CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater 13.10.2026 9.1
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions 13.10.2026 9.3
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 13.10.2026 10
CVE-2026-104192 DragonflyDB stream RDB deserialization double-free 13.10.2026 9.6
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 13.10.2026 9.8
CVE-2026-77099 CVFS Command Execution 13.10.2026 9.3
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 13.10.2026 9.3
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 13.10.2026 9.4
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch 13.10.2026 9.4
CVE-2026-65162 13.10.2026 10
CVE-2026-65173 13.10.2026 9.1
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflow 13.10.2026 9.4
CVE-2026-63350 13.10.2026 9.4
CVE-2026-63353 13.10.2026 9.4
CVE-2026-63354 13.10.2026 9.4
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection 13.10.2026 10
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow 13.10.2026 10
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection 13.10.2026 9.4
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification 13.10.2026 9.4
CVE-2026-109758 13.10.2026 9.3
CVE-2026-97229 Integer Overflow or Wraparound in GitLab 13.10.2026 10
CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints 13.10.2026 9.8
CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) 13.10.2026 9.9
CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) 13.10.2026 9.1
CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer 13.10.2026 9.9
CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python 13.10.2026 10
CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI 13.10.2026 9.9
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint 13.10.2026 9.2
CVE-2026-82101 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-82103 DataStage on Cloud Pak for Data Information Disclosure 13.10.2026 9.6
CVE-2026-82110 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials 12.10.2026 9.3
CVE-2026-90920 Maximo AI Service Code Injection 13.10.2026 9.8
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function 12.10.2026 9.2
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py 12.10.2026 9.3
CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder 12.10.2026 9.3
CVE-2026-109569 sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace 12.10.2026 9.3
CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle 12.10.2026 9.1
CVE-2026-108929 Netcore NR268 DDNS DDNSset.cgi execvp argument injection 12.10.2026 9.4
CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC 12.10.2026 9.2
CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass 12.10.2026 9.1
CVE-2026-109575 12.10.2026 9.8
CVE-2026-96012 IBM Db2 Mirror for i Privilege Escalation 13.10.2026 9.9
CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) 13.10.2026 9.1
CVE-2026-57118 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints 12.10.2026 9.8
CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations 12.10.2026 9.1
CVE-2026-108918 Edimax BR-6208AC formWlanMP command injection 12.10.2026 10
CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults 13.10.2026 9.9
CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade command injection 12.10.2026 10
CVE-2026-108915 Edimax BR-6208AC formWlanMP buffer overflow 12.10.2026 9.4
CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey buffer overflow 12.10.2026 9.4
CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authentication 12.10.2026 10
CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder 13.10.2026 9.2
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass 12.10.2026 9.3
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header 12.10.2026 9.2
CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion 12.10.2026 9.3
CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie 12.10.2026 9.2
CVE-2026-85955 Improper privilege management in Progress MarkLogic Server xdmp:eval-in 12.10.2026 9.9
CVE-2026-85956 Improper privilege management in Progress MarkLogic Server backup and restore operations 12.10.2026 9.6
CVE-2026-85947 Improper privilege management in Progress MarkLogic Server forest operations 12.10.2026 9.9
CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API 12.10.2026 9.9
CVE-2026-9191 Insufficient isolation of user-supplied code in Progress MarkLogic Server 12.10.2026 9.6
CVE-2026-109391 Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API 12.10.2026 9.2
CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout 12.10.2026 9.1
CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates 12.10.2026 9.2
CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields 12.10.2026 9.3
CVE-2026-109390 13.10.2026 9.8
CVE-2026-108895 Linksys E1700 setDMZ os command injection 13.10.2026 9.4
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection 12.10.2026 9.4
CVE-2026-108894 Linksys E1700 Static Route addStaticRoute os command injection 12.10.2026 9.4
CVE-2026-108892 Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow 12.10.2026 10
CVE-2026-108893 Linksys E1700 setVlan stack-based overflow 12.10.2026 9.4
CVE-2026-78357 Insufficient Session Revocation for JWT Authentication 12.10.2026 9.1
CVE-2026-93582 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication 12.10.2026 9.4
CVE-2026-108804 TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection 12.10.2026 10
CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key 11.10.2026 9.3
CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection 11.10.2026 10
CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose 11.10.2026 9.3
CVE-2026-108540 OpenSpug File Transfer transfer os command injection 11.10.2026 9.4
CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect 11.10.2026 9.3
CVE-2026-39801 WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-40800 WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-42696 WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability 13.10.2026 10
CVE-2026-42716 WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42718 WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42719 WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42723 WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62022 WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-62024 WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability 11.10.2026 9.9
CVE-2026-62025 WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability 11.10.2026 9
CVE-2026-62031 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-62032 WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability 11.10.2026 9.8
CVE-2026-62050 WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62051 WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62052 WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62053 WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62054 WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62076 WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62077 WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62086 WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62087 WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62090 WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62120 WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62123 WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62124 WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62125 WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62129 WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability 11.10.2026 9.9
CVE-2026-66482 WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66483 WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66563 WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66564 WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66565 WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66567 WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66568 WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66569 WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78529 WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78531 WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78533 WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78535 WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates 13.10.2026 9.3
CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability 11.10.2026 9.8
CVE-2026-106610 WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-104398 WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-105889 WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing 13.10.2026 9.2
CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates 10.10.2026 9.3
CVE-2026-104803 WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback 11.10.2026 9.8
CVE-2026-62045 WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62046 WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93927 WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93929 WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93930 WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93931 WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93932 WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93933 WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93934 WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93935 WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93936 WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93937 WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93938 WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93940 WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93941 WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93942 WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93943 WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93944 WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93945 WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter 11.10.2026 9.1
CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter 11.10.2026 9.8
CVE-2026-97670 Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field 11.10.2026 9.1
CVE-2026-104732 Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler 11.10.2026 9.8
CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter 11.10.2026 9.1
CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload 11.10.2026 9.8
CVE-2026-108474 12.10.2026 9.8
CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session 13.10.2026 9.1
CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session 13.10.2026 9.1
CVE-2026-108269 ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session 09.10.2026 9.1
CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session 09.10.2026 9.1
CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) 13.10.2026 9.1
CVE-2026-108265 enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session 13.10.2026 9.1
CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment 13.10.2026 9.3
CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 09.10.2026 9.9
CVE-2026-107845 Contao: Cross-site scripting in the comments bundle 09.10.2026 9.3
CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients 09.10.2026 9.3
CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking 09.10.2026 9.2
CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite 09.10.2026 9.4
CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow 11.10.2026 9.3
CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php 09.10.2026 9.3
CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code 09.10.2026 9.3
CVE-2026-28745 Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format 11.10.2026 9.3
CVE-2026-33367 Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function 11.10.2026 9.3
CVE-2026-39460 Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials 12.10.2026 9.3
CVE-2026-105278 Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials 11.10.2026 9.3
CVE-2026-32645 Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials 12.10.2026 9.2
CVE-2026-100730 Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data 11.10.2026 9.3
CVE-2026-86405 Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop 12.10.2026 9.8
CVE-2026-85531 Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x 12.10.2026 9.8
CVE-2026-93947 WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability 12.10.2026 10
CVE-2026-96327 WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96328 WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96330 WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-96331 WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96809 WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose 12.10.2026 9.3
CVE-2026-107908 Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message 09.10.2026 9.3
CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling 09.10.2026 9.2
CVE-2026-5759 Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB 09.10.2026 9.3
CVE-2026-7827 Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB 09.10.2026 9.2
CVE-2026-69435 Azure SRE Agent Elevation of Privilege Vulnerability 10.10.2026 9.6
CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability 10.10.2026 9.8
CVE-2026-88131 Microsoft Dataverse Remote Code Execution Vulnerability 10.10.2026 9.8
CVE-2026-94510 Microsoft Bookings Elevation of Privilege Vulnerability 10.10.2026 9.9
CVE-2026-96207 Microsoft Partner Center Elevation of Privilege Vulnerability 10.10.2026 10
CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client 09.10.2026 9.3
CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion 08.10.2026 9.8
CVE-2026-75875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection 10.10.2026 9.8
CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection 10.10.2026 9.8
CVE-2026-84249 IBM Guardium Data Protection is affected by vulnerability 10.10.2026 9.8
CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service 10.10.2026 9.5
CVE-2026-16823 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-16916 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-19491 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-78401 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.8
CVE-2026-78406 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.8
CVE-2026-79842 10.10.2026 9.1
CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE 08.10.2026 9.3
CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter 08.10.2026 9.3
CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById 09.10.2026 9.1
CVE-2026-106126 Command Injection 08.10.2026 9.4
CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login 08.10.2026 9.3
CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API 09.10.2026 9.3
CVE-2026-84244 IBM Guardium Data Protection Cross-Site Scripting 08.10.2026 9.3
CVE-2026-84272 IBM Guardium Data Protection Missing Authentication 10.10.2026 9.8
CVE-2026-107699 ppt2png through 0.0.6 OS Command Injection via input and output paths 08.10.2026 9.3
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument 09.10.2026 9.3
CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo 08.10.2026 9.3
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format 09.10.2026 9.3
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx 08.10.2026 9.3
CVE-2026-14269 IBM DataPower Gateway Buffer Overflow 09.10.2026 9.8
CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API 08.10.2026 9.3
CVE-2026-14502 IBM DataPower Gateway Improper Authentication 09.10.2026 9.8
CVE-2026-14992 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-14990 IBM DataPower Gateway affected by cross-site scripting 08.10.2026 9.3
CVE-2026-14991 IBM DataPower Gateway Out-of-bounds Write 10.10.2026 9.8
CVE-2026-103663 Path Traversal leading to Remote Code Execution in Ollama 08.10.2026 9.4
CVE-2026-15762 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-16340 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-19218 Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta 08.10.2026 9.1
CVE-2026-92555 Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel 08.10.2026 9.8
CVE-2026-107510 Authenticated argument injection in NIOS command line leading to privilege escalation 09.10.2026 9.1
CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter 08.10.2026 9.3
CVE-2026-12260 SQL injection in the NetBoard CRM demo platform 08.10.2026 10
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter 08.10.2026 9.8
CVE-2026-107459 Openfind｜SecuShare Pro - OS Command Injection 08.10.2026 9.3
CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter 10.10.2026 9.1
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host 10.10.2026 9.4
CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise 09.10.2026 9.8
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability 07.10.2026 9.3
CVE-2026-95606 WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability 07.10.2026 9.8
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability 08.10.2026 9.1
CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation 07.10.2026 9.1
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login 07.10.2026 9.8
CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) 10.10.2026 9.8
CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability 07.10.2026 9.1
CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities 08.10.2026 9.8
CVE-2026-76459 Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities 09.10.2026 9.8
CVE-2026-76464 Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities 07.10.2026 9.6
CVE-2026-76465 Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76480 Cisco License On-Prem Security Hardening Release 08.10.2026 9.8
CVE-2026-76482 Cisco License On-Prem Security Hardening Release 08.10.2026 10
CVE-2026-76483 Cisco License On-Prem Security Hardening Release 08.10.2026 9.1
CVE-2026-76485 Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76486 Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76498 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities 07.10.2026 9.8
CVE-2026-76499 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities 07.10.2026 9.8
CVE-2026-76500 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities 08.10.2026 9.8
CVE-2026-76501 Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens 07.10.2026 9.3
CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint 07.10.2026 9.3
CVE-2026-107194 10.10.2026 9.2
CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser 07.10.2026 9.2
CVE-2026-96408 07.10.2026 9.3
CVE-2026-105192 LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization 07.10.2026 9.8
CVE-2026-103416 07.10.2026 9.3
CVE-2025-64393 08.10.2026 9.4
CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 08.10.2026 9.3
CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-59346 VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability 07.10.2026 9.3
CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability 07.10.2026 9.3
CVE-2026-14911 07.10.2026 9.3
CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm 07.10.2026 9
CVE-2026-19386 08.10.2026 9.3
CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM 07.10.2026 9.2
CVE-2026-104334 Langflow OSS is affected by multiple vulnerabilities 08.10.2026 9.8
CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilities 08.10.2026 9.8
CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder 07.10.2026 9.6

Latest Updates

CVE Title Updated Score
CVE-2026-101899 Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 13.10.2026
CVE-2026-102672 Electron: Local race condition in Squirrel.Mac update installation on macOS 13.10.2026 6.7
CVE-2026-54697 ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing 13.10.2026
CVE-2026-54700 ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation 13.10.2026
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater 13.10.2026 9.1
CVE-2026-102699 Arm: multiple issues with GNTTABOP_cache_flush 13.10.2026
CVE-2026-102700 gnttab: cache-flush handling may cause page reference leak 13.10.2026
CVE-2026-102702 Arm: multiple issues with GNTTABOP_cache_flush 13.10.2026
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions 13.10.2026
CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert 13.10.2026
CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces 13.10.2026
CVE-2026-109605 SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization 13.10.2026
CVE-2026-110025 slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload 13.10.2026
CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation 13.10.2026 6.1
CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison 13.10.2026 6.8
CVE-2026-78802 13.10.2026
CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update 13.10.2026
CVE-2026-79608 x86/AMD: ineffectual Zenbleed workaround 13.10.2026
CVE-2026-79609 x86: XPTI may break on huge-memory systems 13.10.2026
CVE-2026-79610 grant-table: double version change race 13.10.2026
CVE-2026-79611 VMX: VMentry failure with branch tracing and blocked states 13.10.2026
CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter 13.10.2026 5.5
CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked 13.10.2026 4.2
CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage 13.10.2026 6.5
CVE-2026-102982 Plane: XSS in work item comments 13.10.2026
CVE-2026-102988 Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) 13.10.2026 5.3
CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references 13.10.2026
CVE-2026-104935 13.10.2026 8.6
CVE-2026-109526 HBAI-Ltd Toonflow-app exportData Endpoint information disclosure 13.10.2026
CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map 13.10.2026
CVE-2026-88836 13.10.2026
CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline 13.10.2026
CVE-2026-96299 MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM 13.10.2026
CVE-2024-34320 13.10.2026
CVE-2024-34321 13.10.2026
CVE-2024-34323 13.10.2026
CVE-2024-34324 13.10.2026
CVE-2024-34326 13.10.2026
CVE-2026-105460 Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() 13.10.2026
CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization 13.10.2026
CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization 13.10.2026
CVE-2026-55376 heym Python Tool Sandbox Escape 13.10.2026 8.8
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 13.10.2026 10
CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data 13.10.2026 6.5
CVE-2024-34319 13.10.2026
CVE-2026-102250 13.10.2026
CVE-2026-103028 SFTPGo source-side file-pattern filter bypass during copy operations 13.10.2026 4.3
CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory 13.10.2026
CVE-2026-107917 Insufficient input validation vulnerability in NETGEAR R7300 router 13.10.2026
CVE-2026-107918 Insufficient input validation vulnerability in NETGEAR R7300 13.10.2026
CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request 13.10.2026 6.5
CVE-2026-95127 13.10.2026
CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes 13.10.2026 5.4
CVE-2026-104192 DragonflyDB stream RDB deserialization double-free 13.10.2026 9.6
CVE-2026-108184 13.10.2026 7.4
CVE-2026-108185 13.10.2026 7.4
CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection 13.10.2026
CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection 13.10.2026
CVE-2026-11730 Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models 13.10.2026
CVE-2026-11731 Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models 13.10.2026
CVE-2026-11732 Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models 13.10.2026
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 13.10.2026 9.8
CVE-2026-53711 MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI 13.10.2026
CVE-2026-95122 13.10.2026
CVE-2026-9218 Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access 13.10.2026
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint 13.10.2026
CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding 13.10.2026
CVE-2026-109521 girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection 13.10.2026
CVE-2026-12655 1732E ArmorBlock® - Multiple Vulnerabilities 13.10.2026
CVE-2026-12656 1732E ArmorBlock® - Multiple Vulnerabilities 13.10.2026
CVE-2026-18228 Hyperscale Path Traversal 13.10.2026
CVE-2026-4869 Potential Privilege Escalation in InstallShield 13.10.2026
CVE-2026-53418 13.10.2026 8.1
CVE-2026-53420 13.10.2026 8
CVE-2026-65197 H3C G3/G5 HDM Firmware Verification Key Replacement 13.10.2026 3.1
CVE-2026-65198 Huawei Default SNMPv3 USM key 13.10.2026 8.6
CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation 13.10.2026 5.4
CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses 13.10.2026 3.5
CVE-2026-77090 CVFS Information Disclosure 13.10.2026
CVE-2026-77093 CvFWD Denial of Service 13.10.2026
CVE-2026-77094 CvFWD Out-of-Bounds Write 13.10.2026
CVE-2026-77095 CvFWD Null Pointer Dereference 13.10.2026
CVE-2026-77096 CVFS Missing Authentication 13.10.2026
CVE-2026-77099 CVFS Command Execution 13.10.2026
CVE-2026-77100 MediaAgent Denial of Service 13.10.2026
CVE-2026-95114 13.10.2026
CVE-2026-95115 13.10.2026
CVE-2026-95117 13.10.2026
CVE-2026-95121 13.10.2026
CVE-2026-95124 13.10.2026
CVE-2026-97333 QAPI stack-based buffer overflow 13.10.2026
CVE-2026-97334 Network messaging layer decompression resource exhaustion 13.10.2026
CVE-2025-58771 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58772 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58773 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58774 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2026-0893 Uncleared Password Keystrokes Vulnerability 13.10.2026
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 13.10.2026
CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root 13.10.2026
CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method 13.10.2026
CVE-2026-109967 yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats 13.10.2026
CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions 13.10.2026 4.7
CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL 13.10.2026 4.3
CVE-2026-103499 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service 13.10.2026 7.5
CVE-2026-109519 YouTransfer Template Rendering template path traversal 13.10.2026
CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder 13.10.2026
CVE-2026-93907 IBM WebSphere Application Server is affected by a bypass authentication vulnerability 13.10.2026 8.1
CVE-2026-95680 IBM WebSphere Application Server is affected by an authorization bypass 13.10.2026 8
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames 13.10.2026 3.7
CVE-2026-109409 HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection 13.10.2026
CVE-2026-109410 macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation 13.10.2026
CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect 13.10.2026
CVE-2026-109677 FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler 13.10.2026
CVE-2026-109678 FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA 13.10.2026
CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response 13.10.2026
CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username 13.10.2026
CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update 13.10.2026
CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order 13.10.2026
CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name 13.10.2026
CVE-2026-109941 FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response 13.10.2026
CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet 13.10.2026
CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order 13.10.2026
CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle 13.10.2026
CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit 13.10.2026
CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width 13.10.2026
CVE-2026-109947 FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read 13.10.2026
CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection 13.10.2026
CVE-2026-109949 FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard 13.10.2026
CVE-2026-109950 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages 13.10.2026
CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name 13.10.2026
CVE-2026-109952 FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response 13.10.2026
CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin 13.10.2026
CVE-2026-109954 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference 13.10.2026
CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding 13.10.2026
CVE-2026-109956 NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path 13.10.2026
CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter 13.10.2026
CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search 13.10.2026
CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint 13.10.2026
CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value 13.10.2026
CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members 13.10.2026
CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API 13.10.2026
CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php 13.10.2026
CVE-2026-74030 Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion 13.10.2026
CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers 13.10.2026
CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions 13.10.2026
CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers 13.10.2026
CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command 13.10.2026
CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user 13.10.2026
CVE-2026-74036 Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies 13.10.2026
CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token 13.10.2026
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 13.10.2026
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch 13.10.2026
CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions 13.10.2026
CVE-2026-74045 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder 13.10.2026
CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint 13.10.2026
CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition 13.10.2026
CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file 13.10.2026
CVE-2026-109407 macrozheng mall Coupon Redemption generateOrder race condition 13.10.2026
CVE-2026-65101 13.10.2026 8.6
CVE-2026-65103 13.10.2026 8.1
CVE-2026-65104 13.10.2026 7.1
CVE-2026-65110 13.10.2026 7.8
CVE-2026-65131 13.10.2026 6
CVE-2026-65161 13.10.2026 7.5
CVE-2026-65162 13.10.2026 10
CVE-2026-65164 13.10.2026 8.1
CVE-2026-65170 13.10.2026 8.6
CVE-2026-65172 13.10.2026 8.6
CVE-2026-65173 13.10.2026 9.1
CVE-2026-65180 13.10.2026 7.8
CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery 13.10.2026
CVE-2026-109406 macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error 13.10.2026
CVE-2026-109704 Privilege escalation in the Application Update component 13.10.2026
CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component 13.10.2026
CVE-2026-109706 Use-after-free in the Storage: IndexedDB component 13.10.2026
CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component 13.10.2026
CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component 13.10.2026
CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing component 13.10.2026
CVE-2026-109710 Use-after-free in the Graphics: Text component 13.10.2026
CVE-2026-109711 Use-after-free in the Graphics: Canvas2D component 13.10.2026
CVE-2026-109712 Sandbox escape due to uninitialized memory in the Graphics component 13.10.2026
CVE-2026-109713 Use-after-free in the Crash Reporting component 13.10.2026
CVE-2026-109714 Incorrect boundary conditions in the Layout component 13.10.2026
CVE-2026-109715 Incorrect boundary conditions in the JavaScript Engine component 13.10.2026
CVE-2026-109716 Incorrect boundary conditions in the JavaScript Engine component 13.10.2026
CVE-2026-109717 Use-after-free in the DOM: Bindings (WebIDL) component 13.10.2026
CVE-2026-109718 Use-after-free in the XML component 13.10.2026
CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component 13.10.2026
CVE-2026-109720 JIT miscompilation in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109721 Incorrect boundary conditions in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109723 Integer overflow in the Layout: Text and Fonts component 13.10.2026
CVE-2026-109724 Use-after-free in the DOM: Core & HTML component 13.10.2026
CVE-2026-109725 Use-after-free in the DOM: Core & HTML component 13.10.2026
CVE-2026-109726 Use-after-free in the SVG component 13.10.2026
CVE-2026-109727 Use-after-free in the Audio/Video component 13.10.2026
CVE-2026-109728 Use-after-free in the DOM: Animation component 13.10.2026
CVE-2026-109729 Use-after-free in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109730 Integer overflow in the Graphics component 13.10.2026
CVE-2026-109731 Incorrect boundary conditions in the Graphics: Canvas2D component 13.10.2026
CVE-2026-109732 Use-after-free in the DOM: Streams component 13.10.2026
CVE-2026-109733 JIT miscompilation in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109734 Mitigation bypass in the DOM: Security component 13.10.2026
CVE-2026-109735 Use-after-free in the DOM: Animation component 13.10.2026
CVE-2026-109736 Frame poisoning in the Layout component 13.10.2026
CVE-2026-109737 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109738 Use-after-free in the Audio/Video: Playback component 13.10.2026
CVE-2026-109739 Privilege escalation in the WebExtensions component 13.10.2026
CVE-2026-109740 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component 13.10.2026
CVE-2026-109741 Use-after-free in the Storage: Bucket File System component 13.10.2026
CVE-2026-109742 Information disclosure in the PDF Viewer component 13.10.2026
CVE-2026-109743 Privilege escalation in the Panning and Zooming component 13.10.2026
CVE-2026-109744 Other issue in the DOM: File component 13.10.2026
CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component 13.10.2026
CVE-2026-109746 Mitigation bypass in the DOM: Security component 13.10.2026
CVE-2026-109747 Other issue in the Address Bar component 13.10.2026
CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component 13.10.2026
CVE-2026-109751 Information disclosure in the Networking component 13.10.2026
CVE-2026-109752 Use-after-free in the DOM: Workers component 13.10.2026
CVE-2026-109753 Incorrect boundary conditions in the Layout component 13.10.2026
CVE-2026-109754 Incorrect boundary conditions in the DOM: Editor component 13.10.2026
CVE-2026-109755 Sandbox escape in the DOM: Content Processes component 13.10.2026
CVE-2026-109756 Privilege escalation in the DOM: Navigation component 13.10.2026
CVE-2026-109757 Sandbox escape due to race condition in the Networking component 13.10.2026
CVE-2026-109759 Site isolation issue in the Networking component 13.10.2026
CVE-2026-109760 Mitigation bypass in the Networking: HTTP component 13.10.2026
CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109762 Incorrect boundary conditions in the SVG component 13.10.2026
CVE-2026-109763 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-109764 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component 13.10.2026
CVE-2026-109766 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109767 Information disclosure in the Networking component 13.10.2026
CVE-2026-109768 Denial-of-service in the Site Reports component 13.10.2026
CVE-2026-109769 Information disclosure in the Networking: Cache component 13.10.2026
CVE-2026-109770 Spoofing issue in the DOM: Web Serial component 13.10.2026
CVE-2026-109771 Information disclosure in the WebRTC: Networking component 13.10.2026
CVE-2026-109772 Same-origin policy bypass in the DevTools component 13.10.2026
CVE-2026-109773 Denial-of-service in the Sync component 13.10.2026
CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component 13.10.2026
CVE-2026-109775 Denial-of-service in the WebRTC component 13.10.2026
CVE-2026-109776 Race condition in the XPCOM component 13.10.2026
CVE-2026-109777 Information disclosure in the Storage: IndexedDB component 13.10.2026
CVE-2026-109778 Privilege escalation in the WebExtensions component 13.10.2026
CVE-2026-109779 Race condition in the Networking: DNS component 13.10.2026
CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component 13.10.2026
CVE-2026-109781 Denial-of-service in the Printing: Output component 13.10.2026
CVE-2026-109782 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-109783 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-65141 13.10.2026 7.8
CVE-2026-65147 13.10.2026 7.3
CVE-2026-65148 13.10.2026 7.3
CVE-2026-65149 13.10.2026 7.3
CVE-2026-65150 13.10.2026 7.3
CVE-2026-67456 13.10.2026 4.4
CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery 13.10.2026
CVE-2026-109404 conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery 13.10.2026
CVE-2026-109833 Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service 13.10.2026
CVE-2026-109976 Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection 13.10.2026
CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery 13.10.2026
CVE-2026-109832 Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) 13.10.2026
CVE-2026-94410 Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service 13.10.2026
CVE-2026-109190 conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery 13.10.2026
CVE-2026-89279 Active Directory Password Change CSRF in AuthTake Technology's authtake 13.10.2026 6.5
CVE-2026-109189 fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery 13.10.2026
CVE-2026-63316 SQL Injection in Payload CMS 13.10.2026
CVE-2026-109160 PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect 13.10.2026
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflow 13.10.2026
CVE-2026-109156 SeldonIO MLServer environment_tarball env.py _extract_env path traversal 13.10.2026
CVE-2026-109153 MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal 13.10.2026
CVE-2026-109155 DeepPavlov Model Download untar path traversal 13.10.2026
CVE-2026-109152 jbardin scp.py SCP Receive _recv_pushd path traversal 13.10.2026
CVE-2026-102073 13.10.2026 8.2
CVE-2026-102074 13.10.2026 7.5
CVE-2026-102075 13.10.2026 7.5
CVE-2026-102076 13.10.2026 7.5
CVE-2026-109144 wbond certvalidator Certificate Path Builder resource consumption 13.10.2026
CVE-2026-109149 beautifier js-beautify memory allocation 13.10.2026
CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework 13.10.2026
CVE-2026-109854 M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding 13.10.2026
CVE-2026-44414 13.10.2026 6.8
CVE-2026-44415 13.10.2026 9.1
CVE-2026-59241 13.10.2026 8.8
CVE-2026-63350 13.10.2026 9.6
CVE-2026-63351 13.10.2026 6.1
CVE-2026-63352 13.10.2026 6.1
CVE-2026-63353 13.10.2026 9.6
CVE-2026-63354 13.10.2026 9.6
CVE-2026-63355 13.10.2026 6.1
CVE-2026-63356 13.10.2026 6.1
CVE-2026-63357 13.10.2026 6.1
CVE-2026-72895 13.10.2026 7.7
CVE-2026-78556 13.10.2026 7.4
CVE-2026-78557 13.10.2026 8.3
CVE-2026-85114 13.10.2026 7.5
CVE-2026-85115 13.10.2026 5.5
CVE-2026-89196 13.10.2026 8.8
CVE-2026-89197 13.10.2026 8.8
CVE-2026-89198 13.10.2026 8.8
CVE-2026-89199 13.10.2026 8.8
CVE-2026-89200 13.10.2026 6.7
CVE-2026-89201 13.10.2026 7.5
CVE-2026-89202 13.10.2026 6.5
CVE-2026-89203 13.10.2026 4.3
CVE-2026-89204 13.10.2026 5.4
CVE-2026-89205 13.10.2026 6.3
CVE-2026-89206 13.10.2026 6.3
CVE-2026-89208 13.10.2026 5.3
CVE-2026-106598 WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-108487 WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management 13.10.2026
CVE-2026-109687 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability 13.10.2026 7.6
CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 13.10.2026 5.4
CVE-2026-101020 13.10.2026
CVE-2026-103076 WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability 13.10.2026 5.4
CVE-2026-105881 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-106597 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108174 WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108179 WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability 13.10.2026 7.6
CVE-2026-108488 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108489 WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-108490 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108492 WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108493 WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108495 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108496 WordPress WP User Manager plugin <= 2.9.23 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-109115 AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection 13.10.2026
CVE-2026-109116 AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization 13.10.2026
CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-109691 WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-109696 WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability 13.10.2026 5.4
CVE-2026-109697 WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-13138 Improper Authorization in Divasoft Software's Biletiva Ticketing Platform 13.10.2026 8.6
CVE-2026-89309 n/a 13.10.2026
CVE-2026-96535 Cross-Site Scripting in the YouMind web application 13.10.2026
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection 13.10.2026
CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication 13.10.2026
CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback 13.10.2026 7.2
CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter 13.10.2026 7.2
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow 13.10.2026
CVE-2026-14308 Insufficient Signature Validation 13.10.2026 4.9
CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter 13.10.2026 4.9
CVE-2026-89097 Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters 13.10.2026 4.3
CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation 13.10.2026
CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services 13.10.2026
CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference 13.10.2026
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection 13.10.2026
CVE-2026-109703 WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS) 13.10.2026 5.4
CVE-2026-108975 SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload 13.10.2026
CVE-2026-109106 Polaris Office App Document Intake com.infraware.service.m.n.a path traversal 13.10.2026
CVE-2026-75826 Teltonika Command Injection in Backup function 13.10.2026
CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime 13.10.2026 7.1
CVE-2026-108973 SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload 13.10.2026
CVE-2026-108974 SourceCodester E-Learning System Users.php save_users unrestricted upload 13.10.2026
CVE-2026-108972 SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication 13.10.2026
CVE-2026-54867 WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode 13.10.2026
CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile 13.10.2026
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification 13.10.2026
CVE-2026-54868 WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-54869 WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-54870 WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison 13.10.2026
CVE-2026-108970 itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection 13.10.2026
CVE-2026-108968 SourceCodester Performance Indicator System sales_history.php sql injection 13.10.2026
CVE-2026-108966 SourceCodester Performance Indicator System product.php sql injection 13.10.2026
CVE-2026-108967 SourceCodester Performance Indicator System edit_credit.php sql injection 13.10.2026
CVE-2026-108965 SourceCodester Performance Indicator System edit_quantity.php sql injection 13.10.2026
CVE-2026-109758 13.10.2026
CVE-2026-108964 SourceCodester Performance Indicator System addproduct.php sql injection 13.10.2026
CVE-2026-108961 PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection 13.10.2026
CVE-2026-108962 storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection 13.10.2026
CVE-2026-108959 itsourcecode Online Cake Ordering System addtransacdetail.php sql injection 13.10.2026
CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds 13.10.2026
CVE-2026-108957 TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection 13.10.2026
CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization 13.10.2026
CVE-2026-109786 13.10.2026 5.3
CVE-2026-108954 k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode buffer overflow 13.10.2026
CVE-2026-108955 Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds 13.10.2026
CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection 13.10.2026
CVE-2026-35001 OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow 13.10.2026
CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab 13.10.2026 3.5
CVE-2026-100755 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab 13.10.2026 4.6
CVE-2026-101168 Insertion of Sensitive Information into Log File in GitLab 13.10.2026 6.2
CVE-2026-103549 Incorrect Authorization in GitLab 13.10.2026 2.7
CVE-2026-104661 Incorrect Privilege Assignment in GitLab 13.10.2026 4.3
CVE-2026-105458 Reliance on Untrusted Inputs in a Security Decision in GitLab 13.10.2026 4.3
CVE-2026-108947 yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization 13.10.2026
CVE-2026-108948 code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes 13.10.2026
CVE-2026-14210 Insufficient Granularity of Access Control in GitLab 13.10.2026 4.3
CVE-2026-14552 Incorrect Authorization in GitLab 13.10.2026 4.3
CVE-2026-14814 Permissive Regular Expression in GitLab 13.10.2026 8.2
CVE-2026-16275 Incorrect Authorization in GitLab 13.10.2026 5.3
CVE-2026-16301 Incorrect Authorization in GitLab 13.10.2026 8.5
CVE-2026-5954 Incorrect Authorization in GitLab 13.10.2026 4.2
CVE-2026-6567 Incorrect Authorization in GitLab 13.10.2026 4.3
CVE-2026-78335 Incorrect Authorization in GitLab 13.10.2026 4.2
CVE-2026-7767 URL Redirection to Untrusted Site ('Open Redirect') in GitLab 13.10.2026 5.8
CVE-2026-81839 Incorrect Authorization in GitLab 13.10.2026 7.7
CVE-2026-82632 Incorrect Authorization in GitLab 13.10.2026 3.1
CVE-2026-84284 Incorrect Authorization in GitLab 13.10.2026 5.3
CVE-2026-85529 Incorrect Authorization in GitLab 13.10.2026 5.3
CVE-2026-92528 Incorrect Authorization in GitLab 13.10.2026 4.2
CVE-2026-92883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 13.10.2026 8.7
CVE-2026-96893 Improper Neutralization of Input Used for LLM Prompting in GitLab 13.10.2026 7.3
CVE-2026-97229 Integer Overflow or Wraparound in GitLab 13.10.2026 10
CVE-2026-9268 Incorrect Authorization in GitLab 13.10.2026 2.7
CVE-2026-108942 philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting 13.10.2026
CVE-2026-108943 ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection 13.10.2026
CVE-2026-108944 repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection 13.10.2026
CVE-2026-108945 iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection 13.10.2026
CVE-2026-58242 Improper Authorization check in SAP Cloud Connector 13.10.2026 3.5
CVE-2026-58249 Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) 13.10.2026 7.5
CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence 13.10.2026 6.5
CVE-2026-76975 Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) 13.10.2026 6.1
CVE-2026-76976 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) 13.10.2026 5.4
CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints 13.10.2026 9.8
CVE-2026-89105 Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library 13.10.2026 4.2
CVE-2026-89106 Cross Site Scripting (XSS) vulnerability in SAPUI5 13.10.2026 4.4
CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) 13.10.2026 9.9
CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) 13.10.2026 9.1
CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer 13.10.2026 9.9
CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python 13.10.2026 10
CVE-2026-89112 Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure 13.10.2026 6.5
CVE-2026-89113 SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) 13.10.2026 8.8
CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code 13.10.2026 5.9
CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal 13.10.2026 6.1
CVE-2026-89118 Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal 13.10.2026 5.3
CVE-2026-89120 Missing authorization check in SAP ABAP Platform 13.10.2026 7.1
CVE-2026-89121 Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) 13.10.2026 4.7
CVE-2026-89122 Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal 13.10.2026 6.1
CVE-2026-89124 Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) 13.10.2026 4.3
CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection 12.10.2026
CVE-2026-108940 EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal 12.10.2026
CVE-2026-17484 IBM i is Information Disclosure 13.10.2026 5.3
CVE-2026-17487 IBM i is Information Disclosure 13.10.2026 5.3
CVE-2026-18318 IBM i Information Disclosure 13.10.2026 5.3
CVE-2026-18343 IBM i is Affected By An Improper Privilege Management Vulnerability 13.10.2026 4.4
CVE-2026-81858 IBM i is Affected By A Denial of Service Vulnerability in Host Servers 13.10.2026 5.4
CVE-2026-93886 IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI 13.10.2026 8.3
CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI 13.10.2026 9.9
CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery 12.10.2026
CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference 12.10.2026 4.8
CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses 12.10.2026 5.7
CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails 12.10.2026 5.9
CVE-2026-108938 code-projects Matrimonial System matrimony.sql file access 13.10.2026
CVE-2026-102627 Security Vulnerability identified in IBM TRIRIGA - Zip Slip 13.10.2026 8.8
CVE-2026-75076 IBM Aspera Enterprise Webapps Information Disclosure 13.10.2026 4.3
CVE-2026-75095 IBM Aspera Enterprise Webapps Denial of Service 13.10.2026 7.5
CVE-2026-75621 IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges 13.10.2026 6.2
CVE-2026-75782 IBM Aspera Enterprise Webapps Untrusted Search Path 13.10.2026 7.8
CVE-2026-92832 IBM Aspera Enterprise Webapps Information Disclosure 13.10.2026 5.1
CVE-2026-93891 Security Vulnerability identified in IBM TRIRIGA - XXE 13.10.2026 7.6
CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console 13.10.2026 8.1
CVE-2026-108937 code-projects Online Ticket Reservation System medallion.sql file information disclosure 12.10.2026
CVE-2026-17475 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 7.1
CVE-2026-18541 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 6.4
CVE-2026-19620 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 8.8
CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 8.8
CVE-2026-19627 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 8.2
CVE-2026-75061 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 7.5
CVE-2026-75063 IBM Planning Analytics Local is affected by security vulnerabilities 13.10.2026 5.4
CVE-2026-85457 IBM Planning Analytics Local is affected by security vulnerabilities 12.10.2026 8.1
CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts 12.10.2026
CVE-2023-54407 Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks 12.10.2026
CVE-2023-54408 Frappe before 14.31.0 HTML Injection via Weak Escaping 12.10.2026
CVE-2023-54409 Frappe before 13.46.1 XSS via html2text Weak Sanitization 13.10.2026
CVE-2023-54410 Frappe before 13.22.0 Improper Authorization via Document Rename 12.10.2026
CVE-2023-54411 Frappe before 13.32.0 Weak Authentication via Print View Key 12.10.2026
CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates 12.10.2026
CVE-2024-58390 Frappe before 15.41.0 Privilege Escalation via Document Action 12.10.2026
CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters 13.10.2026
CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names 12.10.2026
CVE-2025-71431 Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters 12.10.2026
CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover 12.10.2026
CVE-2026-108936 Edimax BR-6208AC QoS Page formQoS cross site scripting 12.10.2026
CVE-2026-109572 Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy 12.10.2026
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint 13.10.2026
CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback 12.10.2026
CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver 12.10.2026
CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor 12.10.2026
CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs 12.10.2026
CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint 13.10.2026
CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification 12.10.2026
CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications 12.10.2026
CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML 12.10.2026
CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters 12.10.2026
CVE-2026-109603 Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit 13.10.2026
CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names 12.10.2026
CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input 12.10.2026
CVE-2026-109609 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation 12.10.2026
CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification 12.10.2026
CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints 13.10.2026
CVE-2026-109612 Frappe ERPNext before 15.120.0 Stored XSS via Report View 12.10.2026
CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification 12.10.2026
CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints 12.10.2026
CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification 13.10.2026
CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints 12.10.2026
CVE-2026-109621 Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass 12.10.2026
CVE-2026-109622 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization 12.10.2026
CVE-2026-109623 Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization 12.10.2026
CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data 13.10.2026
CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints 12.10.2026
CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization 12.10.2026
CVE-2026-109629 Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint 13.10.2026
CVE-2026-109630 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints 12.10.2026
CVE-2026-109631 Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation 12.10.2026
CVE-2026-109632 Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints 12.10.2026
CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page 12.10.2026
CVE-2026-109634 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints 13.10.2026
CVE-2026-109635 Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints 12.10.2026
CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification 12.10.2026
CVE-2026-109638 Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation 12.10.2026
CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests 13.10.2026
CVE-2026-109640 Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification 12.10.2026
CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints 12.10.2026
CVE-2026-109642 Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints 12.10.2026
CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data 12.10.2026
CVE-2026-109644 Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data 13.10.2026
CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization 12.10.2026
CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation 12.10.2026
CVE-2026-109647 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation 12.10.2026
CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation 12.10.2026
CVE-2026-109649 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests 13.10.2026
CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data 12.10.2026
CVE-2026-109651 Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field 12.10.2026
CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields 12.10.2026
CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover 12.10.2026
CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints 13.10.2026
CVE-2026-109655 Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints 12.10.2026
CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access 12.10.2026
CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name 12.10.2026
CVE-2026-109658 Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints 12.10.2026
CVE-2026-109659 Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data 13.10.2026
CVE-2026-109660 Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints 12.10.2026
CVE-2026-109661 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form 12.10.2026
CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters 12.10.2026
CVE-2026-109664 Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification 13.10.2026
CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation 12.10.2026
CVE-2026-109666 Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints 12.10.2026
CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation 12.10.2026
CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints 12.10.2026
CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification 13.10.2026
CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name 12.10.2026
CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages 12.10.2026
CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data 12.10.2026
CVE-2026-109673 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names 12.10.2026
CVE-2026-109674 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation 13.10.2026
CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs 12.10.2026
CVE-2026-82096 DataStage on Cloud Pak for Data Command Injection 12.10.2026 8.8
CVE-2026-82101 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-82103 DataStage on Cloud Pak for Data Information Disclosure 13.10.2026 9.6
CVE-2026-82108 DataStage on Cloud Pak for Data Code Injection 12.10.2026 8.8
CVE-2026-82110 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-84418 DataStage on Cloud Pak for Data Improper Certificate Validation 12.10.2026 7.4
CVE-2026-108935 Edimax BR-6208AC Port Forwarding formPortFw cross site scripting 12.10.2026
CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes 12.10.2026 4.3
CVE-2026-108934 Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting 13.10.2026
CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials 12.10.2026
CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation 13.10.2026 4.3
CVE-2026-104140 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values 13.10.2026 6.1
CVE-2026-108933 Edimax BR-6208AC formFilter cross site scripting 12.10.2026
CVE-2026-49484 Code for IBM i: Temporary files are visible to all users 12.10.2026
CVE-2026-90911 Maximo AI Service Denial of Service 13.10.2026 7.5
CVE-2026-90912 Maximo AI Service Denial of Service 13.10.2026 7.5
CVE-2026-90920 Maximo AI Service Code Injection 13.10.2026 9.8
CVE-2026-90921 Maximo AI Service Denial of Service 13.10.2026 7.5
CVE-2026-92876 IBM Maximo Application Suite - IoT Component Denial of Service 12.10.2026 7.5
CVE-2026-108932 Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting 12.10.2026
CVE-2026-49483 Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution 12.10.2026
CVE-2026-53922 odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated) 13.10.2026 6.5
CVE-2026-103658 12.10.2026 5.9
CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id 13.10.2026 6.5