Automated cyber signal feeds.
CVE ID :CVE-2026-112051 Published : Oct. 18, 2026, 1:16 p.m. | 5 hours, 57 minutes ago Description :Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in…
CVE ID :CVE-2026-112021 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing…
CVE ID :CVE-2026-112001 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner’s credentials via PATCH Attackers…
CVE ID :CVE-2026-112005 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions…
CVE ID :CVE-2026-112006 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate…
CVE ID :CVE-2026-111927 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs…
CVE ID :CVE-2026-111924 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small,…
CVE ID :CVE-2026-111923 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send…
CVE ID :CVE-2026-111911 Published : Oct. 17, 2026, 6:46 p.m. | 19 minutes ago Description :phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage…
CVE ID :CVE-2026-111909 Published : Oct. 17, 2026, 6:46 p.m. | 19 minutes ago Description :phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can…