 9.8 EPSS 0.48%

Exploit status: No public exploit known

Affects: Pie Register Premium, wordpress pie-register-premium

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_an...
Critical (CVSS 9+) Published 2026-10-28 04:03 · updated 2026-11-04 12:01

CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

CriticalCVSS 9.2 EPSS 0.37%

Exploit status: No public exploit known

Affects: redhat/firefox, ggml-org llama.cpp, debian/llama.cpp and 1 more

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB...
Critical (CVSS 9+) Published 2026-10-28 03:30 · updated 2026-10-29 04:16

CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

CriticalCVSS 9.8 EPSS 0.55%

Exploit status: No public exploit known

Affects: artbees Jupiter X Core, wordpress jupiterx-core

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_veri...
Critical (CVSS 9+) Published 2026-10-28 02:07 · updated 2026-11-07 11:47

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

CriticalCVSS 9.8 EPSS 1.2%

Exploit status: No public exploit known

Affects: com.fasterxml.jackson.core/jackson-databind, tools.jackson.core/jackson-databind, redhat/com.fasterxml.jackson.core/jackson-databind:2.21.8.redhat-00001 and 74 more

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added fo...
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118312 Chromium: CVE-2026-118312 Memory corruption in Paint

CriticalCVSS 9.6 EPSS 0.23%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118309 Chromium CVE-2026-118309: Incorrect reference resolution

CriticalCVSS 9.6 EPSS 0.25%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, debian/chromium, Google Chrome

Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118342 Chromium: CVE-2026-118342 Out of bounds write in Editing

CriticalCVSS 9.6 EPSS 0.30%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118310 Chromium: CVE-2026-118310 Improper input validation in Views

CriticalCVSS 9.6 EPSS 0.31%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118308 Chromium: CVE-2026-118308 Use after free in SVG

CriticalCVSS 9.6 EPSS 0.31%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118316 Chromium: CVE-2026-118316 Improper input validation in V8

CriticalCVSS 9.6 EPSS 0.30%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118332 Chromium: CVE-2026-118332 Improper input validation in Compositing

CriticalCVSS 9.6 EPSS 0.30%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118333 Chromium: CVE-2026-118333 Missing authorization in Video

CriticalCVSS 9.3 EPSS 0.25%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Critical (CVSS 9+) Published 2026-10-28 01:03 · updated 2026-11-06 00:00

CVE-2026-118355 Chromium: CVE-2026-118355 Improper input validation in Command

CriticalCVSS 9.6 EPSS 0.30%

Exploit status: No public exploit known

Affects: Microsoft edge chromium, Google Chrome, debian/chromium

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).