| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-42093 | Redash: SQL Injection via Query Results parameterized query substitution | getredash | redash | High | 8.7 | 2026-10-14 18:00:04 | Deep Dive |
| CVE-2026-109527 | Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies | modelcontextprotocol | python-sdk | High | 7.5 | 2026-10-14 17:52:36 | Deep Dive |
| CVE-2026-86849 | Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:16 | Deep Dive |
| CVE-2026-86856 | Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:15 | Deep Dive |
| CVE-2026-86847 | Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:13 | Deep Dive |
| CVE-2026-86846 | Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:08 | Deep Dive |
| CVE-2026-86845 | Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:07 | Deep Dive |
| CVE-2026-86566 | Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) | Red Hat | Fast Datapath for RHEL 10 | Medium | 6.5 | 2026-10-14 17:52:01 | Deep Dive |
| CVE-2026-88164 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Microsoft | Microsoft SharePoint Server Subscription Edition | High | 8.8 | 2026-10-14 17:50:08 | Deep Dive |
| CVE-2026-86848 | Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto | Red Hat | Fast Datapath for RHEL 10 | High | 8.8 | 2026-10-14 17:50:08 | Deep Dive |
| CVE-2026-86567 | Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap | Red Hat | Fast Datapath for RHEL 10 | High | 8.8 | 2026-10-14 17:50:03 | Deep Dive |
| CVE-2026-106465 | NetX Secure DTLS服务器存在绕过验证漏洞 | Eclipse Foundation | NetX Duo | High | 8.7 | 2026-10-14 17:47:11 | Deep Dive |
| CVE-2026-108395 | Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies | modelcontextprotocol | io.modelcontextprotocol.sdk:mcp | High | 7.5 | 2026-10-14 17:46:24 | Deep Dive |
| CVE-2026-106464 | VxWorks 库TLS空签名解析致越界 | Eclipse Foundation | NetX Duo | High | 8.7 | 2026-10-14 17:41:44 | Deep Dive |
| CVE-2026-103415 | TLS 1.3 客户端缓冲区溢出漏洞 | Eclipse Foundation | NetX Duo | Critical | 9.3 | 2026-10-14 17:36:18 | Deep Dive |
| CVE-2026-107350 | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer | - | PgBouncer | High | 8.8 | 2026-10-14 17:34:39 | Deep Dive |
| CVE-2026-107349 | Infinite loop on empty option name in startup options parameter in PgBouncer | - | PgBouncer | High | 7.5 | 2026-10-14 17:34:34 | Deep Dive |
| CVE-2026-107348 | Integer overflow causes an infinite loop in message buffer growth in PgBouncer | - | PgBouncer | Medium | 5.9 | 2026-10-14 17:34:30 | Deep Dive |
| CVE-2026-103414 | GUIX二进制资源加载器缓冲区溢出漏洞 | Eclipse Foundation | GUIX | High | 8.4 | 2026-10-14 17:32:12 | Deep Dive |
| CVE-2026-86461 | FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter | foliovision | FV Flowplayer Video Player | High | 8.8 | 2026-10-14 17:29:14 | Deep Dive |