Channel
@cvefeed
On this record: Topic · Growth · Engagement · Posts · Cite this entry
1,185subscribers
+206 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of 1,000–3,162.
| Telegram ID | -1002021962091 |
|---|---|
| Type | Channel |
| Username | @cvefeed |
| Created | Between 1 November 2023 and 31 May 2024 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 8 August 2026 |
| Last confirmed live | 1 November 2026 |
| Measurements held | 19 |
| Confirmed unchanged | 1 time, most recently 1 November 2026 |
| On Telegram | t.me/cvefeed |
Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 19 September 2026 and assigned it the closest of 31 fixed categories, at 93% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and the other topics.
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 1 Nov 2026, 14:34 | 1,185 | +14 |
| 29 Oct 2026, 20:46 | 1,171 | +7 |
| 26 Oct 2026, 11:36 | 1,164 | +14 |
| 23 Oct 2026, 20:05 | 1,150 | +98 |
| 21 Oct 2026, 03:09 | 1,052 | +2 |
| 18 Oct 2026, 01:46 | 1,050 | +4 |
| 14 Oct 2026, 20:36 | 1,046 | +9 |
| 11 Oct 2026, 10:18 | 1,037 | +12 |
| 4 Oct 2026, 17:02 | 1,025 | +3 |
| 24 Sept 2026, 21:16 | 1,022 | +12 |
| 16 Sept 2026, 13:59 | 1,010 | -3 |
| 12 Sept 2026, 18:22 | 1,013 | +9 |
| 8 Sept 2026, 22:36 | 1,004 | +10 |
| 31 Aug 2026, 13:17 | 994 | +1 |
| 24 Aug 2026, 11:54 | 993 | +4 |
| 16 Aug 2026, 19:58 | 989 | +9 |
| 8 Aug 2026, 10:26 | 980 | +1 |
| 8 Aug 2026, 00:45 | 979 | no change |
| 7 Aug 2026, 20:43 | 979 | first reading |
20 posts held, back to 7 August 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 20 posts for this entry, the most recent from 7 August 2026. An engagement rate over an empty window would be a number about nothing.
🚨 CVE-2026-48122 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vsc…
🚨 CVE-2026-52880 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTime…
🚨 CVE-2026-52878 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is…
🚨 CVE-2026-52879 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of c…
🚨 CVE-2026-48026 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository bran…
🚨 CVE-2026-48120 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to …
🚨 CVE-2025-4438 📢 Source: GitLab 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False None 📅 Published Date: 2026-08-07T22:19:35.146Z https://cvefeed.io/vuln/detail/CVE-2025-4438
🚨 CVE-2026-47249 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash …
🚨 CVE-2026-48047 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the co…
🚨 CVE-2026-49343 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserve…
🚨 CVE-2026-58262 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so …
🚨 CVE-2026-47243 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --san…
Showing the 12 most recent of 20 posts we hold for @cvefeed. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 1 November 2026 — this entry's latest reading, not the date you are reading this.
“CVE & Vulnerability RSS Feed” (@cvefeed), 1,185 subscribers as measured 1 November 2026. Telegram Register, tgregister.com/channel/cvefeed.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.