CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass 08.11.2026 9.3
CVE-2026-123550 OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions 08.11.2026 9.3
CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket 08.11.2026 10
CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow 08.11.2026 9.3
CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow 07.11.2026 9.4
CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow 07.11.2026 9.4
CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow 07.11.2026 9.4
CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow 07.11.2026 9.4
CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow 07.11.2026 10
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 07.11.2026 9.1
CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action 07.11.2026 9.1
CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 07.11.2026 9.8
CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 07.11.2026 9.1
CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout 07.11.2026 9.8
CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow 07.11.2026 9.4
CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow 07.11.2026 9.4
CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow 07.11.2026 9.4
CVE-2026-18535 IBM API Connect Denial of Service 08.11.2026 9.6
CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17297 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17298 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17299 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17301 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17313 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17329 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17338 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17339 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17340 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17344 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17353 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17354 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17360 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17392 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17394 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17399 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9
CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect 08.11.2026 9.4
CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-123218 IBM Aspera Faspex Authorization Bypass 07.11.2026 9.8
CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 07.11.2026 9.8
CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 07.11.2026 9.8
CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability 06.11.2026 10
CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials 06.11.2026 9.3
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections 06.11.2026 9.1
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution 06.11.2026 9.8
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 06.11.2026 9.8
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 06.11.2026 9.3
CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 06.11.2026 9.4
CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 06.11.2026 9.6
CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 06.11.2026 9.8
CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 06.11.2026 9.8
CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 06.11.2026 9.8
CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State 06.11.2026 9.2
CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser 07.11.2026 9.3
CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access 06.11.2026 10
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX) 06.11.2026 9.3
CVE-2026-123831 07.11.2026 9.6
CVE-2026-123832 07.11.2026 9.6
CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint 06.11.2026 9.3
CVE-2026-59105 Universal sysadmin credential vulnerability in Jumis 06.11.2026 9.3
CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter 06.11.2026 9.8
CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter 06.11.2026 9.1
CVE-2026-123279 06.11.2026 9
CVE-2026-123294 07.11.2026 9.6
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability 07.11.2026 9.8
CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability 06.11.2026 9.8
CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload 06.11.2026 10
CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion 06.11.2026 9.1
CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization 06.11.2026 9.4
CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection 06.11.2026 9.4
CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads 05.11.2026 9.6
CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app 05.11.2026 9.1
CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API 05.11.2026 9.9
CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform 05.11.2026 9.9
CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure 05.11.2026 9.3
CVE-2026-48705 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) 05.11.2026 9.3
CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 05.11.2026 9
CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS 05.11.2026 9.1
CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment 05.11.2026 9.6
CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY 05.11.2026 9.1
CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 07.11.2026 9.8
CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling 05.11.2026 9.1
CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection 05.11.2026 9.4
CVE-2026-71550 SuiteCRM: LFI to RCE via AOW_WorkFlow 05.11.2026 9.9
CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> 05.11.2026 9.3
CVE-2026-54143 OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution 05.11.2026 9.8
CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec` 05.11.2026 9
CVE-2026-119344 Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks 05.11.2026 9.1
CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names 07.11.2026 9.1
CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 05.11.2026 10
CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override 05.11.2026 10
CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors 05.11.2026 10
CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults 05.11.2026 10
CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 05.11.2026 10
CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 05.11.2026 10
CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 05.11.2026 10
CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing 05.11.2026 10
CVE-2026-100109 Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user 05.11.2026 9.8
CVE-2026-123025 05.11.2026 9.4
CVE-2026-122992 05.11.2026 9.2
CVE-2026-122302 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check 05.11.2026 9.3
CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader 05.11.2026 9.4
CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath 05.11.2026 9.4
CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument 05.11.2026 9.4
CVE-2026-122313 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122051 Edimax BR-6208AC mp command injection 05.11.2026 10
CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing 04.11.2026 9.6
CVE-2026-52848 GLPI: MFA bypass 04.11.2026 9.2
CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ 04.11.2026 9.3
CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint 04.11.2026 9.3
CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy 05.11.2026 9.3
CVE-2026-102894 GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover 06.11.2026 9.1
CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 06.11.2026 9.8
CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise 04.11.2026 9.9
CVE-2026-82418 IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL 04.11.2026 9.8
CVE-2026-122013 Comfast CF-WR632AX Multipart webmgnt path traversal 04.11.2026 10
CVE-2025-71457 vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php 05.11.2026 9.3
CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again 04.11.2026 9.1
CVE-2026-122220 WPO365 LOGIN before 45.2 SAML Replay Protection Bypass 05.11.2026 9.1
CVE-2026-121933 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication 04.11.2026 10
CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list 04.11.2026 9.3
CVE-2026-113780 ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary 05.11.2026 9.3
CVE-2026-121932 Linksys E5350 apply.cgi system os command injection 04.11.2026 10
CVE-2026-121931 Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-121930 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-122120 05.11.2026 9
CVE-2026-121952 FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability 04.11.2026 9.3
CVE-2026-121953 FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close 04.11.2026 9.3
CVE-2026-121638 WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks 04.11.2026 9.1
CVE-2026-121639 WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service 04.11.2026 9.2
CVE-2026-121640 WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions 04.11.2026 9.1
CVE-2026-122006 05.11.2026 9.8
CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking 04.11.2026 9.2
CVE-2026-119481 WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-65555 WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-114424 Code execution through double evaluation in address replacement rules 04.11.2026 9.2
CVE-2026-114425 Forged LFT metadata permits arbitrary file read and deletion 04.11.2026 9.2
CVE-2026-121802 06.11.2026 9.1
CVE-2026-121615 Linksys E5600 Login mesh_login.cgi improper authentication 04.11.2026 10
CVE-2026-121609 Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials 04.11.2026 10
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 04.11.2026 10
CVE-2026-121606 Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 04.11.2026 10
CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow 04.11.2026 9.4
CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow 04.11.2026 9.4
CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow 07.11.2026 9.4
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow 04.11.2026 9.4
CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality 06.11.2026 9.3
CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 05.11.2026 9.1
CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials 07.11.2026 9.3
CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 06.11.2026 9.2
CVE-2026-82158 03.11.2026 9
CVE-2026-115731 Report Deserialization Code Execution 06.11.2026 9.4
CVE-2026-115732 Certificate Name Authorization Bypass 06.11.2026 9
CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 07.11.2026 9.1
CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access 03.11.2026 9.8
CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 03.11.2026 9.3
CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 03.11.2026 9.3
CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 07.11.2026 9.3
CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall 04.11.2026 9.2
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 03.11.2026 9.8
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 07.11.2026 9.8
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability 04.11.2026 9.9
CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 03.11.2026 9.4
CVE-2026-121392 FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 03.11.2026 9.1
CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 03.11.2026 9.2
CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client 03.11.2026 9.2
CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 03.11.2026 9.8
CVE-2026-13594 Improper Access Control vulnerability 04.11.2026 9.1
CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler 07.11.2026 9.1
CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 03.11.2026 9.8
CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 02.11.2026 9.8
CVE-2026-116769 Authentication bypass in Secure Access Servers 06.11.2026 9.3
CVE-2026-97718 CSRF in Secure Access Server v14.60 06.11.2026 9.4
CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 03.11.2026 9.8
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 05.11.2026 9.5
CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 05.11.2026 9.3
CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 05.11.2026 9.4
CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench 03.11.2026 9.4
CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 02.11.2026 9.3
CVE-2026-88811 Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy 03.11.2026 9.1
CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller 03.11.2026 9.1
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 05.11.2026 9.3
CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 06.11.2026 9.2
CVE-2026-120459 python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key 02.11.2026 9.1
CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway 03.11.2026 9.3
CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters 02.11.2026 9.1
CVE-2025-11969 Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions 02.11.2026 9.4
CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection 05.11.2026 10
CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection 02.11.2026 10
CVE-2026-120322 Termix-SSH Termix transferToHost path traversal 02.11.2026 9.4
CVE-2026-120283 Linksys E8450 portal.cgi strcpy stack-based overflow 02.11.2026 10
CVE-2026-120281 WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow 06.11.2026 10
CVE-2026-120282 WAVLINK WN536AX6-A protocol.csp host_black os command injection 02.11.2026 9.4
CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection 02.11.2026 10
CVE-2026-120280 WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection 05.11.2026 10
CVE-2026-120277 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 06.11.2026 10
CVE-2026-120276 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 05.11.2026 10
CVE-2026-120240 WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection 02.11.2026 9.4
CVE-2026-120239 WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection 02.11.2026 9.4
CVE-2026-120238 WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection 06.11.2026 9.4
CVE-2026-62048 WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability 01.11.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2026-103303 Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting 08.11.2026
CVE-2026-103375 Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure 08.11.2026
CVE-2026-104307 BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error 08.11.2026
CVE-2026-104337 Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply 08.11.2026
CVE-2026-104338 Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route 08.11.2026
CVE-2026-104639 Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook 08.11.2026
CVE-2026-105970 BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation 08.11.2026
CVE-2026-106015 Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force 08.11.2026
CVE-2026-109925 Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers 08.11.2026
CVE-2026-110132 Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification 08.11.2026
CVE-2026-110963 Userplace <= 1.2.0 - Unauthenticated Privilege Escalation 08.11.2026
CVE-2026-114432 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename 08.11.2026
CVE-2026-122060 WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure 08.11.2026
CVE-2026-122062 Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API 08.11.2026
CVE-2026-122085 Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure 08.11.2026
CVE-2026-85344 FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization 08.11.2026
CVE-2026-96961 Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction 08.11.2026
CVE-2026-96963 Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification 08.11.2026
CVE-2026-97192 Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path 08.11.2026
CVE-2026-97193 Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 08.11.2026
CVE-2026-97194 Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields 08.11.2026
CVE-2026-97195 Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition 08.11.2026
CVE-2026-114713 08.11.2026 8.6
CVE-2026-123493 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens 08.11.2026
CVE-2026-123494 Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks 08.11.2026
CVE-2026-123495 Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback 08.11.2026
CVE-2026-123496 Vikunja veans before 2.7.1 Symlink Following in veans init 08.11.2026
CVE-2026-123497 Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery 08.11.2026
CVE-2026-123498 Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata 08.11.2026
CVE-2026-123499 Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server 08.11.2026
CVE-2026-123500 Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump 08.11.2026
CVE-2026-123501 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes 08.11.2026
CVE-2026-123502 Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging 08.11.2026
CVE-2026-123503 Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion 08.11.2026
CVE-2026-123504 Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members 08.11.2026
CVE-2026-123505 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database 08.11.2026
CVE-2026-123506 Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints 08.11.2026
CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter 08.11.2026
CVE-2026-123508 Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain 08.11.2026
CVE-2026-123509 Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count 08.11.2026
CVE-2026-123510 Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath 08.11.2026
CVE-2026-123511 Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries 08.11.2026
CVE-2026-123512 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs 08.11.2026
CVE-2026-123513 Vikunja before 2.7.1 Auth Token Leak via API URL Change 08.11.2026
CVE-2026-123514 Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion 08.11.2026
CVE-2026-123515 Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images 08.11.2026
CVE-2026-123516 Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import 08.11.2026
CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint 08.11.2026
CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move 08.11.2026
CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports 08.11.2026
CVE-2026-123520 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion 08.11.2026
CVE-2026-123521 Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint 08.11.2026
CVE-2026-123522 Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook 08.11.2026
CVE-2026-123523 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache 08.11.2026
CVE-2026-123524 Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload 08.11.2026
CVE-2026-123525 Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations 08.11.2026
CVE-2026-123526 Vikunja before 2.7.1 Mass Assignment via Team external_id Field 08.11.2026
CVE-2026-123527 Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass 08.11.2026
CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware 08.11.2026
CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color 08.11.2026
CVE-2026-123530 Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints 08.11.2026
CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter 08.11.2026
CVE-2026-123532 gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe 08.11.2026
CVE-2026-123533 Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File 08.11.2026
CVE-2026-123534 Tornado before 6.6 Path Traversal via static_url() Version Hashing 08.11.2026
CVE-2026-123535 Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age 08.11.2026
CVE-2026-123536 OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs 08.11.2026
CVE-2026-123537 OpenAM before 16.1.4 SSRF via UMA Scope Description URLs 08.11.2026
CVE-2026-123538 OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation 08.11.2026
CVE-2026-123539 OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name 08.11.2026
CVE-2026-123540 OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST 08.11.2026
CVE-2026-123541 OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching 08.11.2026
CVE-2026-123542 OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow 08.11.2026
CVE-2026-123543 OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation 08.11.2026
CVE-2026-123544 OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel 08.11.2026
CVE-2026-123545 OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow 08.11.2026
CVE-2026-123546 OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail 08.11.2026
CVE-2026-123547 OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState 08.11.2026
CVE-2026-123548 OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages 08.11.2026
CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass 08.11.2026
CVE-2026-123550 OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions 08.11.2026
CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket 08.11.2026
CVE-2026-123552 OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point 08.11.2026
CVE-2026-123553 OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login 08.11.2026
CVE-2026-123554 Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check 08.11.2026
CVE-2026-123555 Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures 08.11.2026
CVE-2026-123556 Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring 08.11.2026
CVE-2026-123557 Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection 08.11.2026
CVE-2026-123558 Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind 08.11.2026
CVE-2026-123559 Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation 08.11.2026
CVE-2026-123560 Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body 08.11.2026
CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion 08.11.2026
CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection 08.11.2026
CVE-2026-123563 Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse 08.11.2026
CVE-2026-123564 Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays 08.11.2026
CVE-2026-123565 Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval 08.11.2026
CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval 08.11.2026
CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten 08.11.2026
CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output 08.11.2026
CVE-2026-123569 Devalue before 5.6.3 Denial of Service via Sparse Array Serialization 08.11.2026
CVE-2026-123570 Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts 08.11.2026
CVE-2026-123571 Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding 08.11.2026
CVE-2026-123572 Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser 08.11.2026
CVE-2026-123573 hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser 08.11.2026
CVE-2026-123574 Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser 08.11.2026
CVE-2026-123575 Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies 08.11.2026
CVE-2026-123576 Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests 08.11.2026
CVE-2026-123577 Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service 08.11.2026
CVE-2026-123578 Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0 08.11.2026
CVE-2026-123579 Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion 08.11.2026
CVE-2026-123580 Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3 08.11.2026
CVE-2026-123581 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset 08.11.2026
CVE-2026-123582 Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record 08.11.2026
CVE-2026-123583 Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses 08.11.2026
CVE-2026-123584 Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses 08.11.2026
CVE-2026-123585 Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records 08.11.2026
CVE-2026-123586 Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals 08.11.2026
CVE-2026-123587 Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC 08.11.2026
CVE-2026-123588 Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool 08.11.2026
CVE-2026-123589 Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout 08.11.2026
CVE-2026-123590 Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation 08.11.2026
CVE-2026-123591 Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks 08.11.2026
CVE-2026-123592 Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision 08.11.2026
CVE-2026-123593 Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors 08.11.2026
CVE-2026-123594 Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals 08.11.2026
CVE-2026-123595 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3 08.11.2026
CVE-2026-123596 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC 08.11.2026
CVE-2026-123597 Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors 08.11.2026
CVE-2026-123598 Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning 08.11.2026
CVE-2026-123599 Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records 08.11.2026
CVE-2026-123600 Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass 08.11.2026
CVE-2026-123601 Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery 08.11.2026
CVE-2026-123602 Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching 08.11.2026
CVE-2026-123603 Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass 08.11.2026
CVE-2026-123604 Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop 08.11.2026
CVE-2026-123605 Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name 08.11.2026
CVE-2026-123606 Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification 08.11.2026
CVE-2026-123607 Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service 08.11.2026
CVE-2026-123608 Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression 08.11.2026
CVE-2026-123609 Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug 08.11.2026
CVE-2026-123610 rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression 08.11.2026
CVE-2026-123611 rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello 08.11.2026
CVE-2026-123612 rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure 08.11.2026
CVE-2026-123613 Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass 08.11.2026
CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow 08.11.2026
CVE-2026-123615 imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader 08.11.2026
CVE-2026-123616 imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader 08.11.2026
CVE-2026-124422 SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder 08.11.2026
CVE-2026-120531 Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter 07.11.2026 7.2
CVE-2026-99284 net: skbuff: propagate shared-frag marker in skb_zerocopy() 07.11.2026
CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow 07.11.2026
CVE-2026-99283 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets 07.11.2026
CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow 07.11.2026
CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow 07.11.2026
CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow 07.11.2026
CVE-2026-119522 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120836 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability 07.11.2026 6.5
CVE-2026-123461 WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123472 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-124258 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123992 DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting 07.11.2026
CVE-2026-123991 DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload 07.11.2026
CVE-2026-123990 DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection 07.11.2026