CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-103593 Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution 27.10.2026 9.1
CVE-2026-103594 Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution 27.10.2026 9.5
CVE-2026-112709 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026 9.2
CVE-2026-112710 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026 9.2
CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability 27.10.2026 9.6
CVE-2026-93857 Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution 27.10.2026 9.2
CVE-2026-93865 Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection 27.10.2026 9.2
CVE-2026-93866 Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write 27.10.2026 9.2
CVE-2026-117564 nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret 27.10.2026 9.3
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions 27.10.2026 9.3
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass 27.10.2026 9.3
CVE-2026-65145 27.10.2026 10
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials 27.10.2026 9.1
CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets 27.10.2026 9.1
CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin 27.10.2026 9.3
CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 27.10.2026 9.3
CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82119 OS Command Injection Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.4
CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base 27.10.2026 9.8
CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 27.10.2026 9.3
CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login 27.10.2026 9.8
CVE-2026-18450 Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability 27.10.2026 9.8
CVE-2026-116747 Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret 26.10.2026 9.2
CVE-2026-116508 TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow 26.10.2026 10
CVE-2026-116506 TOTOLINK A950RG firewall.so apmib_set command injection 26.10.2026 9.4
CVE-2026-116505 TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection 26.10.2026 9.4
CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection 27.10.2026 9.4
CVE-2026-110720 Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules 26.10.2026 9.9
CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability. 27.10.2026 9.8
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset 26.10.2026 9.9
CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 26.10.2026 10
CVE-2026-112346 OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE 26.10.2026 9.3
CVE-2026-65184 Avocent ACS8000 wsserver command injection 26.10.2026 9.8
CVE-2026-77055 Improper Privilege Assignment in boneIO 26.10.2026 9.3
CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write 26.10.2026 9.3
CVE-2026-107656 27.10.2026 9.6
CVE-2026-110475 Improper Authentication Vulnerability in CreditNirvana Collections Platform 26.10.2026 9.3
CVE-2026-115188 26.10.2026 9.9
CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney 26.10.2026 9.1
CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code 26.10.2026 9.3
CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints 26.10.2026 9.3
CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation 26.10.2026 9.3
CVE-2026-59107 Shared SSH Authentication Key in vSolution Matrix File Sharing 26.10.2026 9.2
CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection 26.10.2026 9.3
CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection 26.10.2026 9.4
CVE-2026-116233 Oray Pugongying X5 Pro Dnsmasq crlf injection 26.10.2026 9.4
CVE-2026-116234 Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection 26.10.2026 9.4
CVE-2026-116231 Oray Pugongying X5 Pro Ser2net crlf injection 26.10.2026 9.4
CVE-2026-116232 Oray Pugongying X5 Pro SNMP snmp_set crlf injection 26.10.2026 9.4
CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification 26.10.2026 9.3
CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 26.10.2026 9.1
CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback 26.10.2026 9.2
CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection 24.10.2026 9.4
CVE-2026-114820 25.10.2026 9.1
CVE-2026-115557 Distrust compromised intermediate certificates in ssl module 27.10.2026 9.4
CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations 24.10.2026 9.9
CVE-2026-115932 Path traversal in post media lets any registered user read server files 24.10.2026 9.6
CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType 24.10.2026 9.2
CVE-2026-111402 WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-112866 WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-114196 WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-94075 WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace 24.10.2026 9.8
CVE-2026-115931 Arbitrary file read and backend crash through unrestricted provider method calls 24.10.2026 9.9
CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 26.10.2026 9.9
CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 23.10.2026 9.9
CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 23.10.2026 9.3
CVE-2026-46651 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer 23.10.2026 9.8
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer 23.10.2026 9.8
CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN 23.10.2026 9.9
CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS 23.10.2026 9.3
CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) 23.10.2026 9.3
CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) 23.10.2026 9.8
CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112847 WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112851 WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112853 WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112854 WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112855 WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112857 WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112858 WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112859 WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 24.10.2026 9.8
CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry 24.10.2026 9.8
CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation 23.10.2026 9.8
CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item 24.10.2026 9.8
CVE-2026-115727 AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server 27.10.2026 9.2
CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers 23.10.2026 9.1
CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop 23.10.2026 9.3
CVE-2025-30046 Remote Code Execution in CGM CLININET 23.10.2026 9
CVE-2025-30047 Remote Code Execution via Java Deserialization in CGM CLININET 23.10.2026 9.4
CVE-2025-30050 Remote Code Execution in CGM CLININET 23.10.2026 9.4
CVE-2025-30054 Local Privilege Escalation in CGM CLININET 23.10.2026 9.3
CVE-2026-112860 WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability 23.10.2026 9.3
CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-63244 Authentication Bypass Vulnerability 23.10.2026 9.8
CVE-2026-55981 Firmware verification vulnerability 23.10.2026 9.6
CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media 23.10.2026 9.6
CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway 23.10.2026 9.1
CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution 23.10.2026 9.3
CVE-2026-107861 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-110243 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability 26.10.2026 9.1
CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability 27.10.2026 10
CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability 26.10.2026 10
CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability 26.10.2026 10
CVE-2026-111594 InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information 22.10.2026 9.2
CVE-2026-114625 Security Advisory 0199 24.10.2026 9.4
CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login 22.10.2026 9.3
CVE-2026-115353 Mistune before 3.3.0 Path Traversal via include Directive 22.10.2026 9.2
CVE-2026-115372 Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options 22.10.2026 9
CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 22.10.2026 9.4
CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream 22.10.2026 9.4
CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow 22.10.2026 9.4
CVE-2026-79844 Authentication Bypass Leading to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79846 Unauthenticated Command Injection Vulnerabilities in AOS-8 23.10.2026 10
CVE-2026-79847 Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79848 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79849 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79850 Authentication Bypass Leading to Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79851 Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79852 Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface 24.10.2026 9.8
CVE-2026-79853 Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10 23.10.2026 9.8
CVE-2026-79854 Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10 24.10.2026 9.8
CVE-2026-79855 Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise 24.10.2026 9.8
CVE-2026-79856 Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8 24.10.2026 9.8
CVE-2026-79857 Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol 24.10.2026 9.8
CVE-2026-79858 Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8 24.10.2026 9.8
CVE-2026-79859 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 23.10.2026 9.8
CVE-2026-79860 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 23.10.2026 9.8
CVE-2026-79861 Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10 23.10.2026 9.8
CVE-2026-79862 Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution 23.10.2026 9.6
CVE-2026-79863 Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution 23.10.2026 9.6
CVE-2026-79864 Unauthenticated Adjacent Command Injection Vulnerability in AOS-10 23.10.2026 9.6
CVE-2026-79865 Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10 23.10.2026 9.6
CVE-2026-79866 Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8 23.10.2026 9.6
CVE-2026-79867 Authentication Bypass Leading to Remote Code Execution in AOS-8 23.10.2026 9.6
CVE-2026-79868 Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8 23.10.2026 9.6
CVE-2026-79869 Authentication Bypass Leading to Remote Code Execution in AOS-10 23.10.2026 9.6
CVE-2026-79870 Authentication Bypass leads to Unauthorized Access in AOS-8 23.10.2026 9.6
CVE-2026-79871 Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10 23.10.2026 9.6
CVE-2026-79872 Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8 23.10.2026 9.4
CVE-2026-79873 Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access 23.10.2026 9.3
CVE-2026-79874 Authentication Bypass in the API allows Administrative Access of AOS-10 23.10.2026 9.3
CVE-2026-79875 Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access 23.10.2026 9.3
CVE-2026-79876 Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing 23.10.2026 9.3
CVE-2026-114612 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key 22.10.2026 9.9
CVE-2026-114611 OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack 22.10.2026 9.1
CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user 23.10.2026 9.1
CVE-2026-97631 Pre-boot RCE in EDK II PXE driver 22.10.2026 9.5
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder 27.10.2026 9.2
CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 22.10.2026 10
CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 22.10.2026 9.8
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer 23.10.2026 9.3
CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php 22.10.2026 9.3
CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store 22.10.2026 9.2
CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 22.10.2026 9.8
CVE-2026-112327 WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability 22.10.2026 9.3
CVE-2026-114219 NewType Infortech｜NT OneAPP - Hard-coded Credentials 22.10.2026 9.1
CVE-2026-114220 NewType Infortech｜NT OneAPP - Improper Certificate Validation 22.10.2026 9.3
CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints 22.10.2026 9
CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injection 22.10.2026 10
CVE-2026-110264 Integer Overflow or Wraparound in GitLab 22.10.2026 10
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 21.10.2026 9.2
CVE-2026-114383 TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow 21.10.2026 10
CVE-2026-114382 TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow 21.10.2026 10
CVE-2026-91403 24.10.2026 9.1
CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions 21.10.2026 9.8
CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route 21.10.2026 9.1
CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() 21.10.2026 9.4
CVE-2026-111811 Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication 23.10.2026 9.4
CVE-2026-114268 Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow 21.10.2026 9.4
CVE-2026-111816 Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out 23.10.2026 9.2
CVE-2025-31699 Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling 23.10.2026 9.1
CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life 23.10.2026 10
CVE-2026-111813 Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration 23.10.2026 10
CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role 21.10.2026 9.2
CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects 21.10.2026 9.2
CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability 23.10.2026 9.8
CVE-2026-89035 MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass 27.10.2026 9.1
CVE-2026-20043 Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 22.10.2026 9
CVE-2026-76466 Cisco Expressway Series Remote Code Execution Vulnerability 22.10.2026 9.8
CVE-2026-76473 Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. 22.10.2026 9.8
CVE-2026-76474 Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities 22.10.2026 9.8
CVE-2026-76475 Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities 22.10.2026 9.3
CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution 23.10.2026 9.4
CVE-2026-111832 WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability 21.10.2026 10
CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability 21.10.2026 9.9
CVE-2026-111852 WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability 21.10.2026 9.3
CVE-2026-109619 RCE via stale global state 27.10.2026 9.2
CVE-2026-109618 RCE via OOM corruption 27.10.2026 9.2
CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load 21.10.2026 9.2
CVE-2026-87095 21.10.2026 9.1

Latest Updates

CVE Title Updated Score
CVE-2026-103593 Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution 27.10.2026
CVE-2026-103594 Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution 27.10.2026
CVE-2026-104381 Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service 27.10.2026
CVE-2026-111107 Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service 27.10.2026
CVE-2026-112709 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026
CVE-2026-112710 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026
CVE-2026-113881 Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution 27.10.2026
CVE-2026-115495 Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket 27.10.2026
CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability 27.10.2026 9.6
CVE-2026-82332 Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking 27.10.2026
CVE-2026-90442 Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service 27.10.2026
CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root 27.10.2026
CVE-2026-90465 Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation 27.10.2026
CVE-2026-93434 Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets 27.10.2026
CVE-2026-93857 Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution 27.10.2026
CVE-2026-93862 Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service 27.10.2026
CVE-2026-93864 Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root 27.10.2026
CVE-2026-93865 Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection 27.10.2026
CVE-2026-93866 Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write 27.10.2026
CVE-2026-109823 Host filesystem path disclosure via DNS rebinding 27.10.2026
CVE-2026-117510 Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal 27.10.2026
CVE-2026-107458 27.10.2026
CVE-2026-117509 crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal 27.10.2026
CVE-2026-104189 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share 27.10.2026 7.5
CVE-2026-111582 Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows 27.10.2026 7.3
CVE-2026-111583 Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows 27.10.2026 7.3
CVE-2026-111584 Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows 27.10.2026 7.3
CVE-2026-111585 Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow 27.10.2026 8.8
CVE-2026-92372 Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution 27.10.2026 8.8
CVE-2026-92374 Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS 27.10.2026 7.8
CVE-2026-92375 Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring 27.10.2026 7.8
CVE-2026-92376 Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows 27.10.2026 7.8
CVE-2026-92377 Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows 27.10.2026 7.8
CVE-2026-117507 a2aproject a2a-java TaskManager.saveTaskEvent race condition 27.10.2026
CVE-2026-117506 a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption 27.10.2026
CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback 27.10.2026
CVE-2026-105987 Stored XSS in KGS Software tia Viewer 27.10.2026
CVE-2026-117505 a2aproject a2a-java ChildQueue queue.offer resource consumption 27.10.2026
CVE-2026-78845 27.10.2026
CVE-2026-117504 a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service 27.10.2026
CVE-2026-117860 Same-origin policy bypass in the DOM: Navigation component 27.10.2026
CVE-2026-117861 Sandbox escape in the DOM: Navigation component 27.10.2026
CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking component 27.10.2026
CVE-2026-117863 Information disclosure due to uninitialized memory in the Audio/Video component 27.10.2026
CVE-2026-117864 Sandbox escape in the Form Manager component 27.10.2026
CVE-2026-117865 Use-after-free in the JavaScript: GC component 27.10.2026
CVE-2026-117866 Privilege escalation due to use-after-free in the Graphics: Canvas2D component 27.10.2026
CVE-2026-117867 Use-after-free in the Layout component 27.10.2026
CVE-2026-117868 Sandbox escape in the DOM: Networking component 27.10.2026
CVE-2026-117869 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117870 Use-after-free in the JavaScript Engine component 27.10.2026
CVE-2026-117871 Invalid pointer in the Graphics component 27.10.2026
CVE-2026-117872 Use-after-free in the JavaScript: Standard Library component 27.10.2026
CVE-2026-117873 Incorrect boundary conditions in the Audio/Video: Playback component 27.10.2026
CVE-2026-117874 Use-after-free in the Internationalization component 27.10.2026
CVE-2026-117875 Use-after-free in the Layout: Scrolling and Overflow component 27.10.2026
CVE-2026-117876 Use-after-free in the Layout: Text and Fonts component 27.10.2026
CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component 27.10.2026
CVE-2026-117878 Other issue, use-after-free in the Storage: IndexedDB component 27.10.2026
CVE-2026-117879 Incorrect boundary conditions in the Layout: Tables component 27.10.2026
CVE-2026-117880 Use-after-free in the XML component 27.10.2026
CVE-2026-117881 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117882 Use-after-free in the Layout component 27.10.2026
CVE-2026-117883 Use-after-free in the DOM: HTML Parser component 27.10.2026
CVE-2026-117884 Use-after-free in the Networking component 27.10.2026
CVE-2026-117885 Use-after-free in the Layout: Grid component 27.10.2026
CVE-2026-117886 Incorrect boundary conditions in the Graphics: Text component 27.10.2026
CVE-2026-117887 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117888 Uninitialized memory in the Graphics: Canvas2D component 27.10.2026
CVE-2026-117889 Incorrect boundary conditions in the JavaScript Engine component 27.10.2026
CVE-2026-117890 JIT miscompilation in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117891 Use-after-free in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117892 Privilege escalation due to use-after-free in the WebRTC: Networking component 27.10.2026
CVE-2026-117893 Incorrect boundary conditions in the Security: PSM component 27.10.2026
CVE-2026-117894 Incorrect boundary conditions in the WebRTC: Signaling component 27.10.2026
CVE-2026-117895 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117896 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117897 Incorrect boundary conditions in the Layout: Tables component 27.10.2026
CVE-2026-117898 Use-after-free in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117899 Use-after-free in the Networking: HTTP component 27.10.2026
CVE-2026-117900 Use-after-free in the DOM: Editor component 27.10.2026
CVE-2026-117901 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117902 Use-after-free in the Layout: Text and Fonts component 27.10.2026
CVE-2026-117903 Use-after-free in the Audio/Video component 27.10.2026
CVE-2026-117904 Use-after-free in the JavaScript: GC component 27.10.2026
CVE-2026-117905 Use-after-free in the Audio/Video: Playback component 27.10.2026
CVE-2026-117906 Use-after-free in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117907 Use-after-free in the Networking component 27.10.2026
CVE-2026-117908 Use-after-free in the Graphics: ImageLib component 27.10.2026
CVE-2026-117909 Use-after-free in the JavaScript: GC component 27.10.2026
CVE-2026-117910 Invalid pointer in the JavaScript Engine component 27.10.2026
CVE-2026-117911 Use-after-free in the Audio/Video: Playback component 27.10.2026
CVE-2026-117912 Same-origin policy bypass in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117913 Use-after-free in the SVG component 27.10.2026
CVE-2026-117914 Use-after-free in the SVG component 27.10.2026
CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component 27.10.2026
CVE-2026-117916 Use-after-free in the XSLT component 27.10.2026
CVE-2026-117917 Invalid pointer in the Graphics: WebRender component 27.10.2026
CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component 27.10.2026
CVE-2026-117919 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117920 Use-after-free in the DOM: HTML Parser component 27.10.2026
CVE-2026-117921 Use-after-free in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117922 Use-after-free in the Networking: WebSockets component 27.10.2026
CVE-2026-117923 Use-after-free in the Audio/Video component 27.10.2026
CVE-2026-117924 Use-after-free in the XSLT component 27.10.2026
CVE-2026-117925 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117926 Incorrect boundary conditions in the SVG component 27.10.2026
CVE-2026-117927 Use-after-free in the SVG component 27.10.2026
CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117929 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117930 Use-after-free in the DOM: Bindings (WebIDL) component 27.10.2026
CVE-2026-117931 Use-after-free in the DOM: Events component 27.10.2026
CVE-2026-117932 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117934 Use-after-free in the Layout component 27.10.2026
CVE-2026-117935 Use-after-free in the DOM: Bindings (WebIDL) component 27.10.2026
CVE-2026-117936 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117937 Invalid pointer in the JavaScript Engine component 27.10.2026
CVE-2026-117938 Use-after-free in the Layout component 27.10.2026
CVE-2026-117939 Use-after-free in the XML component 27.10.2026
CVE-2026-117940 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117941 Use-after-free in the DOM: CSS Object Model component 27.10.2026
CVE-2026-117942 Incorrect boundary conditions in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117943 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117944 Use-after-free in the Layout component 27.10.2026
CVE-2026-117945 Incorrect boundary conditions in the XML component 27.10.2026
CVE-2026-117946 Incorrect boundary conditions in the JavaScript Engine component 27.10.2026
CVE-2026-117947 Use-after-free in the XML component 27.10.2026
CVE-2026-117948 Use-after-free in the SVG component 27.10.2026
CVE-2026-117949 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117950 Incorrect boundary conditions in the DOM: Core & HTML component 27.10.2026
CVE-2026-117951 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117952 Uninitialized memory in the Networking component 27.10.2026
CVE-2026-117953 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117954 Use-after-free in the Layout: Positioned component 27.10.2026
CVE-2026-117955 JIT miscompilation in the JavaScript: WebAssembly component 27.10.2026
CVE-2026-117956 Invalid pointer in the Nimbus Desktop Client component 27.10.2026
CVE-2026-117957 Cryptographic issue in the WebRTC: Networking component 27.10.2026
CVE-2026-117958 Site isolation issue in the Networking: HTTP component 27.10.2026
CVE-2026-117959 Site isolation issue in the DOM: Service Workers component 27.10.2026
CVE-2026-117960 Spoofing issue in the DOM: Core & HTML component 27.10.2026
CVE-2026-117961 Incorrect boundary conditions in the Layout: Text and Fonts component 27.10.2026
CVE-2026-117962 Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component 27.10.2026
CVE-2026-117963 Incorrect boundary conditions in the DOM: Service Workers component 27.10.2026
CVE-2026-117964 Use-after-free in the Panning and Zooming component 27.10.2026
CVE-2026-117965 Same-origin policy bypass in the Address Bar component 27.10.2026
CVE-2026-117966 Site isolation issue in the Networking: HTTP component 27.10.2026
CVE-2026-117967 Mitigation bypass in the DOM: Security component 27.10.2026
CVE-2026-117968 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-117969 Invalid pointer in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117970 Race condition in the Disability Access APIs component 27.10.2026
CVE-2026-117971 Sandbox escape due to use-after-free in the Print Preview component 27.10.2026
CVE-2026-117972 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117973 Use-after-free in the Networking: DNS component 27.10.2026
CVE-2026-117974 Use-after-free in the XML component 27.10.2026
CVE-2026-117975 Sandbox escape due to invalid pointer in the Graphics: WebRender component 27.10.2026
CVE-2026-117976 Site isolation issue in the DOM: Navigation component 27.10.2026
CVE-2026-117977 Other issue in the Console component 27.10.2026
CVE-2026-117978 Incorrect boundary conditions in the Graphics component 27.10.2026
CVE-2026-117979 Incorrect boundary conditions in the Graphics: WebRender component 27.10.2026
CVE-2026-117980 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117981 Privilege escalation in the Toolkit component 27.10.2026
CVE-2026-117982 Invalid pointer in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-117983 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117984 Incorrect boundary conditions in the Layout: Scrolling and Overflow component 27.10.2026
CVE-2026-117985 Sandbox escape due to use-after-free in the Graphics component 27.10.2026
CVE-2026-117986 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117987 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117988 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component 27.10.2026
CVE-2026-117989 Use-after-free in the Graphics component 27.10.2026
CVE-2026-117990 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component 27.10.2026
CVE-2026-117991 Incorrect boundary conditions in the Layout: Text and Fonts component 27.10.2026
CVE-2026-117992 Information disclosure in the CSS Parsing and Computation component 27.10.2026
CVE-2026-117993 Integer overflow in the Graphics: Text component 27.10.2026
CVE-2026-117994 Use-after-free in the JavaScript: GC component 27.10.2026
CVE-2026-117995 Privilege escalation in the DOM: UI Events & Focus Handling component 27.10.2026
CVE-2026-117996 Incorrect boundary conditions in the WebRTC component 27.10.2026
CVE-2026-117997 Sandbox escape due to use-after-free in the Widget component 27.10.2026
CVE-2026-117998 Mitigation bypass in the DOM: Push Subscriptions component 27.10.2026
CVE-2026-117999 Race condition in the IPC component 27.10.2026
CVE-2026-118000 Information disclosure in the Networking: HTTP component 27.10.2026
CVE-2026-118002 Information disclosure due to race condition in the Networking component 27.10.2026
CVE-2026-118003 Information disclosure in the Networking: DNS component 27.10.2026
CVE-2026-118004 Incorrect boundary conditions in the CSS Transitions and Animations component 27.10.2026
CVE-2026-118005 Use-after-free in the WebRTC: Signaling component 27.10.2026
CVE-2026-118006 Privilege escalation due to use-after-free in the WebRTC: Signaling component 27.10.2026
CVE-2026-118007 Use-after-free in the JavaScript: GC component 27.10.2026
CVE-2026-118008 Privilege escalation in the DOM: Navigation component 27.10.2026
CVE-2026-118009 Integer overflow, use-after-free in the Graphics: Text component 27.10.2026
CVE-2026-118010 Use-after-free in the Disability Access APIs component 27.10.2026
CVE-2026-118011 Frame poisoning in the CSS Parsing and Computation component 27.10.2026
CVE-2026-118012 Use-after-free in the DOM: Animation component 27.10.2026
CVE-2026-118013 Use-after-free in the Layout: Images, Video, and HTML Frames component 27.10.2026
CVE-2026-118014 Use-after-free in the JavaScript Engine: JIT component 27.10.2026
CVE-2026-118015 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-118016 Use-after-free in the DOM: Core & HTML component 27.10.2026
CVE-2026-118017 Use-after-free in the SVG component 27.10.2026
CVE-2026-118018 Spoofing issue in the Downloads component in Firefox for Android 27.10.2026
CVE-2026-118019 Race condition, use-after-free in the DOM: File component 27.10.2026
CVE-2026-118020 Use-after-free in the Layout component 27.10.2026
CVE-2026-118021 Sandbox escape due to use-after-free in the XPCOM component 27.10.2026
CVE-2026-118022 Sandbox escape due to use-after-free in the Disability Access APIs component 27.10.2026
CVE-2026-118023 Sandbox escape due to use-after-free in the Graphics: WebRender component 27.10.2026
CVE-2026-118024 Use-after-free in the Graphics: Text component 27.10.2026
CVE-2026-118025 Other issue in the SVG component 27.10.2026
CVE-2026-118026 Invalid pointer in the JavaScript: GC component 27.10.2026
CVE-2026-118027 Frame poisoning in the Layout component 27.10.2026
CVE-2026-107067 27.10.2026
CVE-2026-117503 a2aproject a2a-go REST SSE handler rest.go resource consumption 27.10.2026
CVE-2026-68866 27.10.2026 6.5
CVE-2026-90725 27.10.2026 4.9
CVE-2026-90726 27.10.2026 6
CVE-2026-90727 27.10.2026 3.8
CVE-2026-10537 Remote unauthenticated information disclosure and denial of service due to unauthenticated service access 27.10.2026
CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning 27.10.2026
CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php 27.10.2026
CVE-2026-117555 GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp() 27.10.2026
CVE-2026-117556 zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface() 27.10.2026
CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader 27.10.2026
CVE-2026-117558 ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status 27.10.2026
CVE-2026-117559 DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass 27.10.2026
CVE-2026-117560 ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools 27.10.2026
CVE-2026-117561 sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values 27.10.2026
CVE-2026-117562 rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint 27.10.2026
CVE-2026-117563 MrDoc through 1.1.1 Broken Access Control via manage_doc_share 27.10.2026
CVE-2026-117564 nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret 27.10.2026
CVE-2026-117565 Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch 27.10.2026
CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php 27.10.2026
CVE-2026-117567 esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters 27.10.2026
CVE-2026-117568 mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir 27.10.2026
CVE-2026-117569 Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters 27.10.2026
CVE-2026-117570 nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities 27.10.2026
CVE-2026-117573 hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools 27.10.2026
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions 27.10.2026
CVE-2026-117602 Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution 27.10.2026
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass 27.10.2026
CVE-2026-12887 27.10.2026
CVE-2026-16307 IDOR in Netiket Information Technologies' EdoWEB 27.10.2026 4.3
CVE-2026-94346 27.10.2026 7.2
CVE-2026-94347 27.10.2026 7.2
CVE-2026-92546 Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally 27.10.2026 7.5
CVE-2026-116627 27.10.2026
CVE-2026-15586 OTP Brute-Force Account Takeover in Idvlabs Software's Ontime 27.10.2026 5.3
CVE-2026-100164 User Enumeration in Rolantis Information Technologies' Agentis 27.10.2026 7.5
CVE-2026-107590 Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt 27.10.2026
CVE-2026-114409 Docker Desktop logs can expose stored third-party credentials 27.10.2026
CVE-2026-24269 27.10.2026 7.1
CVE-2026-47486 27.10.2026 7.8
CVE-2026-65119 27.10.2026 8.4
CVE-2026-65120 27.10.2026 7.1
CVE-2026-65145 27.10.2026 10
CVE-2026-65151 27.10.2026 8.4
CVE-2026-106087 27.10.2026
CVE-2026-10756 27.10.2026
CVE-2026-115408 ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets 27.10.2026 5.5
CVE-2026-13162 27.10.2026
CVE-2026-105323 Reflected XSS in Kulga Software's Kulga News Software 27.10.2026 6.1
CVE-2026-113644 iofogctl command injection via Controller provisioning response 27.10.2026
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials 27.10.2026
CVE-2026-90728 27.10.2026 6.3
CVE-2026-90729 27.10.2026 6.7
CVE-2026-109995 Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content 27.10.2026 7.2
CVE-2026-10752 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field 27.10.2026 4.8
CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets 27.10.2026 9.1
CVE-2026-41021 27.10.2026 7.5
CVE-2026-41022 27.10.2026 5.9
CVE-2026-90730 27.10.2026 6.5
CVE-2026-90731 27.10.2026 4.9
CVE-2026-102800 Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 27.10.2026
CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition 27.10.2026 3.7
CVE-2026-41020 27.10.2026 7.5
CVE-2026-4337 Unrestricted Upload of File in PuMuKIT application 27.10.2026
CVE-2026-56084 27.10.2026 5.8
CVE-2026-90732 27.10.2026 4.9
CVE-2026-116893 REDAXO core before 5.21.5 Missing Authorization in rex_api_package API 27.10.2026
CVE-2026-116894 REDAXO before 5.21.5 Insufficient Session Expiration on Password Change 27.10.2026
CVE-2026-116895 REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter 27.10.2026
CVE-2026-116896 REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables 27.10.2026
CVE-2026-116897 REDAXO before 5.21.4 Missing Authorization in Version and History Previews 27.10.2026
CVE-2026-116898 REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move 27.10.2026
CVE-2026-116899 REDAXO before 5.21.4 Broken Access Control in Slice Operations 27.10.2026
CVE-2026-116900 REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets 27.10.2026
CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin 27.10.2026
CVE-2026-117533 REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads 27.10.2026
CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin 27.10.2026
CVE-2026-117535 REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool 27.10.2026
CVE-2026-117536 REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation 27.10.2026
CVE-2026-117537 REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter 27.10.2026
CVE-2026-117538 REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter 27.10.2026
CVE-2026-117539 darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass 27.10.2026
CVE-2026-117540 svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop 27.10.2026
CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() 27.10.2026
CVE-2026-117341 27.10.2026
CVE-2026-117466 27.10.2026
CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers 27.10.2026
CVE-2026-116870 27.10.2026
CVE-2026-116871 Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask 27.10.2026
CVE-2026-116872 Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters 27.10.2026
CVE-2026-116873 Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update 27.10.2026
CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter 27.10.2026
CVE-2026-116875 SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters 27.10.2026
CVE-2026-116876 Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected 27.10.2026
CVE-2026-116877 Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event 27.10.2026
CVE-2026-116878 Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity 27.10.2026
CVE-2026-116879 Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task 27.10.2026
CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions 27.10.2026
CVE-2026-116881 Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete 27.10.2026
CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels 27.10.2026
CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions 27.10.2026
CVE-2026-116884 SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes 27.10.2026
CVE-2026-116885 Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter 27.10.2026
CVE-2026-116886 Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse 27.10.2026
CVE-2026-116887 Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property 27.10.2026
CVE-2026-116888 SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading 27.10.2026
CVE-2026-116889 SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property 27.10.2026
CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API 27.10.2026
CVE-2026-116891 SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate 27.10.2026
CVE-2026-116892 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile 27.10.2026
CVE-2026-117530 27.10.2026 6.7
CVE-2026-111548 27.10.2026
CVE-2026-102787 Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 27.10.2026
CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 27.10.2026
CVE-2026-107145 Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator 27.10.2026
CVE-2026-107146 Insufficient session expiration in twofactor_gauthenticator 27.10.2026
CVE-2026-107147 Authentication bypass by spoofing in twofactor_gauthenticator 27.10.2026
CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82119 OS Command Injection Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82121 Origin Validation Error Vulnerability in HiRDB 27.10.2026 7.5
CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.4
CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base 27.10.2026 9.8
CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 27.10.2026
CVE-2026-117493 Multiple vulnerabilities in Sisense’s Cloud BI Platform 27.10.2026
CVE-2026-117494 Multiple vulnerabilities in Sisense’s Cloud BI Platform 27.10.2026
CVE-2026-85299 Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration 27.10.2026
CVE-2026-65211 Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability 27.10.2026 7.2
CVE-2026-65213 Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability 27.10.2026 6.6
CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login 27.10.2026 9.8
CVE-2026-65210 Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability 27.10.2026 4.9
CVE-2026-65220 Supermicro BMC IPMI feature contains a Privilege escalation vulnerability 27.10.2026 8.8
CVE-2026-18450 Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability 27.10.2026 9.8
CVE-2026-18451 Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token 27.10.2026 3.1
CVE-2026-65219 Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability 27.10.2026 7.4
CVE-2026-10511 Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter 27.10.2026 6.4