CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification 26.10.2026 9.3
CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 25.10.2026 9.1
CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback 25.10.2026 9.2
CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection 24.10.2026 9.4
CVE-2026-114820 25.10.2026 9.1
CVE-2026-115557 Distrust compromised intermediate certificates in ssl module 26.10.2026 9.4
CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations 24.10.2026 9.9
CVE-2026-115932 Path traversal in post media lets any registered user read server files 24.10.2026 9.6
CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType 24.10.2026 9.2
CVE-2026-111402 WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-112866 WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-114196 WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-94075 WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace 24.10.2026 9.8
CVE-2026-115931 Arbitrary file read and backend crash through unrestricted provider method calls 24.10.2026 9.9
CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 23.10.2026 9.9
CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 23.10.2026 9.9
CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 23.10.2026 9.3
CVE-2026-46651 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer 23.10.2026 9.8
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer 23.10.2026 9.8
CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN 23.10.2026 9.9
CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS 23.10.2026 9.3
CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) 23.10.2026 9.3
CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) 23.10.2026 9.8
CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112847 WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112851 WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112853 WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112854 WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112855 WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112857 WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112858 WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112859 WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 24.10.2026 9.8
CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry 24.10.2026 9.8
CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation 23.10.2026 9.8
CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item 24.10.2026 9.8
CVE-2026-115727 AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server 23.10.2026 9.2
CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers 23.10.2026 9.1
CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop 23.10.2026 9.3
CVE-2025-30046 Remote Code Execution in CGM CLININET 23.10.2026 9
CVE-2025-30047 Remote Code Execution via Java Deserialization in CGM CLININET 23.10.2026 9.4
CVE-2025-30050 Remote Code Execution in CGM CLININET 23.10.2026 9.4
CVE-2025-30054 Local Privilege Escalation in CGM CLININET 23.10.2026 9.3
CVE-2026-112860 WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability 23.10.2026 9.3
CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-63244 Authentication Bypass Vulnerability 23.10.2026 9.8
CVE-2026-55981 Firmware verification vulnerability 23.10.2026 9.6
CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media 23.10.2026 9.6
CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway 23.10.2026 9.1
CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution 23.10.2026 9.3
CVE-2026-107861 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-110243 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection 23.10.2026 9.4
CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability 25.10.2026 9.1
CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability 25.10.2026 10
CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability 25.10.2026 10
CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability 25.10.2026 10
CVE-2026-111594 InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information 22.10.2026 9.2
CVE-2026-114625 Security Advisory 0199 24.10.2026 9.4
CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login 22.10.2026 9.3
CVE-2026-115353 Mistune before 3.3.0 Path Traversal via include Directive 22.10.2026 9.2
CVE-2026-115372 Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options 22.10.2026 9
CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 22.10.2026 9.4
CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream 22.10.2026 9.4
CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow 22.10.2026 9.4
CVE-2026-79844 Authentication Bypass Leading to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79846 Unauthenticated Command Injection Vulnerabilities in AOS-8 23.10.2026 10
CVE-2026-79847 Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79848 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79849 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79850 Authentication Bypass Leading to Remote Code Execution in AOS-8 23.10.2026 10
CVE-2026-79851 Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 23.10.2026 10
CVE-2026-79852 Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface 24.10.2026 9.8
CVE-2026-79853 Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10 23.10.2026 9.8
CVE-2026-79854 Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10 24.10.2026 9.8
CVE-2026-79855 Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise 24.10.2026 9.8
CVE-2026-79856 Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8 24.10.2026 9.8
CVE-2026-79857 Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol 24.10.2026 9.8
CVE-2026-79858 Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8 24.10.2026 9.8
CVE-2026-79859 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 23.10.2026 9.8
CVE-2026-79860 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 23.10.2026 9.8
CVE-2026-79861 Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10 23.10.2026 9.8
CVE-2026-79862 Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution 23.10.2026 9.6
CVE-2026-79863 Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution 23.10.2026 9.6
CVE-2026-79864 Unauthenticated Adjacent Command Injection Vulnerability in AOS-10 23.10.2026 9.6
CVE-2026-79865 Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10 23.10.2026 9.6
CVE-2026-79866 Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8 23.10.2026 9.6
CVE-2026-79867 Authentication Bypass Leading to Remote Code Execution in AOS-8 23.10.2026 9.6
CVE-2026-79868 Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8 23.10.2026 9.6
CVE-2026-79869 Authentication Bypass Leading to Remote Code Execution in AOS-10 23.10.2026 9.6
CVE-2026-79870 Authentication Bypass leads to Unauthorized Access in AOS-8 23.10.2026 9.6
CVE-2026-79871 Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10 23.10.2026 9.6
CVE-2026-79872 Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8 23.10.2026 9.4
CVE-2026-79873 Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access 23.10.2026 9.3
CVE-2026-79874 Authentication Bypass in the API allows Administrative Access of AOS-10 23.10.2026 9.3
CVE-2026-79875 Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access 23.10.2026 9.3
CVE-2026-79876 Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing 23.10.2026 9.3
CVE-2026-114612 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key 22.10.2026 9.9
CVE-2026-114611 OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack 22.10.2026 9.1
CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user 23.10.2026 9.1
CVE-2026-97631 Pre-boot RCE in EDK II PXE driver 22.10.2026 9.5
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder 26.10.2026 9.2
CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 22.10.2026 10
CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 22.10.2026 9.8
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer 23.10.2026 9.3
CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php 22.10.2026 9.3
CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store 22.10.2026 9.2
CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 22.10.2026 9.8
CVE-2026-112327 WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability 22.10.2026 9.3
CVE-2026-114219 NewType Infortech｜NT OneAPP - Hard-coded Credentials 22.10.2026 9.1
CVE-2026-114220 NewType Infortech｜NT OneAPP - Improper Certificate Validation 22.10.2026 9.3
CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints 22.10.2026 9
CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injection 22.10.2026 10
CVE-2026-110264 Integer Overflow or Wraparound in GitLab 22.10.2026 10
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 21.10.2026 9.2
CVE-2026-114383 TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow 21.10.2026 10
CVE-2026-114382 TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow 21.10.2026 10
CVE-2026-91403 24.10.2026 9.1
CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions 21.10.2026 9.8
CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route 21.10.2026 9.1
CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() 21.10.2026 9.4
CVE-2026-111811 Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication 23.10.2026 9.4
CVE-2026-114268 Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow 21.10.2026 9.4
CVE-2026-111816 Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out 23.10.2026 9.2
CVE-2025-31699 Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling 23.10.2026 9.1
CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life 23.10.2026 10
CVE-2026-111813 Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration 23.10.2026 10
CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role 21.10.2026 9.2
CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects 21.10.2026 9.2
CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability 23.10.2026 9.8
CVE-2026-89035 MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass 21.10.2026 9.1
CVE-2026-20043 Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 22.10.2026 9
CVE-2026-76466 Cisco Expressway Series Remote Code Execution Vulnerability 22.10.2026 9.8
CVE-2026-76473 Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. 22.10.2026 9.8
CVE-2026-76474 Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities 22.10.2026 9.8
CVE-2026-76475 Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities 22.10.2026 9.3
CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution 23.10.2026 9.4
CVE-2026-111832 WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability 21.10.2026 10
CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability 21.10.2026 9.9
CVE-2026-111852 WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability 21.10.2026 9.3
CVE-2026-109619 RCE via stale global state 23.10.2026 9.2
CVE-2026-109618 RCE via OOM corruption 23.10.2026 9.2
CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load 21.10.2026 9.2
CVE-2026-87095 21.10.2026 9.1
CVE-2026-71195 21.10.2026 9.9
CVE-2026-113744 Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow 21.10.2026 10
CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password 21.10.2026 9.3
CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision 21.10.2026 9.2
CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets 22.10.2026 9.2
CVE-2026-114108 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE 21.10.2026 9.3
CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential 21.10.2026 9.3
CVE-2026-81212 DataStage on Cloud Pak for Data Improper Authorization 20.10.2026 10
CVE-2026-92559 IBM App Connect Enterprise is vulnerable to a credential exposure 23.10.2026 9.8
CVE-2026-101420 23.10.2026 9.6
CVE-2026-101446 20.10.2026 9.9
CVE-2026-101484 22.10.2026 9.8
CVE-2026-101499 21.10.2026 9.8
CVE-2026-101501 20.10.2026 9.9
CVE-2026-101503 20.10.2026 9.9
CVE-2026-101521 22.10.2026 9.8
CVE-2026-101528 20.10.2026 9.9
CVE-2026-101529 20.10.2026 9.9
CVE-2026-101537 21.10.2026 9.8
CVE-2026-101590 22.10.2026 9.1
CVE-2026-101634 21.10.2026 9.1
CVE-2026-101763 21.10.2026 9.8
CVE-2026-101765 21.10.2026 9.1
CVE-2026-101767 21.10.2026 9.8
CVE-2026-101808 21.10.2026 9.1
CVE-2026-101809 24.10.2026 10
CVE-2026-60432 21.10.2026 9.8
CVE-2026-83396 21.10.2026 9.8
CVE-2026-83397 21.10.2026 9.8
CVE-2026-83399 21.10.2026 9.8
CVE-2026-87251 21.10.2026 9.8
CVE-2026-87302 21.10.2026 9.1
CVE-2026-87337 20.10.2026 10
CVE-2026-87347 20.10.2026 9.6
CVE-2026-91214 21.10.2026 9.8
CVE-2026-91216 20.10.2026 10
CVE-2026-91218 20.10.2026 9.6
CVE-2026-91220 21.10.2026 9.8
CVE-2026-91221 20.10.2026 10
CVE-2026-91222 20.10.2026 9.9
CVE-2026-91224 20.10.2026 9.9
CVE-2026-91225 20.10.2026 9.1
CVE-2026-91230 20.10.2026 9.3
CVE-2026-91231 20.10.2026 10
CVE-2026-91232 20.10.2026 9.9
CVE-2026-91233 21.10.2026 9.8
CVE-2026-91234 21.10.2026 9.8
CVE-2026-91235 21.10.2026 9.8
CVE-2026-91236 21.10.2026 9.8
CVE-2026-91241 20.10.2026 9.1
CVE-2026-91243 20.10.2026 9.6
CVE-2026-91250 20.10.2026 9.9
CVE-2026-91251 20.10.2026 9.9
CVE-2026-91265 22.10.2026 9.1
CVE-2026-91299 23.10.2026 10
CVE-2026-91305 22.10.2026 9.1
CVE-2026-91323 21.10.2026 9.8
CVE-2026-91341 20.10.2026 9.1
CVE-2026-91354 20.10.2026 9.9
CVE-2026-91408 21.10.2026 9.8
CVE-2026-91490 21.10.2026 9.1
CVE-2026-91491 21.10.2026 9.8
CVE-2026-91495 21.10.2026 9.8
CVE-2026-91622 20.10.2026 9.3
CVE-2026-91624 21.10.2026 9.1
CVE-2026-91637 23.10.2026 9.9
CVE-2026-91638 23.10.2026 9.9
CVE-2026-91644 20.10.2026 9.3
CVE-2026-91655 20.10.2026 9.1
CVE-2026-91656 20.10.2026 9.1
CVE-2026-91658 23.10.2026 9.9
CVE-2026-91663 23.10.2026 9.9
CVE-2026-91665 22.10.2026 9.8
CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch 20.10.2026 9.1
CVE-2016-20101 Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php 20.10.2026 9.2
CVE-2026-10131 23.10.2026 9.1
CVE-2026-10132 23.10.2026 9.1
CVE-2026-10133 23.10.2026 9.1
CVE-2026-10135 23.10.2026 9.1
CVE-2026-10136 23.10.2026 9.1
CVE-2026-10137 23.10.2026 9.1
CVE-2026-10138 23.10.2026 9.1
CVE-2026-10139 23.10.2026 9.1
CVE-2026-10141 23.10.2026 9.1
CVE-2026-28763 20.10.2026 9.1
CVE-2026-33568 20.10.2026 9.1
CVE-2026-35499 23.10.2026 9.1
CVE-2026-40615 20.10.2026 9.1
CVE-2026-40627 20.10.2026 9.1
CVE-2026-41222 20.10.2026 9.1
CVE-2026-41223 20.10.2026 9.1
CVE-2026-42019 20.10.2026 9.1
CVE-2026-42020 20.10.2026 9.1
CVE-2026-42021 23.10.2026 9.1
CVE-2026-42022 23.10.2026 9.1
CVE-2026-42023 23.10.2026 9.1
CVE-2026-42024 23.10.2026 9.1
CVE-2026-42025 23.10.2026 9.1
CVE-2026-42026 23.10.2026 9.1
CVE-2026-9659 20.10.2026 9.1
CVE-2026-9660 23.10.2026 9.1
CVE-2026-9814 23.10.2026 9.1
CVE-2026-9817 23.10.2026 9.1
CVE-2026-9827 23.10.2026 9.1
CVE-2026-9869 23.10.2026 9.1
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew 20.10.2026 9
CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server 20.10.2026 9.9
CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server 21.10.2026 9.9
CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server 20.10.2026 9.9
CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler 21.10.2026 9.3
CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId 20.10.2026 9.1
CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injection 20.10.2026 9.4
CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing 23.10.2026 9.1
CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin 21.10.2026 9.2
CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 23.10.2026 9.4
CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password 23.10.2026 9.1
CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user 21.10.2026 9.3
CVE-2026-93475 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 20.10.2026 9.3
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection 20.10.2026 9.4
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection 22.10.2026 9.4
CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT 20.10.2026 9.8
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection 20.10.2026 9.4
CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation 20.10.2026 9.9
CVE-2026-43844 20.10.2026 9.3
CVE-2026-43845 20.10.2026 9.2
CVE-2026-43836 20.10.2026 9.3
CVE-2026-43838 20.10.2026 9.2
CVE-2026-113380 20.10.2026 9.3
CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell 20.10.2026 9.3
CVE-2026-109444 OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection 22.10.2026 9.3
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint 20.10.2026 9.3
CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents 22.10.2026 9.3
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent 20.10.2026 9.3
CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 20.10.2026 9.3
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 20.10.2026 9.3
CVE-2026-112371 H3C Magic NX15 RPC esps write code injection 20.10.2026 9.4
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection 22.10.2026 9.4
CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE 20.10.2026 9.2
CVE-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecode 22.10.2026 9.2
CVE-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution 22.10.2026 9.2
CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO 19.10.2026 9.2
CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations 20.10.2026 9.3
CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass 20.10.2026 9.3
CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 22.10.2026 9.3
CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend 23.10.2026 9.2
CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack 20.10.2026 9.1
CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 20.10.2026 9.6
CVE-2026-111862 Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code 20.10.2026 9.8
CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass 19.10.2026 10
CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels 19.10.2026 9.8
CVE-2026-109432 Camunda Expression Injection via orQueries RCE 19.10.2026 9.3
CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules 19.10.2026 9.3
CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials 19.10.2026 9.3
CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) 20.10.2026 10

Latest Updates

CVE Title Updated Score
CVE-2026-116229 ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting 26.10.2026
CVE-2026-116230 Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization 26.10.2026
CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records 26.10.2026
CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback 26.10.2026 5.3
CVE-2026-107894 26.10.2026 7.8
CVE-2026-107895 26.10.2026 7.8
CVE-2026-107896 26.10.2026 7.8
CVE-2026-107897 26.10.2026 7.8
CVE-2026-107898 26.10.2026 7.8
CVE-2026-107899 26.10.2026 7.8
CVE-2026-107900 26.10.2026 7.8
CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency 26.10.2026 5.3
CVE-2026-116224 fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery 26.10.2026
CVE-2026-116227 Edimax BR-6208AC Virtual Server cross site scripting 26.10.2026
CVE-2026-116228 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication 26.10.2026
CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery 26.10.2026
CVE-2026-103299 nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret 26.10.2026
CVE-2026-103306 iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback 26.10.2026
CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key 26.10.2026
CVE-2026-103381 Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery 26.10.2026
CVE-2026-116124 GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow 26.10.2026
CVE-2026-116223 icret EasyImage del.php privileges management 26.10.2026
CVE-2026-116123 NocoDB signup validatePassword excessive authentication 26.10.2026
CVE-2026-116122 NocoDB Sign-in Endpoint AuthService.validateUser information disclosure 26.10.2026
CVE-2026-116120 NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources 26.10.2026
CVE-2026-116121 NocoDB Registration users.service.ts race condition 26.10.2026
CVE-2026-116119 NocoDB Password-Reset Flow users.service.ts race condition 26.10.2026
CVE-2026-113345 26.10.2026
CVE-2026-116118 Z.ai Zcode Sed Command Filter os command injection 26.10.2026
CVE-2026-116117 halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal 26.10.2026
CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification 26.10.2026
CVE-2026-116115 Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization 26.10.2026
CVE-2026-116113 GouGuOA Api.php chunkUpload unrestricted upload 26.10.2026
CVE-2026-116114 Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission 26.10.2026
CVE-2026-116112 HashenUdara edoc-doctor-appointment-system add-new.php sql injection 26.10.2026
CVE-2026-116111 2K Games Civilization V Lua Sandbox loadstring type confusion 26.10.2026
CVE-2026-116109 continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection 26.10.2026
CVE-2026-116110 GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication 26.10.2026
CVE-2026-116107 Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization 26.10.2026
CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control 26.10.2026
CVE-2026-116105 HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission 26.10.2026
CVE-2026-116106 HeyCyan App FileProvider access control 26.10.2026
CVE-2026-116103 Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection 26.10.2026
CVE-2026-116104 Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection 26.10.2026
CVE-2026-116100 gougucms User Level Level.php add cross site scripting 26.10.2026
CVE-2026-116101 itsourcecode Online Cake Ordering System deletetransac.php sql injection 26.10.2026
CVE-2026-116102 QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection 26.10.2026
CVE-2026-116099 Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write 26.10.2026
CVE-2026-116098 SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization 25.10.2026
CVE-2026-116097 CloudClassroom-PHP-Project addnewstudent.php cross site scripting 25.10.2026
CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write 25.10.2026
CVE-2026-116095 smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation 25.10.2026
CVE-2026-116094 EyouCMS function.php remote_file_to_local server-side request forgery 25.10.2026
CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records 25.10.2026
CVE-2026-115627 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows 25.10.2026
CVE-2026-115635 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set 25.10.2026
CVE-2026-116063 DedeCMS update_guide.php require_once code injection 25.10.2026
CVE-2026-116062 SourceCodester Performance Indicator System save_profile.php sql injection 25.10.2026
CVE-2026-116061 SourceCodester Performance Indicator System edit_dealer.php sql injection 25.10.2026
CVE-2026-115817 Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers 25.10.2026
CVE-2026-115822 Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies 25.10.2026
CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections 25.10.2026
CVE-2026-115824 Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies 25.10.2026
CVE-2026-115825 HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length 26.10.2026
CVE-2026-116060 SourceCodester Performance Indicator System adddealer.php sql injection 25.10.2026
CVE-2026-116058 Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection 25.10.2026
CVE-2026-116057 KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload 25.10.2026
CVE-2026-116056 KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery 25.10.2026
CVE-2026-116055 SourceCodester Performance Indicator System deleteproduct.php sql injection 25.10.2026
CVE-2026-116054 SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash 25.10.2026
CVE-2026-116053 dbcli mycli Whitelist source.py source_special_command_is_safe os command injection 25.10.2026
CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering 25.10.2026
CVE-2026-116140 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing 25.10.2026
CVE-2026-116141 ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder 25.10.2026
CVE-2026-116142 ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box 25.10.2026
CVE-2026-116143 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders 25.10.2026
CVE-2026-116144 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder 25.10.2026
CVE-2026-116145 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix 25.10.2026
CVE-2026-116146 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder 25.10.2026
CVE-2026-116147 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder 25.10.2026
CVE-2026-116148 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options 25.10.2026
CVE-2026-116149 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images 25.10.2026
CVE-2026-116150 ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder 25.10.2026
CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder 25.10.2026
CVE-2026-116152 ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path 25.10.2026
CVE-2026-116153 ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit 25.10.2026
CVE-2026-116154 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit 25.10.2026
CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile 25.10.2026
CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option 25.10.2026
CVE-2026-116157 ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading 25.10.2026
CVE-2026-116158 ImageMagick before 7.1.2-33 Memory Leak in magick compare 25.10.2026
CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option 25.10.2026
CVE-2026-116160 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate 25.10.2026
CVE-2026-116161 Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions 25.10.2026
CVE-2026-116162 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login 25.10.2026
CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 25.10.2026
CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes 25.10.2026
CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB 25.10.2026
CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting 25.10.2026
CVE-2026-116167 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter 25.10.2026
CVE-2026-116168 SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool 25.10.2026
CVE-2026-116169 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks 25.10.2026
CVE-2026-116170 SiYuan before v3.8.7 SQL Injection via History Search op and query 25.10.2026
CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix 25.10.2026
CVE-2026-116172 vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n 25.10.2026
CVE-2026-116173 vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids 25.10.2026
CVE-2026-116174 vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate 25.10.2026
CVE-2026-116175 vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions 25.10.2026
CVE-2026-116176 vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector 25.10.2026
CVE-2026-116177 vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass 25.10.2026
CVE-2026-116178 vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders 25.10.2026
CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override 25.10.2026
CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors 25.10.2026
CVE-2026-116181 vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids 25.10.2026
CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching 25.10.2026
CVE-2026-116183 phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID 25.10.2026
CVE-2026-116184 OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket 25.10.2026
CVE-2026-116185 OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos 25.10.2026
CVE-2026-116186 OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId 25.10.2026
CVE-2026-116187 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads 25.10.2026
CVE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow 25.10.2026
CVE-2026-116189 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS 25.10.2026
CVE-2026-116190 rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect 25.10.2026
CVE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL 25.10.2026
CVE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots 25.10.2026
CVE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests 25.10.2026
CVE-2026-116194 Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback 25.10.2026
CVE-2026-116195 Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim 25.10.2026
CVE-2026-116196 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url 25.10.2026
CVE-2026-116197 Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection 25.10.2026
CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store 25.10.2026
CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback 25.10.2026
CVE-2026-116200 Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() 25.10.2026
CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition 25.10.2026
CVE-2026-116202 YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload 25.10.2026
CVE-2026-116203 YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters 25.10.2026
CVE-2026-116204 YesWiki before 4.7.0 CSRF via despam Admin Action 25.10.2026
CVE-2026-116205 YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax 25.10.2026
CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax 25.10.2026
CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API 25.10.2026
CVE-2026-116208 YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts 25.10.2026
CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create 25.10.2026
CVE-2026-116052 LinkStackOrg LinkStack cross-site request forgery 25.10.2026
CVE-2026-116066 Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service 25.10.2026
CVE-2026-116067 Paisa before 0.7.8 Path Traversal via Editor and Sheet API 25.10.2026
CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router 25.10.2026
CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field 25.10.2026
CVE-2026-116070 Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config 25.10.2026
CVE-2026-116071 rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption 25.10.2026
CVE-2026-116072 Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity 25.10.2026
CVE-2026-116073 Leon before commit 50df142 Path Traversal via /download model Command 25.10.2026
CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking 25.10.2026
CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names 25.10.2026