CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater 13.10.2026 9.1
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions 13.10.2026 9.3
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 13.10.2026 10
CVE-2026-104192 DragonflyDB stream RDB deserialization double-free 13.10.2026 9.6
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 13.10.2026 9.8
CVE-2026-77099 CVFS Command Execution 13.10.2026 9.3
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 13.10.2026 9.3
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 13.10.2026 9.4
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch 13.10.2026 9.4
CVE-2026-65162 13.10.2026 10
CVE-2026-65173 13.10.2026 9.1
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflow 13.10.2026 9.4
CVE-2026-63350 13.10.2026 9.4
CVE-2026-63353 13.10.2026 9.4
CVE-2026-63354 13.10.2026 9.4
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection 13.10.2026 10
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow 13.10.2026 10
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection 13.10.2026 9.4
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification 13.10.2026 9.4
CVE-2026-109758 13.10.2026 9.3
CVE-2026-97229 Integer Overflow or Wraparound in GitLab 13.10.2026 10
CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints 13.10.2026 9.8
CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) 13.10.2026 9.9
CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) 13.10.2026 9.1
CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer 13.10.2026 9.9
CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python 13.10.2026 10
CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI 13.10.2026 9.9
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint 13.10.2026 9.2
CVE-2026-82101 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-82103 DataStage on Cloud Pak for Data Information Disclosure 13.10.2026 9.6
CVE-2026-82110 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials 12.10.2026 9.3
CVE-2026-90920 Maximo AI Service Code Injection 13.10.2026 9.8
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function 12.10.2026 9.2
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py 12.10.2026 9.3
CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder 12.10.2026 9.3
CVE-2026-109569 sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace 12.10.2026 9.3
CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle 12.10.2026 9.1
CVE-2026-108929 Netcore NR268 DDNS DDNSset.cgi execvp argument injection 12.10.2026 9.4
CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC 12.10.2026 9.2
CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass 12.10.2026 9.1
CVE-2026-109575 12.10.2026 9.8
CVE-2026-96012 IBM Db2 Mirror for i Privilege Escalation 13.10.2026 9.9
CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) 13.10.2026 9.1
CVE-2026-57118 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints 12.10.2026 9.8
CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations 12.10.2026 9.1
CVE-2026-108918 Edimax BR-6208AC formWlanMP command injection 12.10.2026 10
CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults 13.10.2026 9.9
CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade command injection 12.10.2026 10
CVE-2026-108915 Edimax BR-6208AC formWlanMP buffer overflow 12.10.2026 9.4
CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey buffer overflow 12.10.2026 9.4
CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authentication 12.10.2026 10
CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder 13.10.2026 9.2
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass 12.10.2026 9.3
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header 12.10.2026 9.2
CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion 12.10.2026 9.3
CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie 12.10.2026 9.2
CVE-2026-85955 Improper privilege management in Progress MarkLogic Server xdmp:eval-in 12.10.2026 9.9
CVE-2026-85956 Improper privilege management in Progress MarkLogic Server backup and restore operations 12.10.2026 9.6
CVE-2026-85947 Improper privilege management in Progress MarkLogic Server forest operations 12.10.2026 9.9
CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API 12.10.2026 9.9
CVE-2026-9191 Insufficient isolation of user-supplied code in Progress MarkLogic Server 12.10.2026 9.6
CVE-2026-109391 Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API 12.10.2026 9.2
CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout 12.10.2026 9.1
CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates 12.10.2026 9.2
CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields 12.10.2026 9.3
CVE-2026-109390 13.10.2026 9.8
CVE-2026-108895 Linksys E1700 setDMZ os command injection 13.10.2026 9.4
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection 12.10.2026 9.4
CVE-2026-108894 Linksys E1700 Static Route addStaticRoute os command injection 12.10.2026 9.4
CVE-2026-108892 Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow 12.10.2026 10
CVE-2026-108893 Linksys E1700 setVlan stack-based overflow 12.10.2026 9.4
CVE-2026-78357 Insufficient Session Revocation for JWT Authentication 12.10.2026 9.1
CVE-2026-93582 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication 12.10.2026 9.4
CVE-2026-108804 TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection 12.10.2026 10
CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key 11.10.2026 9.3
CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection 11.10.2026 10
CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose 11.10.2026 9.3
CVE-2026-108540 OpenSpug File Transfer transfer os command injection 11.10.2026 9.4
CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect 11.10.2026 9.3
CVE-2026-39801 WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-40800 WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-42696 WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability 13.10.2026 10
CVE-2026-42716 WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42718 WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42719 WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-42723 WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62022 WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-62024 WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability 11.10.2026 9.9
CVE-2026-62025 WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability 11.10.2026 9
CVE-2026-62031 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-62032 WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability 11.10.2026 9.8
CVE-2026-62050 WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62051 WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62052 WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62053 WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62054 WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62076 WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62077 WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62086 WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62087 WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62090 WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62120 WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62123 WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62124 WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62125 WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62129 WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability 11.10.2026 9.9
CVE-2026-66482 WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66483 WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66563 WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66564 WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66565 WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66567 WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66568 WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-66569 WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78529 WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78531 WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78533 WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-78535 WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-81797 WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates 13.10.2026 9.3
CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability 11.10.2026 9.8
CVE-2026-106610 WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability 11.10.2026 9.8
CVE-2026-104398 WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-105889 WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing 13.10.2026 9.2
CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates 10.10.2026 9.3
CVE-2026-104803 WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback 11.10.2026 9.8
CVE-2026-62045 WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-62046 WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93927 WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93929 WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93930 WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93931 WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93932 WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93933 WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93934 WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93935 WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93936 WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93937 WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93938 WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93940 WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93941 WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93942 WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93943 WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93944 WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-93945 WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability 11.10.2026 9.8
CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter 11.10.2026 9.1
CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter 11.10.2026 9.8
CVE-2026-97670 Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field 11.10.2026 9.1
CVE-2026-104732 Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler 11.10.2026 9.8
CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter 11.10.2026 9.1
CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload 11.10.2026 9.8
CVE-2026-108474 12.10.2026 9.8
CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session 13.10.2026 9.1
CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session 13.10.2026 9.1
CVE-2026-108269 ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session 09.10.2026 9.1
CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session 09.10.2026 9.1
CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) 13.10.2026 9.1
CVE-2026-108265 enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session 13.10.2026 9.1
CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment 13.10.2026 9.3
CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 09.10.2026 9.9
CVE-2026-107845 Contao: Cross-site scripting in the comments bundle 09.10.2026 9.3
CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients 09.10.2026 9.3
CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking 09.10.2026 9.2
CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite 09.10.2026 9.4
CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow 11.10.2026 9.3
CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php 09.10.2026 9.3
CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code 09.10.2026 9.3
CVE-2026-28745 Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format 11.10.2026 9.3
CVE-2026-33367 Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function 11.10.2026 9.3
CVE-2026-39460 Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials 12.10.2026 9.3
CVE-2026-105278 Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials 11.10.2026 9.3
CVE-2026-32645 Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials 12.10.2026 9.2
CVE-2026-100730 Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data 11.10.2026 9.3
CVE-2026-86405 Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop 12.10.2026 9.8
CVE-2026-85531 Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x 12.10.2026 9.8
CVE-2026-93947 WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability 12.10.2026 10
CVE-2026-96327 WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96328 WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96330 WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-96331 WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability 09.10.2026 9.3
CVE-2026-96809 WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability 11.10.2026 9.3
CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose 12.10.2026 9.3
CVE-2026-107908 Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message 09.10.2026 9.3
CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling 09.10.2026 9.2
CVE-2026-5759 Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB 09.10.2026 9.3
CVE-2026-7827 Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB 09.10.2026 9.2
CVE-2026-69435 Azure SRE Agent Elevation of Privilege Vulnerability 10.10.2026 9.6
CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability 10.10.2026 9.8
CVE-2026-88131 Microsoft Dataverse Remote Code Execution Vulnerability 10.10.2026 9.8
CVE-2026-94510 Microsoft Bookings Elevation of Privilege Vulnerability 10.10.2026 9.9
CVE-2026-96207 Microsoft Partner Center Elevation of Privilege Vulnerability 10.10.2026 10
CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client 09.10.2026 9.3
CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion 08.10.2026 9.8
CVE-2026-75875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection 10.10.2026 9.8
CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection 10.10.2026 9.8
CVE-2026-84249 IBM Guardium Data Protection is affected by vulnerability 10.10.2026 9.8
CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service 10.10.2026 9.5
CVE-2026-16823 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-16916 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-19491 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.1
CVE-2026-78401 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.8
CVE-2026-78406 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 10.10.2026 9.8
CVE-2026-79842 10.10.2026 9.1
CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE 08.10.2026 9.3
CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter 08.10.2026 9.3
CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById 09.10.2026 9.1
CVE-2026-106126 Command Injection 08.10.2026 9.4
CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login 08.10.2026 9.3
CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API 09.10.2026 9.3
CVE-2026-84244 IBM Guardium Data Protection Cross-Site Scripting 08.10.2026 9.3
CVE-2026-84272 IBM Guardium Data Protection Missing Authentication 10.10.2026 9.8
CVE-2026-107699 ppt2png through 0.0.6 OS Command Injection via input and output paths 08.10.2026 9.3
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument 09.10.2026 9.3
CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo 08.10.2026 9.3
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format 09.10.2026 9.3
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx 08.10.2026 9.3
CVE-2026-14269 IBM DataPower Gateway Buffer Overflow 09.10.2026 9.8
CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API 08.10.2026 9.3
CVE-2026-14502 IBM DataPower Gateway Improper Authentication 09.10.2026 9.8
CVE-2026-14992 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-14990 IBM DataPower Gateway affected by cross-site scripting 08.10.2026 9.3
CVE-2026-14991 IBM DataPower Gateway Out-of-bounds Write 10.10.2026 9.8
CVE-2026-103663 Path Traversal leading to Remote Code Execution in Ollama 08.10.2026 9.4
CVE-2026-15762 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-16340 IBM DataPower Gateway Out-of-bounds Write 09.10.2026 9.8
CVE-2026-19218 Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta 08.10.2026 9.1
CVE-2026-92555 Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel 08.10.2026 9.8
CVE-2026-107510 Authenticated argument injection in NIOS command line leading to privilege escalation 09.10.2026 9.1
CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter 08.10.2026 9.3
CVE-2026-12260 SQL injection in the NetBoard CRM demo platform 08.10.2026 10
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter 08.10.2026 9.8
CVE-2026-107459 Openfind｜SecuShare Pro - OS Command Injection 08.10.2026 9.3
CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter 10.10.2026 9.1
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host 10.10.2026 9.4
CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise 09.10.2026 9.8
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability 07.10.2026 9.3
CVE-2026-95606 WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability 07.10.2026 9.8
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability 08.10.2026 9.1
CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation 07.10.2026 9.1
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login 07.10.2026 9.8
CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) 10.10.2026 9.8
CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability 07.10.2026 9.1
CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities 08.10.2026 9.8
CVE-2026-76459 Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities 09.10.2026 9.8
CVE-2026-76464 Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities 07.10.2026 9.6
CVE-2026-76465 Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76480 Cisco License On-Prem Security Hardening Release 08.10.2026 9.8
CVE-2026-76482 Cisco License On-Prem Security Hardening Release 08.10.2026 10
CVE-2026-76483 Cisco License On-Prem Security Hardening Release 08.10.2026 9.1
CVE-2026-76485 Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76486 Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-76498 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities 07.10.2026 9.8
CVE-2026-76499 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities 07.10.2026 9.8
CVE-2026-76500 Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities 08.10.2026 9.8
CVE-2026-76501 Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability 08.10.2026 9.8
CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens 07.10.2026 9.3
CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint 07.10.2026 9.3
CVE-2026-107194 10.10.2026 9.2
CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser 07.10.2026 9.2
CVE-2026-96408 07.10.2026 9.3
CVE-2026-105192 LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization 07.10.2026 9.8
CVE-2026-103416 07.10.2026 9.3
CVE-2025-64393 08.10.2026 9.4
CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 08.10.2026 9.3
CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System 07.10.2026 9.3
CVE-2026-59346 VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability 07.10.2026 9.3
CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability 07.10.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2026-101899 Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 13.10.2026
CVE-2026-102672 Electron: Local race condition in Squirrel.Mac update installation on macOS 13.10.2026 6.7
CVE-2026-54697 ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing 13.10.2026
CVE-2026-54700 ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation 13.10.2026
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater 13.10.2026 9.1
CVE-2026-102699 Arm: multiple issues with GNTTABOP_cache_flush 13.10.2026
CVE-2026-102700 gnttab: cache-flush handling may cause page reference leak 13.10.2026
CVE-2026-102702 Arm: multiple issues with GNTTABOP_cache_flush 13.10.2026
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions 13.10.2026
CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert 13.10.2026
CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces 13.10.2026
CVE-2026-109605 SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization 13.10.2026
CVE-2026-110025 slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload 13.10.2026
CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation 13.10.2026 6.1
CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison 13.10.2026 6.8
CVE-2026-78802 13.10.2026
CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update 13.10.2026
CVE-2026-79608 x86/AMD: ineffectual Zenbleed workaround 13.10.2026
CVE-2026-79609 x86: XPTI may break on huge-memory systems 13.10.2026
CVE-2026-79610 grant-table: double version change race 13.10.2026
CVE-2026-79611 VMX: VMentry failure with branch tracing and blocked states 13.10.2026
CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter 13.10.2026 5.5
CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked 13.10.2026 4.2
CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage 13.10.2026 6.5
CVE-2026-102982 Plane: XSS in work item comments 13.10.2026
CVE-2026-102988 Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) 13.10.2026 5.3
CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references 13.10.2026
CVE-2026-104935 13.10.2026 8.6
CVE-2026-109526 HBAI-Ltd Toonflow-app exportData Endpoint information disclosure 13.10.2026
CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map 13.10.2026
CVE-2026-88836 13.10.2026
CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline 13.10.2026
CVE-2026-96299 MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM 13.10.2026
CVE-2024-34320 13.10.2026
CVE-2024-34321 13.10.2026
CVE-2024-34323 13.10.2026
CVE-2024-34324 13.10.2026
CVE-2024-34326 13.10.2026
CVE-2026-105460 Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() 13.10.2026
CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization 13.10.2026
CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization 13.10.2026
CVE-2026-55376 heym Python Tool Sandbox Escape 13.10.2026 8.8
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 13.10.2026 10
CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data 13.10.2026 6.5
CVE-2024-34319 13.10.2026
CVE-2026-102250 13.10.2026
CVE-2026-103028 SFTPGo source-side file-pattern filter bypass during copy operations 13.10.2026 4.3
CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory 13.10.2026
CVE-2026-107917 Insufficient input validation vulnerability in NETGEAR R7300 router 13.10.2026
CVE-2026-107918 Insufficient input validation vulnerability in NETGEAR R7300 13.10.2026
CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request 13.10.2026 6.5
CVE-2026-95127 13.10.2026
CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes 13.10.2026 5.4
CVE-2026-104192 DragonflyDB stream RDB deserialization double-free 13.10.2026 9.6
CVE-2026-108184 13.10.2026 7.4
CVE-2026-108185 13.10.2026 7.4
CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection 13.10.2026
CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection 13.10.2026
CVE-2026-11730 Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models 13.10.2026
CVE-2026-11731 Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models 13.10.2026
CVE-2026-11732 Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models 13.10.2026
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 13.10.2026 9.8
CVE-2026-53711 MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI 13.10.2026
CVE-2026-95122 13.10.2026
CVE-2026-9218 Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access 13.10.2026
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint 13.10.2026
CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding 13.10.2026
CVE-2026-109521 girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection 13.10.2026
CVE-2026-12655 1732E ArmorBlock® - Multiple Vulnerabilities 13.10.2026
CVE-2026-12656 1732E ArmorBlock® - Multiple Vulnerabilities 13.10.2026
CVE-2026-18228 Hyperscale Path Traversal 13.10.2026
CVE-2026-4869 Potential Privilege Escalation in InstallShield 13.10.2026
CVE-2026-53418 13.10.2026 8.1
CVE-2026-53420 13.10.2026 8
CVE-2026-65197 H3C G3/G5 HDM Firmware Verification Key Replacement 13.10.2026 3.1
CVE-2026-65198 Huawei Default SNMPv3 USM key 13.10.2026 8.6
CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation 13.10.2026 5.4
CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses 13.10.2026 3.5
CVE-2026-77090 CVFS Information Disclosure 13.10.2026
CVE-2026-77093 CvFWD Denial of Service 13.10.2026
CVE-2026-77094 CvFWD Out-of-Bounds Write 13.10.2026
CVE-2026-77095 CvFWD Null Pointer Dereference 13.10.2026
CVE-2026-77096 CVFS Missing Authentication 13.10.2026
CVE-2026-77099 CVFS Command Execution 13.10.2026
CVE-2026-77100 MediaAgent Denial of Service 13.10.2026
CVE-2026-95114 13.10.2026
CVE-2026-95115 13.10.2026
CVE-2026-95117 13.10.2026
CVE-2026-95121 13.10.2026
CVE-2026-95124 13.10.2026
CVE-2026-97333 QAPI stack-based buffer overflow 13.10.2026
CVE-2026-97334 Network messaging layer decompression resource exhaustion 13.10.2026
CVE-2025-58771 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58772 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58773 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2025-58774 UEFI OOB Write and Buffer Overflow Vulnerabilities 13.10.2026
CVE-2026-0893 Uncleared Password Keystrokes Vulnerability 13.10.2026
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 13.10.2026
CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root 13.10.2026
CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method 13.10.2026
CVE-2026-109967 yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats 13.10.2026
CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions 13.10.2026 4.7
CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL 13.10.2026 4.3
CVE-2026-103499 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service 13.10.2026 7.5
CVE-2026-109519 YouTransfer Template Rendering template path traversal 13.10.2026
CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder 13.10.2026
CVE-2026-93907 IBM WebSphere Application Server is affected by a bypass authentication vulnerability 13.10.2026 8.1
CVE-2026-95680 IBM WebSphere Application Server is affected by an authorization bypass 13.10.2026 8
CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames 13.10.2026 3.7
CVE-2026-109409 HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection 13.10.2026
CVE-2026-109410 macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation 13.10.2026
CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect 13.10.2026
CVE-2026-109677 FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler 13.10.2026
CVE-2026-109678 FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA 13.10.2026
CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response 13.10.2026
CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username 13.10.2026
CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update 13.10.2026
CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order 13.10.2026
CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name 13.10.2026
CVE-2026-109941 FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response 13.10.2026
CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet 13.10.2026
CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order 13.10.2026
CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle 13.10.2026
CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit 13.10.2026
CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width 13.10.2026
CVE-2026-109947 FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read 13.10.2026
CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection 13.10.2026
CVE-2026-109949 FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard 13.10.2026
CVE-2026-109950 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages 13.10.2026
CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name 13.10.2026
CVE-2026-109952 FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response 13.10.2026
CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin 13.10.2026
CVE-2026-109954 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference 13.10.2026
CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding 13.10.2026
CVE-2026-109956 NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path 13.10.2026
CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter 13.10.2026
CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search 13.10.2026
CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint 13.10.2026
CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value 13.10.2026
CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members 13.10.2026
CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API 13.10.2026
CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php 13.10.2026
CVE-2026-74030 Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion 13.10.2026
CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers 13.10.2026
CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions 13.10.2026
CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers 13.10.2026
CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command 13.10.2026
CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user 13.10.2026
CVE-2026-74036 Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies 13.10.2026
CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token 13.10.2026
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 13.10.2026
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch 13.10.2026
CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions 13.10.2026
CVE-2026-74045 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder 13.10.2026
CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint 13.10.2026
CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition 13.10.2026
CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file 13.10.2026
CVE-2026-109407 macrozheng mall Coupon Redemption generateOrder race condition 13.10.2026
CVE-2026-65101 13.10.2026 8.6
CVE-2026-65103 13.10.2026 8.1
CVE-2026-65104 13.10.2026 7.1
CVE-2026-65110 13.10.2026 7.8
CVE-2026-65131 13.10.2026 6
CVE-2026-65161 13.10.2026 7.5
CVE-2026-65162 13.10.2026 10
CVE-2026-65164 13.10.2026 8.1
CVE-2026-65170 13.10.2026 8.6
CVE-2026-65172 13.10.2026 8.6
CVE-2026-65173 13.10.2026 9.1
CVE-2026-65180 13.10.2026 7.8
CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery 13.10.2026
CVE-2026-109406 macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error 13.10.2026
CVE-2026-109704 Privilege escalation in the Application Update component 13.10.2026
CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component 13.10.2026
CVE-2026-109706 Use-after-free in the Storage: IndexedDB component 13.10.2026
CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component 13.10.2026
CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component 13.10.2026
CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing component 13.10.2026
CVE-2026-109710 Use-after-free in the Graphics: Text component 13.10.2026
CVE-2026-109711 Use-after-free in the Graphics: Canvas2D component 13.10.2026
CVE-2026-109712 Sandbox escape due to uninitialized memory in the Graphics component 13.10.2026
CVE-2026-109713 Use-after-free in the Crash Reporting component 13.10.2026
CVE-2026-109714 Incorrect boundary conditions in the Layout component 13.10.2026
CVE-2026-109715 Incorrect boundary conditions in the JavaScript Engine component 13.10.2026
CVE-2026-109716 Incorrect boundary conditions in the JavaScript Engine component 13.10.2026
CVE-2026-109717 Use-after-free in the DOM: Bindings (WebIDL) component 13.10.2026
CVE-2026-109718 Use-after-free in the XML component 13.10.2026
CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component 13.10.2026
CVE-2026-109720 JIT miscompilation in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109721 Incorrect boundary conditions in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109723 Integer overflow in the Layout: Text and Fonts component 13.10.2026
CVE-2026-109724 Use-after-free in the DOM: Core & HTML component 13.10.2026
CVE-2026-109725 Use-after-free in the DOM: Core & HTML component 13.10.2026
CVE-2026-109726 Use-after-free in the SVG component 13.10.2026
CVE-2026-109727 Use-after-free in the Audio/Video component 13.10.2026
CVE-2026-109728 Use-after-free in the DOM: Animation component 13.10.2026
CVE-2026-109729 Use-after-free in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109730 Integer overflow in the Graphics component 13.10.2026
CVE-2026-109731 Incorrect boundary conditions in the Graphics: Canvas2D component 13.10.2026
CVE-2026-109732 Use-after-free in the DOM: Streams component 13.10.2026
CVE-2026-109733 JIT miscompilation in the JavaScript Engine: JIT component 13.10.2026
CVE-2026-109734 Mitigation bypass in the DOM: Security component 13.10.2026
CVE-2026-109735 Use-after-free in the DOM: Animation component 13.10.2026
CVE-2026-109736 Frame poisoning in the Layout component 13.10.2026
CVE-2026-109737 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109738 Use-after-free in the Audio/Video: Playback component 13.10.2026
CVE-2026-109739 Privilege escalation in the WebExtensions component 13.10.2026
CVE-2026-109740 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component 13.10.2026
CVE-2026-109741 Use-after-free in the Storage: Bucket File System component 13.10.2026
CVE-2026-109742 Information disclosure in the PDF Viewer component 13.10.2026
CVE-2026-109743 Privilege escalation in the Panning and Zooming component 13.10.2026
CVE-2026-109744 Other issue in the DOM: File component 13.10.2026
CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component 13.10.2026
CVE-2026-109746 Mitigation bypass in the DOM: Security component 13.10.2026
CVE-2026-109747 Other issue in the Address Bar component 13.10.2026
CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component 13.10.2026
CVE-2026-109751 Information disclosure in the Networking component 13.10.2026
CVE-2026-109752 Use-after-free in the DOM: Workers component 13.10.2026
CVE-2026-109753 Incorrect boundary conditions in the Layout component 13.10.2026
CVE-2026-109754 Incorrect boundary conditions in the DOM: Editor component 13.10.2026
CVE-2026-109755 Sandbox escape in the DOM: Content Processes component 13.10.2026
CVE-2026-109756 Privilege escalation in the DOM: Navigation component 13.10.2026
CVE-2026-109757 Sandbox escape due to race condition in the Networking component 13.10.2026
CVE-2026-109759 Site isolation issue in the Networking component 13.10.2026
CVE-2026-109760 Mitigation bypass in the Networking: HTTP component 13.10.2026
CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component 13.10.2026
CVE-2026-109762 Incorrect boundary conditions in the SVG component 13.10.2026
CVE-2026-109763 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-109764 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component 13.10.2026
CVE-2026-109766 Mitigation bypass in the Enterprise Policies component 13.10.2026
CVE-2026-109767 Information disclosure in the Networking component 13.10.2026
CVE-2026-109768 Denial-of-service in the Site Reports component 13.10.2026
CVE-2026-109769 Information disclosure in the Networking: Cache component 13.10.2026
CVE-2026-109770 Spoofing issue in the DOM: Web Serial component 13.10.2026
CVE-2026-109771 Information disclosure in the WebRTC: Networking component 13.10.2026
CVE-2026-109772 Same-origin policy bypass in the DevTools component 13.10.2026
CVE-2026-109773 Denial-of-service in the Sync component 13.10.2026
CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component 13.10.2026
CVE-2026-109775 Denial-of-service in the WebRTC component 13.10.2026
CVE-2026-109776 Race condition in the XPCOM component 13.10.2026
CVE-2026-109777 Information disclosure in the Storage: IndexedDB component 13.10.2026
CVE-2026-109778 Privilege escalation in the WebExtensions component 13.10.2026
CVE-2026-109779 Race condition in the Networking: DNS component 13.10.2026
CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component 13.10.2026
CVE-2026-109781 Denial-of-service in the Printing: Output component 13.10.2026
CVE-2026-109782 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-109783 Mitigation bypass in the File Handling component 13.10.2026
CVE-2026-65141 13.10.2026 7.8
CVE-2026-65147 13.10.2026 7.3
CVE-2026-65148 13.10.2026 7.3
CVE-2026-65149 13.10.2026 7.3
CVE-2026-65150 13.10.2026 7.3
CVE-2026-67456 13.10.2026 4.4
CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery 13.10.2026
CVE-2026-109404 conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery 13.10.2026
CVE-2026-109833 Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service 13.10.2026
CVE-2026-109976 Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection 13.10.2026
CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery 13.10.2026
CVE-2026-109832 Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) 13.10.2026
CVE-2026-94410 Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service 13.10.2026
CVE-2026-109190 conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery 13.10.2026
CVE-2026-89279 Active Directory Password Change CSRF in AuthTake Technology's authtake 13.10.2026 6.5
CVE-2026-109189 fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery 13.10.2026
CVE-2026-63316 SQL Injection in Payload CMS 13.10.2026
CVE-2026-109160 PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect 13.10.2026
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflow 13.10.2026
CVE-2026-109156 SeldonIO MLServer environment_tarball env.py _extract_env path traversal 13.10.2026
CVE-2026-109153 MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal 13.10.2026
CVE-2026-109155 DeepPavlov Model Download untar path traversal 13.10.2026
CVE-2026-109152 jbardin scp.py SCP Receive _recv_pushd path traversal 13.10.2026
CVE-2026-102073 13.10.2026 8.2
CVE-2026-102074 13.10.2026 7.5
CVE-2026-102075 13.10.2026 7.5
CVE-2026-102076 13.10.2026 7.5
CVE-2026-109144 wbond certvalidator Certificate Path Builder resource consumption 13.10.2026
CVE-2026-109149 beautifier js-beautify memory allocation 13.10.2026
CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework 13.10.2026
CVE-2026-109854 M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding 13.10.2026
CVE-2026-44414 13.10.2026 6.8
CVE-2026-44415 13.10.2026 9.1
CVE-2026-59241 13.10.2026 8.8
CVE-2026-63350 13.10.2026 9.6
CVE-2026-63351 13.10.2026 6.1
CVE-2026-63352 13.10.2026 6.1
CVE-2026-63353 13.10.2026 9.6
CVE-2026-63354 13.10.2026 9.6
CVE-2026-63355 13.10.2026 6.1
CVE-2026-63356 13.10.2026 6.1
CVE-2026-63357 13.10.2026 6.1
CVE-2026-72895 13.10.2026 7.7
CVE-2026-78556 13.10.2026 7.4
CVE-2026-78557 13.10.2026 8.3
CVE-2026-85114 13.10.2026 7.5
CVE-2026-85115 13.10.2026 5.5
CVE-2026-89196 13.10.2026 8.8
CVE-2026-89197 13.10.2026 8.8
CVE-2026-89198 13.10.2026 8.8
CVE-2026-89199 13.10.2026 8.8
CVE-2026-89200 13.10.2026 6.7
CVE-2026-89201 13.10.2026 7.5
CVE-2026-89202 13.10.2026 6.5
CVE-2026-89203 13.10.2026 4.3
CVE-2026-89204 13.10.2026 5.4
CVE-2026-89205 13.10.2026 6.3
CVE-2026-89206 13.10.2026 6.3
CVE-2026-89208 13.10.2026 5.3
CVE-2026-106598 WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-108487 WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management 13.10.2026
CVE-2026-109687 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability 13.10.2026 7.6
CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 13.10.2026 5.4
CVE-2026-101020 13.10.2026
CVE-2026-103076 WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability 13.10.2026 5.4
CVE-2026-105881 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-106597 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108174 WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108179 WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability 13.10.2026 7.6
CVE-2026-108488 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108489 WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-108490 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108492 WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108493 WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-108495 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108496 WordPress WP User Manager plugin <= 2.9.23 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-109115 AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection 13.10.2026
CVE-2026-109116 AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization 13.10.2026
CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability 13.10.2026 5.3
CVE-2026-109691 WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-109696 WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability 13.10.2026 5.4
CVE-2026-109697 WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-13138 Improper Authorization in Divasoft Software's Biletiva Ticketing Platform 13.10.2026 8.6
CVE-2026-89309 n/a 13.10.2026
CVE-2026-96535 Cross-Site Scripting in the YouMind web application 13.10.2026
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection 13.10.2026
CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication 13.10.2026
CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback 13.10.2026 7.2
CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter 13.10.2026 7.2
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow 13.10.2026
CVE-2026-14308 Insufficient Signature Validation 13.10.2026 4.9
CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter 13.10.2026 4.9
CVE-2026-89097 Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters 13.10.2026 4.3
CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation 13.10.2026
CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services 13.10.2026
CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference 13.10.2026
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection 13.10.2026
CVE-2026-109703 WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability 13.10.2026 5.3
CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS) 13.10.2026 5.4
CVE-2026-108975 SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload 13.10.2026
CVE-2026-109106 Polaris Office App Document Intake com.infraware.service.m.n.a path traversal 13.10.2026
CVE-2026-75826 Teltonika Command Injection in Backup function 13.10.2026
CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime 13.10.2026 7.1
CVE-2026-108973 SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload 13.10.2026
CVE-2026-108974 SourceCodester E-Learning System Users.php save_users unrestricted upload 13.10.2026
CVE-2026-108972 SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication 13.10.2026
CVE-2026-54867 WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode 13.10.2026
CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile 13.10.2026
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification 13.10.2026
CVE-2026-54868 WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-54869 WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-54870 WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability 13.10.2026 6.5
CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison 13.10.2026
CVE-2026-108970 itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection 13.10.2026
CVE-2026-108968 SourceCodester Performance Indicator System sales_history.php sql injection 13.10.2026
CVE-2026-108966 SourceCodester Performance Indicator System product.php sql injection 13.10.2026
CVE-2026-108967 SourceCodester Performance Indicator System edit_credit.php sql injection 13.10.2026
CVE-2026-108965 SourceCodester Performance Indicator System edit_quantity.php sql injection 13.10.2026
CVE-2026-109758 13.10.2026
CVE-2026-108964 SourceCodester Performance Indicator System addproduct.php sql injection 13.10.2026
CVE-2026-108961 PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection 13.10.2026
CVE-2026-108962 storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection 13.10.2026
CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds 13.10.2026