Channel
@cvefeed
On this record: Growth · Engagement · Posts · Cite this entry
993subscribers
+14 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of Under 1,000.
| Telegram ID | -1002021962091 |
|---|---|
| Type | Channel |
| Username | @cvefeed |
| Created | Between 1 November 2023 and 31 May 2024— estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 8 August 2026 |
| Last confirmed live | 24 August 2026 |
| Measurements held | 5 |
| Confirmed unchanged | 1 time, most recently 24 August 2026 |
| On Telegram | t.me/cvefeed |
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 24 Aug 2026, 11:54 | 993 | +4 |
| 16 Aug 2026, 19:58 | 989 | +9 |
| 8 Aug 2026, 10:26 | 980 | +1 |
| 8 Aug 2026, 00:45 | 979 | no change |
| 7 Aug 2026, 20:43 | 979 | first reading |
20 posts held, back to 7 August 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 pageof Telegram’s post history, 20 posts per page.
ERR is average views per post over the last 30 days divided by subscribers, the definition TGStat uses, so this figure is comparable with the one you will see elsewhere. It falls structurally as a channel grows: a high ERR on a small channel and a low one on a large channel describe reach mathematics, not quality. We publish the figure and the sample it came from and pass no verdict on it.
ER is defined industry-wide as (forwards + reactions + comments) ÷ views— note the denominator is views, not subscribers. Telegram’s public web preview carries views and reactions but not forward or comment counts, so the reaction rate above is the reactions term only and is therefore a floor: the true ER for this channel is higher by an amount we have not measured and will not estimate.
| Window | Rolling 30 days · latest post in window 7 August 2026 |
|---|---|
| Posts held | 20 (7 August 2026 – 7 August 2026) |
| Views total | 120 |
| Reactions total | — |
| Forwards / comments | not exposed by the public surface — not measured, not estimated |
| Readings taken | 8 Aug 2026, 00:45 UTC |
Views are a single reading per post, taken at the time above. A post published in the last day or two is still accumulating views, which pulls the 30-day average down slightly. That is a property of the standard definition rather than a fault in it, so we keep the definition rather than “correcting” the number into something nobody can reproduce.
Precision. Telegram publishes view counts on its public widget in short form — 8.12K, 3.7M — so any reading at or above 1,000 reaches us rounded to three significant figures, and only counts below 1,000 are exact. Averages and rates derived from them are shown to the same precision rather than to the unit: a figure like 3,701,250 would assert digits nobody measured.
Reaction counts are published per emoji and rounded the same way, so a total below 1,000 is exact and a larger one is a sum that may carry a rounded component from each emoji above 1,000. Because it is a sum, it does not look rounded — read a large reaction total as three significant figures per contributing emoji rather than as the figure it prints.
🚨 CVE-2026-48122 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vsc…
🚨 CVE-2026-52880 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTime…
🚨 CVE-2026-52878 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is…
🚨 CVE-2026-52879 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of c…
🚨 CVE-2026-48026 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository bran…
🚨 CVE-2026-48120 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to …
🚨 CVE-2025-4438 📢 Source: GitLab 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False None 📅 Published Date: 2026-08-07T22:19:35.146Z https://cvefeed.io/vuln/detail/CVE-2025-4438
🚨 CVE-2026-47249 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash …
🚨 CVE-2026-48047 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the co…
🚨 CVE-2026-49343 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserve…
🚨 CVE-2026-58262 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so …
🚨 CVE-2026-47243 📢 Source: GitHub_M 💣 CVSS Score: 0.0 (NA) 📡 Remotely Exploitable: False Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --san…
Showing the 12 most recent of 20 posts we hold for @cvefeed. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 24 August 2026 — this entry's latest reading, not the date you are reading this.
“CVE & Vulnerability RSS Feed” (@cvefeed), 993 subscribers as measured 24 August 2026. Telegram Register, tgregister.com/channel/cvefeed.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.