Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

183-69% vs 7-day avg of 599

2 critical, 65 high, 74 medium, 32 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	2.1	CVE-2026-95620	A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the... qtqt, qt QNetworkAccessManager	NVD	Oct 23 12:18 UTC
CVE-2026-95620A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the... Executive summary The advisory describes a use-after-free flaw in Qt's QNetworkAccessManager HTTP/2 support that lets a malicious or compromised HTTP/2 server crash a client application, affecting availability. The advisory text is truncated, so its severity rating is not stated in the text provided, and the page is a multi-product list that also covers Axivion Dashboard and Qt for MCUs issues. Fixes are available in Qt 6.11.3 and Qt 6.12.0 for the CVE-2026-95620 item. Technical summary The flaw is a use-after-free in the QNetworkAccessManager HTTP/2 client support of the Qt Network module, and the advisory text is cut off before its full description. Exploitation requires a malicious or compromised HTTP/2 server, and the stated impact is a crash of the client application, affecting availability. Affected versions are stated as From Qt 6.9.0 to Qt 6.11.2, and fixed versions are stated as Qt 6.11.3 and Qt 6.12.0. No workaround is stated, no CVSS score is stated, and no detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.qt.io/List_of_known_vulnerabilitie…ducts#CVE-2026-95620: Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Active CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green Affects qt qt qt QNetworkAccessManager NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.7	CVE-2026-16762	An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application... qtqt, Qt Core, qt QXmlStreamReader	NVD	Oct 23 09:17 UTC
CVE-2026-16762An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application... Executive summary The advisory is about CVE-2026-16762, a denial-of-service flaw in the Qt Core QXmlStreamReader XML parser that can make an application unresponsive when it parses a crafted XML document. The advisory describes the impact as limited to availability, with no data disclosure, data modification, or code execution, and it lists fixed versions of Qt for the affected branches. The text provided does not state a severity score, and the advisory's recommended action is to update to the fixed Qt versions. Technical summary The flaw is a denial-of-service issue caused by disproportionate CPU consumption while the QXmlStreamReader parser handles attacker-supplied XML. Exploitation needs no authentication, privileges, or user interaction beyond the application ingesting the input. Affected versions are stated as from Qt 4.3.0 to Qt 6.8.8 and from Qt 6.9.0 to Qt 6.11.1, with status before Qt 4.3.0 described as unknown. Fixed versions are Qt 6.8.9, Qt 6.11.2, and Qt 6.12.0. The advisory does not state a workaround, a CVSS score, or any detection guidance, and it does not say whether the issue is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.qt.io/List_of_known_vulnerabilitie…ducts#CVE-2026-16762: Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X Affects qt qt Qt Core qt QXmlStreamReader NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	4.0	CVE-2026-105923	A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. Apache, qt, Qt for MCUsqt, Apache Tomcat, Qt Quick, Qt SVG, Qt for MCUs, Axivion Dashboard	NVD	Oct 21 10:16 UTC
CVE-2026-105923A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. Executive summary The advisory describes a set of vulnerabilities in Qt and Qt for MCUs, along with several in the Axivion Dashboard, that are not all tied to the single CVE in the request. The most directly relevant entry, CVE-2026-105923, lets a specially crafted SVG file crash an application that uses the VectorImage QML type, which affects availability only. The advisory does not state a severity score, and the vendor's recommendation is to upgrade to the fixed Qt versions listed for each entry. Technical summary CVE-2026-105923 is an integer overflow leading to a null-pointer dereference in QTriangulator, reached through the VectorImage QML type when processing crafted SVG content. The advisory states the impact is a crash and loss of availability, and does not describe code execution. Affected versions are from Qt 6.8.0 to Qt 6.8.8 and from Qt 6.9.0 to Qt 6.11.2, with fixes in Qt 6.8.9, Qt 6.11.3 and Qt 6.12.0. The advisory does not state a CVSS score, an exploitation status, or a workaround for this entry, and it gives no detection guidance. The same document also lists Axivion Dashboard entries (CVE-2026-86350, CVE-2026-12593, CVE-2026-12379) with their own fixed versions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green Affects Apache qt Qt for MCUs Axivion qt Apache Tomcat Qt Quick Qt SVG Qt for MCUs Axivion Dashboard NIST National Vulnerability DatabasePublished Oct 21, 2026 10:16 UTC Read the advisory
	Medium	4.3	CVE-2026-101201	A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. qtqt	NVD	Oct 20 09:17 UTC
CVE-2026-101201A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. From the advisory A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Amber Affects qt qt NIST National Vulnerability DatabasePublished Oct 20, 2026 09:17 UTC Read the advisory
	High	7.1	CVE-2026-8168	Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack... qtqt	NVD	Oct 19 14:17 UTC
CVE-2026-8168Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack... From the advisory Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects qt qt NIST National Vulnerability DatabasePublished Oct 19, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-94370	A defect in the Qt for MCUs core string handling causes heap memory corruption qtQt for MCUs	NVD	Oct 14 06:17 UTC
CVE-2026-94370A defect in the Qt for MCUs core string handling causes heap memory corruption From the advisory A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:D/RE:M/U:X Affects qt Qt for MCUs NIST National Vulnerability DatabasePublished Oct 14, 2026 06:17 UTC Read the advisory
	Medium	6.6	CVE-2026-19395	In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value qtQt for MCUs	NVD	Oct 5 10:16 UTC
CVE-2026-19395In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value From the advisory In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects qt Qt for MCUs NIST National Vulnerability DatabasePublished Oct 5, 2026 10:16 UTC Read the advisory
	High	8.8	CVE-2026-95509	Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading. qtQt for MCUs	NVD	Sep 29 11:16 UTC
CVE-2026-95509Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading. From the advisory Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects qt Qt for MCUs NIST National Vulnerability DatabasePublished Sep 29, 2026 11:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects