CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing 20.10.2026 9.1
CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin 20.10.2026 9.2
CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 20.10.2026 9.4
CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password 20.10.2026 9.1
CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user 20.10.2026 9.3
CVE-2026-93475 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 20.10.2026 9.3
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection 20.10.2026 9.4
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection 20.10.2026 9.4
CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT 20.10.2026 9.8
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection 20.10.2026 9.4
CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation 20.10.2026 9.9
CVE-2026-43844 20.10.2026 9.3
CVE-2026-43845 20.10.2026 9.2
CVE-2026-43836 20.10.2026 9.3
CVE-2026-43838 20.10.2026 9.2
CVE-2026-113380 20.10.2026 9.3
CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell 20.10.2026 9.3
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint 20.10.2026 9.3
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent 20.10.2026 9.3
CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 20.10.2026 9.3
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 20.10.2026 9.3
CVE-2026-112371 H3C Magic NX15 RPC esps write code injection 20.10.2026 9.4
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection 19.10.2026 9.4
CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE 20.10.2026 9.2
CVE-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecode 19.10.2026 9.2
CVE-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution 19.10.2026 9.2
CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO 19.10.2026 9.2
CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations 20.10.2026 9.3
CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass 20.10.2026 9.3
CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 19.10.2026 9.3
CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend 19.10.2026 9.2
CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack 19.10.2026 9.1
CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 19.10.2026 9.6
CVE-2026-111862 Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code 20.10.2026 9.8
CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass 19.10.2026 10
CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels 19.10.2026 9.8
CVE-2026-109432 Camunda Expression Injection via orQueries RCE 19.10.2026 9.3
CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules 19.10.2026 9.3
CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials 19.10.2026 9.3
CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) 20.10.2026 10
CVE-2026-110887 WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability 19.10.2026 9.9
CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability 19.10.2026 9.9
CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM) 19.10.2026 9.3
CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) 19.10.2026 9.3
CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability 19.10.2026 9.8
CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway 19.10.2026 9.3
CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor 18.10.2026 9.2
CVE-2026-109894 WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability 19.10.2026 9.3
CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 19.10.2026 9.8
CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability 19.10.2026 9.8
CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection 19.10.2026 9.3
CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter 18.10.2026 9.8
CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter 18.10.2026 9.1
CVE-2026-111823 19.10.2026 9.8
CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution 16.10.2026 9.2
CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) 19.10.2026 9
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers 16.10.2026 9.3
CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret 16.10.2026 9.2
CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints 16.10.2026 9.3
CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback 16.10.2026 9.3
CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation 16.10.2026 9.2
CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints 16.10.2026 9.3
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover 19.10.2026 9.1
CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint 16.10.2026 9.3
CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass 19.10.2026 9.3
CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header 16.10.2026 9.1
CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret 16.10.2026 9.3
CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials 16.10.2026 9.3
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers 16.10.2026 9.3
CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup 16.10.2026 9.3
CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() 16.10.2026 9.3
CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling 19.10.2026 9.2
CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel 20.10.2026 9.3
CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel 16.10.2026 9.3
CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access 16.10.2026 9.1
CVE-2026-102693 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID 16.10.2026 9.6
CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read 16.10.2026 9.8
CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections 16.10.2026 9.9
CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's 16.10.2026 9.9
CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. 16.10.2026 9.9
CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade 16.10.2026 9.6
CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context 16.10.2026 9
CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function 16.10.2026 9.3
CVE-2026-107617 Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials 16.10.2026 9.3
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller 18.10.2026 9.6
CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter 16.10.2026 9.2
CVE-2026-111472 SQL injection in TSG Profleet 16.10.2026 9.3
CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability 16.10.2026 10
CVE-2026-94388 WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability 16.10.2026 9.3
CVE-2026-104730 Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter 16.10.2026 9.8
CVE-2026-103768 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment 16.10.2026 9.8
CVE-2026-89079 Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter 16.10.2026 9.8
CVE-2026-104798 My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute 16.10.2026 9.8
CVE-2026-109219 Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter 16.10.2026 9.8
CVE-2026-109515 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter 16.10.2026 9.8
CVE-2026-111444 16.10.2026 9.8
CVE-2026-111281 Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials 15.10.2026 9.3
CVE-2026-111283 BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration 20.10.2026 9.5
CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route 15.10.2026 9.2
CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API 16.10.2026 9.3
CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console 16.10.2026 9.3
CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force 16.10.2026 9.1
CVE-2026-105032 EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write 16.10.2026 9.1
CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read 16.10.2026 9.9
CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching 16.10.2026 9.8
CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks 16.10.2026 9.6
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support 17.10.2026 9.3
CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method 16.10.2026 9.1
CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction 15.10.2026 9.6
CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json 15.10.2026 9.1
CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox 15.10.2026 9.3
CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates 15.10.2026 9.1
CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS 15.10.2026 9.3
CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune 16.10.2026 9.4
CVE-2026-105474 15.10.2026 9.4
CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflow 15.10.2026 10
CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer 15.10.2026 9.9
CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection 20.10.2026 10
CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params 20.10.2026 9.1
CVE-2026-109686 WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability 15.10.2026 9.8
CVE-2026-109688 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability 15.10.2026 9.3
CVE-2026-109892 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability 15.10.2026 9.8
CVE-2026-99999 ipv4: validate checksum_start before completing checksum 19.10.2026 9.3
CVE-2026-109698 WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability 15.10.2026 9.3
CVE-2026-108497 WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability 16.10.2026 9.3
CVE-2026-109694 WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability 15.10.2026 9.8
CVE-2026-19863 15.10.2026 9.3
CVE-2026-34006 Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer 15.10.2026 9.3
CVE-2026-47786 Pre-Authentication Command Injection 15.10.2026 9.3
CVE-2026-50612 Import Symlink Following Remote Code Execution Vulnerability in QuMagie 15.10.2026 9.4
CVE-2026-50619 Unauthenticated remote code execution vulnerability 15.10.2026 9.3
CVE-2026-101287 Authentication bypass in Stela by Diaple Networking 15.10.2026 9.3
CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz 16.10.2026 9.2
CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 16.10.2026 9.4
CVE-2026-102469 15.10.2026 9.2
CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter 15.10.2026 9.8
CVE-2026-93483 19.10.2026 9.5
CVE-2026-110911 15.10.2026 9.8
CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec 16.10.2026 9.2
CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link 15.10.2026 9.3
CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy 15.10.2026 9.1
CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset 15.10.2026 9
CVE-2026-108336 Token Signing Key Allows Unauthenticated Administrative Access 16.10.2026 9.1
CVE-2026-108335 Password Reset Functionality Missing Brute-Force Protection 15.10.2026 9.1
CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php 15.10.2026 9.8
CVE-2026-55680 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter 15.10.2026 9.8
CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php 15.10.2026 9.8
CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service 15.10.2026 9.2
CVE-2026-110770 Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force 14.10.2026 9.2
CVE-2026-110536 D-Link DIR-868L HNAP CGI cgibin system os command injection 15.10.2026 10
CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2 15.10.2026 9.1
CVE-2026-102476 16.10.2026 9.1
CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username 14.10.2026 10
CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain 15.10.2026 9.8
CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access 14.10.2026 9.3
CVE-2026-103415 16.10.2026 9.3
CVE-2026-101954 Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled 16.10.2026 9.3
CVE-2026-101982 Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used 16.10.2026 9.3
CVE-2026-101983 Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured 15.10.2026 9.3
CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking 14.10.2026 9.9
CVE-2026-92152 F´: Unvalidated Port Index in GenericHub 14.10.2026 9.3
CVE-2026-102182 Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution 15.10.2026 9.3
CVE-2026-33789 Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service 15.10.2026 9.2
CVE-2026-33792 Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured 15.10.2026 9.3
CVE-2026-33796 Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled 15.10.2026 9.3
CVE-2026-102031 Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled 16.10.2026 9.3
CVE-2026-102037 Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used 16.10.2026 9.2
CVE-2026-102175 Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used 16.10.2026 9.3
CVE-2026-102178 Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise 16.10.2026 9.3
CVE-2026-109439 Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718 16.10.2026 9.3
CVE-2026-101950 Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled 17.10.2026 9.3
CVE-2026-101955 Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used 16.10.2026 9.2
CVE-2026-101990 Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised 16.10.2026 9.3
CVE-2026-101997 Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication 16.10.2026 9.2
CVE-2026-102062 Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used 15.10.2026 9.2
CVE-2026-101956 Junos OS: Unauthorized root command execution when J-Web is enabled 15.10.2026 9.3
CVE-2026-101967 Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used 15.10.2026 9.3
CVE-2026-101980 Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled 14.10.2026 9.3
CVE-2026-101986 Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution 15.10.2026 9.3
CVE-2026-102068 Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used 14.10.2026 9.2
CVE-2026-102070 Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used 14.10.2026 9.2
CVE-2026-102084 Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution 15.10.2026 9.2
CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability 15.10.2026 9.8
CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication 20.10.2026 9.9
CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim 15.10.2026 9.1
CVE-2026-86002 Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS 14.10.2026 9
CVE-2026-91881 15.10.2026 9
CVE-2026-15176 NGINX ngx_http_core_module vulnerability 15.10.2026 9.2
CVE-2026-93479 NGINX map directive and regex matching vulnerability 15.10.2026 9.2
CVE-2026-97205 NGINX ngx_http_core_module vulnerability 15.10.2026 9.2
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass 14.10.2026 9.2
CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf 14.10.2026 9.3
CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil 14.10.2026 9.3
CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API 20.10.2026 9.2
CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment 16.10.2026 9.2
CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration 20.10.2026 9.3
CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE 14.10.2026 9.2
CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings 14.10.2026 9.3
CVE-2026-110635 webp-converter before 3.0.0 OS Command Injection via File Names and Options 14.10.2026 9.3
CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths 20.10.2026 9.3
CVE-2026-110638 doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path 16.10.2026 9.3
CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir 14.10.2026 9.3
CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language 14.10.2026 9.3
CVE-2026-110643 transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath 16.10.2026 9.3
CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType 14.10.2026 9.3
CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() 14.10.2026 9.3
CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() 20.10.2026 9.2
CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names 14.10.2026 9.3
CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths 14.10.2026 9.3
CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce 14.10.2026 9.8
CVE-2026-16740 Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP 14.10.2026 9.8
CVE-2026-16741 OS Command in TR7 Cyber ​​Defense's TR7 ASP 14.10.2026 9.8
CVE-2026-107424 WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability 14.10.2026 9.8
CVE-2026-108291 WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability 15.10.2026 9.8
CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service 14.10.2026 9.2
CVE-2026-104748 SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register 15.10.2026 9.8
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS 14.10.2026 9.4
CVE-2026-104800 AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php 15.10.2026 9.8
CVE-2026-87855 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method 14.10.2026 9.8
CVE-2026-110002 Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter 15.10.2026 9.8
CVE-2026-110447 14.10.2026 9.2
CVE-2026-97657 Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter 14.10.2026 9.8
CVE-2026-97668 Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value 15.10.2026 9.8
CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning 14.10.2026 9.8
CVE-2026-92097 Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder 15.10.2026 9.1
CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url 14.10.2026 9.8

Latest Updates

CVE Title Updated Score
CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service 20.10.2026 6.5
CVE-2026-112956 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content 20.10.2026 6.5
CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing 20.10.2026
CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user 20.10.2026 4.3
CVE-2026-112953 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames 20.10.2026
CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API 20.10.2026 5.3
CVE-2025-71436 Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag 20.10.2026
CVE-2026-107755 Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs 20.10.2026
CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix 20.10.2026 5.4
CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint 20.10.2026
CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route 20.10.2026
CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route 20.10.2026
CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds 20.10.2026
CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures 20.10.2026
CVE-2026-113598 Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete 20.10.2026
CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation 20.10.2026
CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy 20.10.2026
CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity 20.10.2026
CVE-2026-113602 json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character 20.10.2026
CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource 20.10.2026
CVE-2026-113604 Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts 20.10.2026
CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database 20.10.2026
CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders 20.10.2026
CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data 20.10.2026
CVE-2026-113608 Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var 20.10.2026
CVE-2026-113609 Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts 20.10.2026
CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API 20.10.2026
CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions 20.10.2026
CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint 20.10.2026
CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin 20.10.2026
CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API 20.10.2026
CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API 20.10.2026
CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 20.10.2026
CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string 20.10.2026
CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS 20.10.2026
CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read 20.10.2026
CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password 20.10.2026
CVE-2026-113683 VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename 20.10.2026
CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user 20.10.2026
CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session 20.10.2026
CVE-2026-90798 Apache CouchDB: Replicator follows redirects indefinitely 20.10.2026
CVE-2026-90799 Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values 20.10.2026
CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases 20.10.2026
CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix 20.10.2026 5.9
CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields 20.10.2026
CVE-2026-109700 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability 20.10.2026 6.5
CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect 20.10.2026
CVE-2026-111764 A2A Java SDK has a fail-open default task authorization 20.10.2026 7.5
CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix 20.10.2026 7.5
CVE-2026-111843 WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability 20.10.2026 6.5
CVE-2026-112823 WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability 20.10.2026 4.3
CVE-2026-112824 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability 20.10.2026 5.3
CVE-2026-112829 WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability 20.10.2026 5.3
CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability 20.10.2026 8.8
CVE-2026-112840 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability 20.10.2026 6.5
CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware 20.10.2026
CVE-2026-112946 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 20.10.2026
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` 20.10.2026
CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file 20.10.2026 6.5
CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration 20.10.2026 4.7
CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return 20.10.2026
CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure 20.10.2026
CVE-2026-92853 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure 20.10.2026
CVE-2026-93475 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 20.10.2026
CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path 20.10.2026
CVE-2026-94023 Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion 20.10.2026
CVE-2026-94024 Module Manager object lookup validates one byte of a module's search name 20.10.2026
CVE-2026-94192 Module object deallocation can free a live ThreadX kernel object 20.10.2026
CVE-2026-94202 Module block-pool create validates two of the four parameter words it reads 20.10.2026
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool 20.10.2026
CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack 20.10.2026
CVE-2026-95109 Cortex-A7 module data validation checks only the first address of a caller-supplied range 20.10.2026
CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery 20.10.2026 5.8
CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure 20.10.2026
CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 20.10.2026
CVE-2026-92454 JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode 20.10.2026 6.1
CVE-2026-112833 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability 20.10.2026 6.5
CVE-2026-112834 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability 20.10.2026 5.3
CVE-2026-112942 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 20.10.2026
CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows 20.10.2026
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size 20.10.2026
CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write 20.10.2026
CVE-2026-91189 GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme 20.10.2026
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader 20.10.2026
CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena 20.10.2026
CVE-2026-112936 filelock: ReadWriteLock follows a symlink at the lock path into SQLite 20.10.2026 6.1
CVE-2026-112937 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name 20.10.2026 6.1
CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker 20.10.2026 4.7
CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files 20.10.2026 7.1
CVE-2026-112941 filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock 20.10.2026 3.3
CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key 20.10.2026
CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream 20.10.2026
CVE-2026-95111 Module queue front-send validates a word count as a byte count 20.10.2026
CVE-2026-95168 20.10.2026
CVE-2026-112911 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion 20.10.2026 6.3
CVE-2026-112912 filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker 20.10.2026 2.5
CVE-2026-112914 filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory 20.10.2026 5.3
CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout 20.10.2026 5.5
CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record 20.10.2026 6.1
CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders 20.10.2026 4.7
CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme 20.10.2026
CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count 20.10.2026
CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse 20.10.2026 4.7
CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path 20.10.2026 6.1
CVE-2026-113397 DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection 20.10.2026
CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader) 20.10.2026
CVE-2026-113396 DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection 20.10.2026
CVE-2026-103119 Apache Tomcat: AJP response mix-up 20.10.2026
CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms 20.10.2026
CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing 20.10.2026
CVE-2026-113395 DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal 20.10.2026
CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up 20.10.2026
CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) 20.10.2026
CVE-2026-80353 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector 20.10.2026
CVE-2026-88041 Apache Tomcat: HTTP/2 trailer header cross-contamination 20.10.2026
CVE-2026-93446 Apache Tomcat: Possible TLS 1.3 connection failures 20.10.2026
CVE-2026-113394 DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal 20.10.2026
CVE-2026-113393 DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload 20.10.2026
CVE-2026-91041 FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image 20.10.2026 7.8
CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound 20.10.2026 4.9
CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser 20.10.2026 4.9
CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname 20.10.2026
CVE-2026-113392 DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal 20.10.2026
CVE-2026-113399 Incorrect boundary conditions in the SVG component 20.10.2026
CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component 20.10.2026
CVE-2026-113401 Denial-of-service in the PDF Viewer component 20.10.2026
CVE-2026-113470 Cryptographic issue in the Security Block-lists, Allow-lists, and other State component 20.10.2026
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection 20.10.2026
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection 20.10.2026
CVE-2026-113619 Eclipse ioFog renders request templates before authentication 20.10.2026 7.5
CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT 20.10.2026 9.8
CVE-2026-34484 A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX) 20.10.2026
CVE-2026-34485 A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX) 20.10.2026
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection 20.10.2026
CVE-2026-113388 opensource-socialnetwork Cache Settings dynamic.php input code injection 20.10.2026
CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js 20.10.2026
CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy 20.10.2026
CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation 20.10.2026
CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints 20.10.2026
CVE-2026-18205 XSS in Ticimax Informatics' Ticimax E-Commerce Platform 20.10.2026 6.1
CVE-2026-113385 LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components 20.10.2026
CVE-2026-113495 Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments 20.10.2026
CVE-2026-113496 Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments 20.10.2026
CVE-2026-14933 Unblu Spark Cross-Site Scripting in Embedded Co-Browsing 20.10.2026
CVE-2026-113384 Optimal IdM OptimalCloud social redirect 20.10.2026
CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations 20.10.2026
CVE-2026-113383 Optimal IdM OptimalCloud Login cross site scripting 20.10.2026
CVE-2026-112783 OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints 20.10.2026
CVE-2026-112784 OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php 20.10.2026
CVE-2026-112785 OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints 20.10.2026
CVE-2026-112786 OpenCATS before 0.10.0 Missing Authorization via Import Revert Action 20.10.2026
CVE-2026-112787 OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports 20.10.2026
CVE-2026-113349 OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent 20.10.2026
CVE-2026-113350 react-admin before 5.15.5 Stored XSS via UrlField and FileField 20.10.2026
CVE-2026-113351 libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset 20.10.2026
CVE-2026-113352 uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers 20.10.2026
CVE-2026-113353 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers 20.10.2026
CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content 20.10.2026
CVE-2026-113355 Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links 20.10.2026
CVE-2026-113356 DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition 20.10.2026
CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker 20.10.2026
CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes 20.10.2026
CVE-2026-108086 Apache Cocoon: XEE could lead to SSRF and information disclosure 20.10.2026
CVE-2026-108087 Apache Cocoon: SQL Injection 20.10.2026
CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning 20.10.2026
CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces 20.10.2026
CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme 20.10.2026
CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop 20.10.2026
CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload 20.10.2026
CVE-2026-111844 WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability 20.10.2026 6.5
CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection 20.10.2026
CVE-2026-112064 SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin) 20.10.2026
CVE-2026-112065 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) 20.10.2026
CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) 20.10.2026
CVE-2026-112067 Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha) 20.10.2026
CVE-2026-112068 Insecure Direct Object Reference in extension "Analytics" (analytics) 20.10.2026
CVE-2026-112069 Broken Access Control in extension "FAL Protect" (fal_protect) 20.10.2026
CVE-2026-112070 Broken Access Control in extension "Analytics" (analytics) 20.10.2026
CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) 20.10.2026
CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf) 20.10.2026
CVE-2026-112238 SQL Injection in extension "File manager" (ameos_filemanager) 20.10.2026
CVE-2026-112239 Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai) 20.10.2026
CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) 20.10.2026
CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection 20.10.2026
CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) 20.10.2026
CVE-2026-113459 Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai) 20.10.2026
CVE-2026-113468 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) 20.10.2026
CVE-2026-43857 20.10.2026
CVE-2026-43858 20.10.2026
CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell 20.10.2026
CVE-2026-43849 20.10.2026
CVE-2026-43850 20.10.2026
CVE-2026-43851 20.10.2026
CVE-2026-43852 20.10.2026
CVE-2026-43853 20.10.2026
CVE-2026-43854 20.10.2026
CVE-2026-43855 20.10.2026
CVE-2026-43856 20.10.2026
CVE-2026-43846 20.10.2026
CVE-2026-43847 20.10.2026
CVE-2026-43848 20.10.2026
CVE-2026-43841 20.10.2026
CVE-2026-43842 20.10.2026
CVE-2026-43843 20.10.2026
CVE-2026-43844 20.10.2026
CVE-2026-43845 20.10.2026
CVE-2026-101201 QBinaryJson::fromBinaryData() integer overflow leading to OOB read 20.10.2026
CVE-2026-113465 Possible DOM XSS in SNS Web Administration Portal 20.10.2026 6.6
CVE-2026-113469 Improper Signature Verification of Active Update Files 20.10.2026 7.5
CVE-2026-11959 Multiple vulnerabilities in FacturaScripts 20.10.2026
CVE-2026-11960 Multiple vulnerabilities in FacturaScripts 20.10.2026
CVE-2026-43836 20.10.2026
CVE-2026-43837 20.10.2026
CVE-2026-43838 20.10.2026
CVE-2026-43839 20.10.2026
CVE-2026-43840 20.10.2026
CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation 20.10.2026
CVE-2026-43834 20.10.2026
CVE-2026-43835 20.10.2026
CVE-2024-2323 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery 20.10.2026 4.8
CVE-2026-111090 Improper Signature Verification of Firmware Update Files 20.10.2026 7.8
CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 20.10.2026
CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection 20.10.2026
CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection 20.10.2026
CVE-2026-113407 YS-infoware｜BA-Workflow - SQL Injection 20.10.2026
CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization 20.10.2026 4.8
CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding 20.10.2026 6.1
CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references 20.10.2026 3.7
CVE-2026-113403 ArmorX Global Technology｜ArmorX Spam - Command Injection 20.10.2026
CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization 20.10.2026 3.7
CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action 20.10.2026 6.4
CVE-2026-112148 20.10.2026
CVE-2026-113402 ArmorX Global Technology｜ArmorX Spam - Local File Inclusion 20.10.2026
CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization 20.10.2026
CVE-2026-96902 Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API 20.10.2026
CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers 20.10.2026
CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter 20.10.2026 7.5
CVE-2026-100737 20.10.2026
CVE-2026-97627 20.10.2026
CVE-2026-113386 20.10.2026 7.1
CVE-2026-109831 20.10.2026
CVE-2026-113380 20.10.2026
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account 20.10.2026
CVE-2026-12489 20.10.2026 6.5
CVE-2026-102438 20.10.2026
CVE-2026-17518 20.10.2026
CVE-2026-75753 20.10.2026
CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments 20.10.2026 8.7
CVE-2026-105297 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits 20.10.2026 7.5
CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass 20.10.2026
CVE-2026-109395 Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder 20.10.2026
CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode 20.10.2026
CVE-2026-109441 LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge 20.10.2026
CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell 20.10.2026
CVE-2026-109443 JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell 20.10.2026
CVE-2026-109444 OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection 20.10.2026
CVE-2026-28850 20.10.2026
CVE-2026-28853 20.10.2026
CVE-2026-28854 20.10.2026
CVE-2026-65356 20.10.2026
CVE-2026-65372 20.10.2026
CVE-2026-65379 20.10.2026
CVE-2026-65396 20.10.2026
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint 20.10.2026
CVE-2026-77926 Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool 20.10.2026
CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents 20.10.2026
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent 20.10.2026
CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 20.10.2026
CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner 20.10.2026
CVE-2026-77935 Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers 20.10.2026
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 20.10.2026
CVE-2026-77937 Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header 20.10.2026
CVE-2026-77938 Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance 20.10.2026
CVE-2026-84490 20.10.2026
CVE-2026-84508 20.10.2026
CVE-2026-84547 20.10.2026
CVE-2026-84579 20.10.2026
CVE-2026-84582 20.10.2026
CVE-2026-84613 20.10.2026
CVE-2026-86868 20.10.2026
CVE-2026-86871 20.10.2026
CVE-2026-86872 20.10.2026
CVE-2026-86874 20.10.2026
CVE-2026-86875 20.10.2026
CVE-2026-86907 20.10.2026
CVE-2026-86913 20.10.2026
CVE-2026-86914 20.10.2026
CVE-2026-86915 20.10.2026
CVE-2026-86918 20.10.2026
CVE-2026-86919 20.10.2026
CVE-2026-86921 20.10.2026
CVE-2026-86922 20.10.2026
CVE-2026-86928 20.10.2026
CVE-2026-86932 20.10.2026
CVE-2026-86933 20.10.2026
CVE-2026-86935 20.10.2026
CVE-2026-86940 20.10.2026
CVE-2026-86944 20.10.2026
CVE-2026-86948 20.10.2026
CVE-2026-86949 20.10.2026
CVE-2026-86953 20.10.2026
CVE-2026-86955 20.10.2026
CVE-2026-86957 20.10.2026
CVE-2026-86959 20.10.2026
CVE-2026-86961 20.10.2026
CVE-2026-86962 20.10.2026
CVE-2026-86963 20.10.2026
CVE-2026-86975 20.10.2026
CVE-2026-86976 20.10.2026
CVE-2026-86977 20.10.2026
CVE-2026-86979 20.10.2026
CVE-2026-86981 20.10.2026
CVE-2026-105453 IBM Sterling Connect:Direct for Unix Improper Privilege Management 19.10.2026 8.4
CVE-2026-107366 Langflow OSS Authorization Bypass Through User-Controlled Key 20.10.2026 8.3
CVE-2026-107400 Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication 20.10.2026 8.8
CVE-2026-109126 IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials 20.10.2026 8.8
CVE-2026-8355 IBM ContextForge MCP Gateway is affected by server-side request forgery 20.10.2026
CVE-2026-112373 H3C Magic NX15 usrlist sub_416874 stack-based overflow 20.10.2026
CVE-2025-36061 TS4500 Tape Library Denial of Service 20.10.2026 6.5
CVE-2025-36069 TS4500 Tape Library Insufficient Session Expiration 19.10.2026 5.5
CVE-2025-36252 TS4500 Tape Library Insufficient Session Expiration 19.10.2026 6.3
CVE-2026-19178 TS4500 Tape Library Race Condition 20.10.2026 6.8
CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access 19.10.2026 6.1
CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service 19.10.2026 5.7
CVE-2026-112372 H3C Magic NX15 upload importprofile path traversal 19.10.2026
CVE-2026-112371 H3C Magic NX15 RPC esps write code injection 20.10.2026
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection 19.10.2026
CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url() 20.10.2026
CVE-2026-112896 Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read 20.10.2026
CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips 19.10.2026
CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory 19.10.2026
CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE 20.10.2026
CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes 19.10.2026
CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active 19.10.2026
CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) 20.10.2026
CVE-2026-112895 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) 19.10.2026
CVE-2026-112361 Dolibarr CSP document.php protection mechanism 20.10.2026
CVE-2026-112257 Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) 20.10.2026
CVE-2026-112258 Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels 19.10.2026
CVE-2026-112261 Gimp: gimp: use-after-free in xcf loader via prop_selected_path 19.10.2026
CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle 19.10.2026
CVE-2026-112891 Pillow: Quadratic GIF comment copying during save 20.10.2026
CVE-2026-112892 Pillow: MSP RLE decoder expands a tiny file into unbounded memory 19.10.2026