Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-78402 | High CVSS 7.3 |
- Operating systems & software |
Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows… | 30 Oct 2026 |
| CVE-2026-62334 | High CVSS 8.7 |
- Operating systems & software |
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x… | 30 Oct 2026 |
| CVE-2026-62333 | High CVSS 8.7 |
- Operating systems & software |
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x… | 30 Oct 2026 |
| CVE-2026-62302 | High CVSS 8.7 |
- Cloud & SaaS |
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls… | 30 Oct 2026 |
| CVE-2026-62301 | High CVSS 7.1 |
- Applications & supply chain |
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video… | 30 Oct 2026 |
| CVE-2026-62284 | High CVSS 8.6 |
- Cloud & SaaS |
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy`… | 30 Oct 2026 |
| CVE-2026-119337 | High CVSS 7.1 |
- Applications & supply chain |
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST… | 30 Oct 2026 |
| CVE-2026-119336 | High CVSS 7.8 |
- Network & security devices |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.… | 30 Oct 2026 |
| CVE-2026-119335 | High CVSS 7.8 |
- Network & security devices |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.… | 30 Oct 2026 |
| CVE-2026-119333 | High CVSS 7.8 |
- Operating systems & software |
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched… | 30 Oct 2026 |
| CVE-2026-119332 | High CVSS 8.8 |
- Operating systems & software |
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964,… | 30 Oct 2026 |
| CVE-2026-119331 | High CVSS 7.1 |
- Operating systems & software |
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit,… | 30 Oct 2026 |
| CVE-2026-116252 | High CVSS 7.1 |
- Operating systems & software |
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq… | 30 Oct 2026 |
| CVE-2026-116250 | High CVSS 7.3 |
- Operating systems & software |
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with… | 30 Oct 2026 |
| CVE-2026-116249 | High CVSS 7.2 |
- Identity & access |
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file… | 30 Oct 2026 |
| CVE-2026-116247 | High CVSS 7.1 |
- Operating systems & software |
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one… | 30 Oct 2026 |
| CVE-2026-116246 | High CVSS 7.0 |
- Operating systems & software |
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager… | 30 Oct 2026 |
| CVE-2026-116245 | High CVSS 7.1 |
- Operating systems & software |
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an… | 30 Oct 2026 |
| CVE-2026-116244 | High CVSS 7.1 |
- Identity & access |
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME… | 30 Oct 2026 |
| CVE-2026-116243 | High CVSS 7.7 |
- Operating systems & software |
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In… | 30 Oct 2026 |
| CVE-2026-116242 | High CVSS 7.1 |
- Identity & access |
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,… | 30 Oct 2026 |
| CVE-2026-116240 | High CVSS 7.1 |
- Operating systems & software |
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which… | 30 Oct 2026 |
| CVE-2026-116239 | High CVSS 8.9 |
- Identity & access |
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example,… | 30 Oct 2026 |
| CVE-2026-115830 | High CVSS 8.7 |
- Cloud & SaaS |
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and… | 30 Oct 2026 |
| CVE-2026-115829 | High CVSS 8.7 |
- Operating systems & software |
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.