CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway 18.10.2026 9.3
CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor 18.10.2026 9.2
CVE-2026-109894 WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability 18.10.2026 9.3
CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 18.10.2026 9.8
CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability 18.10.2026 9.8
CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection 17.10.2026 9.3
CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter 18.10.2026 9.8
CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter 18.10.2026 9.1
CVE-2026-111823 16.10.2026 9.8
CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution 16.10.2026 9.2
CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) 16.10.2026 9
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers 16.10.2026 9.3
CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret 16.10.2026 9.2
CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints 16.10.2026 9.3
CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback 16.10.2026 9.3
CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation 16.10.2026 9.2
CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints 16.10.2026 9.3
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover 16.10.2026 9.1
CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint 16.10.2026 9.3
CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass 16.10.2026 9.3
CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header 16.10.2026 9.1
CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret 16.10.2026 9.3
CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials 16.10.2026 9.3
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers 16.10.2026 9.3
CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup 16.10.2026 9.3
CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() 16.10.2026 9.3
CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling 16.10.2026 9.2
CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel 16.10.2026 9.3
CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel 16.10.2026 9.3
CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access 16.10.2026 9.1
CVE-2026-102693 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID 16.10.2026 9.6
CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read 16.10.2026 9.8
CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections 16.10.2026 9.9
CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's 16.10.2026 9.9
CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. 16.10.2026 9.9
CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade 16.10.2026 9.6
CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context 16.10.2026 9
CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function 16.10.2026 9.3
CVE-2026-107617 Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials 16.10.2026 9.3
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller 18.10.2026 9.6
CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter 16.10.2026 9.2
CVE-2026-111472 SQL injection in TSG Profleet 16.10.2026 9.3
CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability 16.10.2026 10
CVE-2026-94388 WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability 16.10.2026 9.3
CVE-2026-104730 Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter 16.10.2026 9.8
CVE-2026-103768 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment 16.10.2026 9.8
CVE-2026-89079 Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter 16.10.2026 9.8
CVE-2026-104798 My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute 16.10.2026 9.8
CVE-2026-109219 Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter 16.10.2026 9.8
CVE-2026-109515 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter 16.10.2026 9.8
CVE-2026-111444 16.10.2026 9.8
CVE-2026-111281 Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials 15.10.2026 9.3
CVE-2026-111283 BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration 18.10.2026 9.5
CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route 15.10.2026 9.2
CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API 16.10.2026 9.3
CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console 16.10.2026 9.3
CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force 16.10.2026 9.1
CVE-2026-105032 EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write 16.10.2026 9.1
CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read 16.10.2026 9.9
CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching 16.10.2026 9.8
CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks 16.10.2026 9.6
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support 17.10.2026 9.3
CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method 16.10.2026 9.1
CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction 15.10.2026 9.6
CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json 15.10.2026 9.1
CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox 15.10.2026 9.3
CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates 15.10.2026 9.1
CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS 15.10.2026 9.3
CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune 16.10.2026 9.4
CVE-2026-105474 15.10.2026 9.4
CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflow 15.10.2026 10
CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer 15.10.2026 9.9
CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection 15.10.2026 10
CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params 15.10.2026 9.1
CVE-2026-109686 WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability 15.10.2026 9.8
CVE-2026-109688 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability 15.10.2026 9.3
CVE-2026-109892 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability 15.10.2026 9.8
CVE-2026-99999 ipv4: validate checksum_start before completing checksum 17.10.2026 9.3
CVE-2026-109698 WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability 15.10.2026 9.3
CVE-2026-108497 WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability 16.10.2026 9.3
CVE-2026-109694 WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability 15.10.2026 9.8
CVE-2026-19863 15.10.2026 9.3
CVE-2026-34006 Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer 15.10.2026 9.3
CVE-2026-47786 Pre-Authentication Command Injection 15.10.2026 9.3
CVE-2026-50612 Import Symlink Following Remote Code Execution Vulnerability in QuMagie 15.10.2026 9.4
CVE-2026-50619 Unauthenticated remote code execution vulnerability 15.10.2026 9.3
CVE-2026-101287 Authentication bypass in Stela by Diaple Networking 15.10.2026 9.3
CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz 16.10.2026 9.2
CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 16.10.2026 9.4
CVE-2026-102469 15.10.2026 9.2
CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter 15.10.2026 9.8
CVE-2026-93483 15.10.2026 9.5
CVE-2026-110911 15.10.2026 9.8
CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec 16.10.2026 9.2
CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link 15.10.2026 9.3
CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy 15.10.2026 9.1
CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset 15.10.2026 9
CVE-2026-108336 Token Signing Key Allows Unauthenticated Administrative Access 16.10.2026 9.1
CVE-2026-108335 Password Reset Functionality Missing Brute-Force Protection 15.10.2026 9.1
CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php 15.10.2026 9.8
CVE-2026-55680 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter 15.10.2026 9.8
CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php 15.10.2026 9.8
CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service 15.10.2026 9.2
CVE-2026-110770 Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force 14.10.2026 9.2
CVE-2026-110536 D-Link DIR-868L HNAP CGI cgibin system os command injection 15.10.2026 10
CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2 15.10.2026 9.1
CVE-2026-102476 16.10.2026 9.1
CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username 14.10.2026 10
CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain 15.10.2026 9.8
CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access 14.10.2026 9.3
CVE-2026-103415 16.10.2026 9.3
CVE-2026-101954 Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled 16.10.2026 9.3
CVE-2026-101982 Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used 16.10.2026 9.3
CVE-2026-101983 Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured 15.10.2026 9.3
CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking 14.10.2026 9.9
CVE-2026-92152 F´: Unvalidated Port Index in GenericHub 14.10.2026 9.3
CVE-2026-102182 Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution 15.10.2026 9.3
CVE-2026-33789 Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service 15.10.2026 9.2
CVE-2026-33792 Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured 15.10.2026 9.3
CVE-2026-33796 Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled 15.10.2026 9.3
CVE-2026-102031 Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled 16.10.2026 9.3
CVE-2026-102037 Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used 16.10.2026 9.2
CVE-2026-102175 Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used 16.10.2026 9.3
CVE-2026-102178 Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise 16.10.2026 9.3
CVE-2026-109439 Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718 16.10.2026 9.3
CVE-2026-101950 Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled 17.10.2026 9.3
CVE-2026-101955 Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used 16.10.2026 9.2
CVE-2026-101990 Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised 16.10.2026 9.3
CVE-2026-101997 Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication 16.10.2026 9.2
CVE-2026-102062 Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used 15.10.2026 9.2
CVE-2026-101956 Junos OS: Unauthorized root command execution when J-Web is enabled 15.10.2026 9.3
CVE-2026-101967 Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used 15.10.2026 9.3
CVE-2026-101980 Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled 14.10.2026 9.3
CVE-2026-101986 Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution 15.10.2026 9.3
CVE-2026-102068 Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used 14.10.2026 9.2
CVE-2026-102070 Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used 14.10.2026 9.2
CVE-2026-102084 Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution 15.10.2026 9.2
CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability 15.10.2026 9.8
CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication 14.10.2026 9.9
CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim 15.10.2026 9.1
CVE-2026-86002 Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS 14.10.2026 9
CVE-2026-91881 15.10.2026 9
CVE-2026-15176 NGINX ngx_http_core_module vulnerability 15.10.2026 9.2
CVE-2026-93479 NGINX map directive and regex matching vulnerability 15.10.2026 9.2
CVE-2026-97205 NGINX ngx_http_core_module vulnerability 15.10.2026 9.2
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass 14.10.2026 9.2
CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf 14.10.2026 9.3
CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil 14.10.2026 9.3
CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API 14.10.2026 9.2
CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment 16.10.2026 9.2
CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration 16.10.2026 9.3
CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE 14.10.2026 9.2
CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings 14.10.2026 9.3
CVE-2026-110635 webp-converter before 3.0.0 OS Command Injection via File Names and Options 14.10.2026 9.3
CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths 14.10.2026 9.3
CVE-2026-110638 doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path 16.10.2026 9.3
CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir 14.10.2026 9.3
CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language 14.10.2026 9.3
CVE-2026-110643 transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath 16.10.2026 9.3
CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType 14.10.2026 9.3
CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() 14.10.2026 9.3
CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() 14.10.2026 9.2
CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names 14.10.2026 9.3
CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths 14.10.2026 9.3
CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce 14.10.2026 9.8
CVE-2026-16740 Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP 14.10.2026 9.8
CVE-2026-16741 OS Command in TR7 Cyber ​​Defense's TR7 ASP 14.10.2026 9.8
CVE-2026-107424 WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability 14.10.2026 9.8
CVE-2026-108291 WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability 15.10.2026 9.8
CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service 14.10.2026 9.2
CVE-2026-104748 SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register 15.10.2026 9.8
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS 14.10.2026 9.4
CVE-2026-104800 AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php 15.10.2026 9.8
CVE-2026-87855 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method 14.10.2026 9.8
CVE-2026-110002 Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter 15.10.2026 9.8
CVE-2026-110447 14.10.2026 9.2
CVE-2026-97657 Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter 14.10.2026 9.8
CVE-2026-97668 Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value 15.10.2026 9.8
CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning 14.10.2026 9.8
CVE-2026-92097 Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder 15.10.2026 9.1
CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url 14.10.2026 9.8
CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins 17.10.2026 9.9
CVE-2026-106619 ColdFusion | Improper Input Validation (CWE-20) 14.10.2026 9
CVE-2026-106622 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 14.10.2026 10
CVE-2026-106624 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 14.10.2026 10
CVE-2026-105899 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) 14.10.2026 10
CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 14.10.2026 9.9
CVE-2026-106612 ColdFusion | Incorrect Authorization (CWE-863) 14.10.2026 9.9
CVE-2026-106620 ColdFusion | Incorrect Authorization (CWE-863) 15.10.2026 9.6
CVE-2026-106621 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 14.10.2026 9.1
CVE-2026-49950 Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool 16.10.2026 9.3
CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863) 14.10.2026 9.6
CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 14.10.2026 9.3
CVE-2026-93895 IBM WebSphere Application Server Liberty Improper Access Control 17.10.2026 9.1
CVE-2026-93909 IBM WebSphere Application Server Liberty is affected by an authentication bypass 14.10.2026 9.1
CVE-2026-63158 Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies 14.10.2026 9.1
CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover 14.10.2026 9.1
CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage 18.10.2026 9.1
CVE-2026-103848 Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 14.10.2026 9.9
CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20) 14.10.2026 9.9
CVE-2026-106626 Adobe Experience Manager | Improper Input Validation (CWE-20) 14.10.2026 9.1
CVE-2026-106629 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) 17.10.2026 9.3
CVE-2026-106630 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) 14.10.2026 9.3
CVE-2026-48382 Adobe Experience Manager | Incorrect Authorization (CWE-863) 15.10.2026 10
CVE-2026-48383 Adobe Experience Manager | Incorrect Authorization (CWE-863) 15.10.2026 10
CVE-2026-63146 Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php 17.10.2026 9.3
CVE-2026-63149 Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() 14.10.2026 9.1
CVE-2026-75732 Adobe Experience Manager | Incorrect Authorization (CWE-863) 14.10.2026 9.9
CVE-2026-83662 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) 14.10.2026 9.3
CVE-2026-90531 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 14.10.2026 9.6
CVE-2026-90532 Adobe Experience Manager | Incorrect Authorization (CWE-863) 14.10.2026 10
CVE-2026-104252 Vitess vttablet /twopcz reflected XSS 15.10.2026 9.8
CVE-2026-102238 Visual Studio Code Remote Code Execution Vulnerability 16.10.2026 9.6
CVE-2026-100202 Windows Message Queuing Queue Manager Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-100219 Microsoft QUIC Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-100222 Network Policy Server (NPS) Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-102210 Windows Text Shaping Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-105008 Windows Schannel Spoofing Vulnerability 16.10.2026 9
CVE-2026-105010 Microsoft Windows Search Component Elevation of Privilege Vulnerability 16.10.2026 9.8
CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-110112 Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation 17.10.2026 9.2
CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check 14.10.2026 10
CVE-2026-69634 Windows iSCSI Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-69639 Windows libarchive Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-69705 Windows iSCSI Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-69883 Windows iSCSI Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-69886 Windows Imaging Component Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70024 Windows Internet Information Services Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70096 Windows Rich Text Edit Control Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70147 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70153 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70157 Windows System Information Console Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70188 ASP.NET Core Security Feature Bypass Vulnerability 16.10.2026 9.1
CVE-2026-70242 Microsoft Office Outlook Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70279 Microsoft Exchange Server Spoofing Vulnerability 16.10.2026 9.3
CVE-2026-70291 Microsoft Office Outlook Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-70300 Microsoft Office Word Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83517 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83578 Microsoft PowerShell Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83693 Windows Error Reporting Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83748 Windows Error Reporting Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83770 Windows Text Shaping Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83780 Windows CCFFilter Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83869 Windows Domain Name Service Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83910 RPC Runtime Library Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-83935 Microsoft XML Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-84015 Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-85792 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-85806 Network Policy Server (NPS) Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-85809 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-85814 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-85818 Windows Schannel Spoofing Vulnerability 16.10.2026 9
CVE-2026-85928 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-88092 ASP.NET Core Tampering Vulnerability 16.10.2026 9.4
CVE-2026-88102 Microsoft Failover Cluster Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-88156 Microsoft Office Outlook Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-88178 Microsoft Office PowerPoint Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96096 Windows Media Player Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96113 Windows Domain Name Service Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96219 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96252 Active Directory Federation Services (AD FS) Spoofing Vulnerability 16.10.2026 9.1
CVE-2026-96320 Windows DHCP Server Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96864 Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96909 Windows BitLocker Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96924 Windows OLE Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-96934 Windows DHCP Server Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97016 Microsoft Office Outlook Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97749 Microsoft Office Outlook Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97805 Windows Partition Management Driver Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97814 Windows Text Shaping Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97815 Windows Error Reporting Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-97816 Microsoft OpenSSH for Windows Remote Code Execution Vulnerability 16.10.2026 9.8
CVE-2026-100133 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) 16.10.2026 9.3
CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) 15.10.2026 10
CVE-2026-75120 Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents 16.10.2026 9.3
CVE-2026-91013 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) 14.10.2026 9.3
CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20) 15.10.2026 9.1
CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863) 15.10.2026 9.8
CVE-2026-92892 Potential command execution on the host running JFrog CLI. 16.10.2026 9
CVE-2026-105445 Docker Hub account conversion could reassign an active personal access token to another user 13.10.2026 9.4
CVE-2026-106173 14.10.2026 9.4
CVE-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation 13.10.2026 10
CVE-2026-109412 14.10.2026 9.9
CVE-2026-54454 OpenCATS: Authenticated RCE in the Import module 13.10.2026 9.1
CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page 13.10.2026 9.6
CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field 16.10.2026 9
CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks 14.10.2026 9.9
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses 14.10.2026 9.3
CVE-2026-106042 14.10.2026 9.9
CVE-2026-69227 BUG-000187331 Portal for ArcGIS has a security vulnerability 14.10.2026 9.8
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater 13.10.2026 9.1
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions 13.10.2026 9.3
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 13.10.2026 10
CVE-2026-104192 DragonflyDB stream RDB deserialization double-free 13.10.2026 9.6
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 16.10.2026 9.8
CVE-2026-77099 CVFS Command Execution 14.10.2026 9.3
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 15.10.2026 9.3
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 16.10.2026 9.4
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch 14.10.2026 9.4
CVE-2026-65162 13.10.2026 10
CVE-2026-65173 13.10.2026 9.1
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflow 14.10.2026 9.4
CVE-2026-63350 13.10.2026 9.4
CVE-2026-63353 14.10.2026 9.4
CVE-2026-63354 16.10.2026 9.4
CVE-2026-89309 Missing Authentication Vulnerability in JTL-WMS 16.10.2026 10
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection 15.10.2026 10
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow 14.10.2026 10
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection 16.10.2026 9.4
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification 14.10.2026 9.4
CVE-2026-109758 15.10.2026 9.3
CVE-2026-97229 Integer Overflow or Wraparound in GitLab 14.10.2026 10
CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints 14.10.2026 9.8
CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) 14.10.2026 9.9
CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) 13.10.2026 9.1
CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer 14.10.2026 9.9
CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python 14.10.2026 10
CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI 14.10.2026 9.9
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint 13.10.2026 9.2
CVE-2026-82101 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-82103 DataStage on Cloud Pak for Data Information Disclosure 13.10.2026 9.6
CVE-2026-82110 DataStage on Cloud Pak for Data Path Traversal 12.10.2026 9.6
CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials 13.10.2026 9.3
CVE-2026-90920 Maximo AI Service Code Injection 13.10.2026 9.8
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function 13.10.2026 9.2
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py 13.10.2026 9.3
CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder 12.10.2026 9.3
CVE-2026-109569 sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace 13.10.2026 9.3
CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle 15.10.2026 9.1
CVE-2026-108929 Netcore NR268 DDNS DDNSset.cgi execvp argument injection 16.10.2026 9.4
CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC 12.10.2026 9.2
CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass 15.10.2026 9.1
CVE-2026-109575 13.10.2026 9.8
CVE-2026-96012 IBM Db2 Mirror for i Privilege Escalation 13.10.2026 9.9
CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) 13.10.2026 9.1
CVE-2026-57118 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints 15.10.2026 9.8
CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations 15.10.2026 9.1
CVE-2026-108918 Edimax BR-6208AC formWlanMP command injection 15.10.2026 10
CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults 13.10.2026 9.9
CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade command injection 13.10.2026 10
CVE-2026-108915 Edimax BR-6208AC formWlanMP buffer overflow 13.10.2026 9.4
CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey buffer overflow 15.10.2026 9.4
CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authentication 13.10.2026 10
CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder 13.10.2026 9.2
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass 18.10.2026 9.3
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header 15.10.2026 9.2
CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion 13.10.2026 9.3
CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie 13.10.2026 9.2
CVE-2026-85955 Improper privilege management in Progress MarkLogic Server xdmp:eval-in 14.10.2026 9.9
CVE-2026-85956 Improper privilege management in Progress MarkLogic Server backup and restore operations 14.10.2026 9.6
CVE-2026-85947 Improper privilege management in Progress MarkLogic Server forest operations 14.10.2026 9.9
CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API 14.10.2026 9.9
CVE-2026-9191 Insufficient isolation of user-supplied code in Progress MarkLogic Server 14.10.2026 9.6
CVE-2026-109391 Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API 13.10.2026 9.2
CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout 15.10.2026 9.1
CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates 18.10.2026 9.2
CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields 16.10.2026 9.3
CVE-2026-109390 13.10.2026 9.8
CVE-2026-108895 Linksys E1700 setDMZ os command injection 13.10.2026 9.4
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection 15.10.2026 9.4
CVE-2026-108894 Linksys E1700 Static Route addStaticRoute os command injection 14.10.2026 9.4
CVE-2026-108892 Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow 15.10.2026 10
CVE-2026-108893 Linksys E1700 setVlan stack-based overflow 13.10.2026 9.4
CVE-2026-78357 Insufficient Session Revocation for JWT Authentication 15.10.2026 9.1
CVE-2026-93582 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication 15.10.2026 9.4
CVE-2026-108804 TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection 15.10.2026 10

Latest Updates

CVE Title Updated Score
CVE-2026-98806 octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled 18.10.2026
CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events 18.10.2026
CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats() 18.10.2026
CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 18.10.2026
CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() 18.10.2026
CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path 18.10.2026
CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised 18.10.2026
CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record 18.10.2026
CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads 18.10.2026
CVE-2026-98815 nvme: fix cdev lifetime 18.10.2026
CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding 18.10.2026
CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe 18.10.2026
CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() 18.10.2026
CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths 18.10.2026
CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known 18.10.2026
CVE-2026-98821 block: reject polled dio with user integrity metadata 18.10.2026
CVE-2026-98822 wifi: mac80211: prevent AP VLAN tx from other interfaces 18.10.2026
CVE-2026-98823 wifi: cfg80211: preserve hidden-group beacon IE ownership 18.10.2026
CVE-2026-98824 wifi: mac80211: validate TX status rate metadata 18.10.2026
CVE-2026-98825 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() 18.10.2026
CVE-2026-98826 rtc: ac100: Fix clock provider use-after-free on probe failure 18.10.2026
CVE-2026-98827 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE 18.10.2026
CVE-2026-98828 wifi: ath9k: reject short WMI command responses 18.10.2026
CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow 18.10.2026
CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller 18.10.2026
CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails 18.10.2026
CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest() 18.10.2026
CVE-2026-98833 mtd: core: call _get_device() with the master MTD 18.10.2026
CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device 18.10.2026
CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check 18.10.2026
CVE-2026-98836 ALSA: line6: reject oversized playback packets 18.10.2026
CVE-2026-98837 ALSA: caiaq: unregister the input device when probe fails 18.10.2026
CVE-2026-98838 vt: skip screen update for DEC alignment test on backgroup consoles 18.10.2026
CVE-2026-98839 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() 18.10.2026
CVE-2026-98840 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 18.10.2026
CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers 18.10.2026
CVE-2026-98842 module: fix lost error code from codetag_load_module() 18.10.2026
CVE-2026-98843 netfs: zero gaps in read-gaps folio to avoid writing back stale data 18.10.2026
CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write 18.10.2026
CVE-2026-98845 tpm: Disable TPM on null key name mismatch 18.10.2026
CVE-2026-98846 sctp: check RCV_SHUTDOWN after the sendmsg connect wait 18.10.2026
CVE-2026-98847 rtc: spear: initialize IRQ state before requesting alarm IRQ 18.10.2026
CVE-2026-98848 rtc: ac100: Assign .num before accessing .hws 18.10.2026
CVE-2026-98849 pfcp: fix socket lifetime on netdevice registration failure 18.10.2026
CVE-2026-98850 net/packet: prevent TX_RING byte count overflow 18.10.2026
CVE-2026-98851 netfilter: nft_flow_offload: drop flowtable reference on init error path 18.10.2026
CVE-2026-98852 net: extend IPv6 exthdr detection of tunneled packets 18.10.2026
CVE-2026-98853 net: gso: limit recursive IP-in-IP segmentation 18.10.2026
CVE-2026-98854 of/overlay: only treat a positive changeset id as registered 18.10.2026
CVE-2026-98855 of/overlay: put property on deadprops only after changeset add succeeds 18.10.2026
CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap 18.10.2026
CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth 18.10.2026
CVE-2026-98858 io_uring: fix task_work add use-after-free with SQPOLL 18.10.2026
CVE-2026-98859 HID: multitouch: stop the release timer from being rearmed on remove 18.10.2026
CVE-2026-98860 HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request 18.10.2026
CVE-2026-98861 fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() 18.10.2026
CVE-2026-98862 audit: fix exe mark UAF in kill_rules() 18.10.2026
CVE-2026-98863 KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails 18.10.2026
CVE-2026-98864 sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task 18.10.2026
CVE-2026-98865 sched_ext: Don't run ops.dequeue() with a DSQ lock held 18.10.2026
CVE-2026-98866 sched/cache: Introduce task_struct->sched_cache_grp to fix UAF 18.10.2026
CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory 18.10.2026
CVE-2026-98868 dm-pcache: reject a kset that overruns its segment 18.10.2026
CVE-2026-98655 perf: Require kernel access for text poke events 18.10.2026
CVE-2026-98656 iio: trigger: cancel reenable_work before freeing trigger 18.10.2026
CVE-2026-98657 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 18.10.2026
CVE-2026-98658 iio: proximity: aw96103: validate firmware data length 18.10.2026
CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails 18.10.2026
CVE-2026-98660 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 18.10.2026
CVE-2026-98661 iio: light: rohm-bu27034: Fix infinite delay on error 18.10.2026
CVE-2026-98662 iio: light: gp2ap020a00f: drain irq_work after free_irq 18.10.2026
CVE-2026-98663 iio: imu: adis16480: fix unprotected debugfs reads 18.10.2026
CVE-2026-98664 iio: imu: adis16400: fix unprotected debugfs reads 18.10.2026
CVE-2026-98665 iio: health: max30102: fix NULL dereference in interrupt handler 18.10.2026
CVE-2026-98666 iio: gyro: adis16136: fix unprotected debugfs reads 18.10.2026
CVE-2026-98667 iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data 18.10.2026
CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. 18.10.2026
CVE-2026-98669 iio: buffer: serialize buffer teardown with mode claims 18.10.2026
CVE-2026-98670 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind 18.10.2026
CVE-2026-98671 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 18.10.2026
CVE-2026-98672 iio: adc: stm32-adc: fix possible division by zero in processed channel 18.10.2026
CVE-2026-98673 iio: adc: pac1934: check ACPI label duplication 18.10.2026
CVE-2026-98674 iio: adc: adi-axi-adc: Initialize state mutex 18.10.2026
CVE-2026-98675 iio: adc: ade9000: handle Phase C dip events in IRQ1 handler 18.10.2026
CVE-2026-98676 iio: adc: ade9000: fix NULL pointer dereference in clkout registration 18.10.2026
CVE-2026-98677 iio: adc: ad_sigma_delta: fix use-after-free on unbind 18.10.2026
CVE-2026-98678 iio: adc: ad4030: fix invalid oversampling_ratio validation 18.10.2026
CVE-2026-98679 iio: accel: kxcjk-1013: reject duplicate event disable 18.10.2026
CVE-2026-98680 iio: accel: kionix-kx022a: Prevent memory leak and fix state 18.10.2026
CVE-2026-98681 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races 18.10.2026
CVE-2026-98682 smb: client: drain and invalidate before server-side copy/clone 18.10.2026
CVE-2026-98683 smb: client: flush dirty data before zeroing a range 18.10.2026
CVE-2026-98684 smb: client: flush and commit data before querying allocated ranges 18.10.2026
CVE-2026-98685 smb: client: discard post-EOF pagecache when extending a file via clone range 18.10.2026
CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range 18.10.2026
CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses 18.10.2026
CVE-2026-98688 thunderbolt: Fix NULL dereference in tb_remove_work() 18.10.2026
CVE-2026-98689 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled 18.10.2026
CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled 18.10.2026
CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped 18.10.2026
CVE-2026-98692 thunderbolt: Make the DP tunnel activation callback mandatory 18.10.2026
CVE-2026-98693 thunderbolt: Hold a router reference for each allocated HopID 18.10.2026
CVE-2026-98694 thunderbolt: Fix KASAN reported use-after-free when request is canceled 18.10.2026
CVE-2026-98695 USB: serial: fix ioctl hangup race 18.10.2026
CVE-2026-98696 USB: serial: fix driver deregistration order 18.10.2026
CVE-2026-98697 USB: serial: fix dynamic id driver deregistration race 18.10.2026
CVE-2026-98698 wifi: mac80211: handle empty FILS association request payload 18.10.2026
CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF 18.10.2026
CVE-2026-98700 wifi: mac80211: set info->band for 802.3 encap offload frames 18.10.2026
CVE-2026-98701 wifi: mac80211: release mesh path quota on failed additions 18.10.2026
CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth 18.10.2026
CVE-2026-98703 wifi: mac80211: minstrel_ht: validate fixed rate index 18.10.2026
CVE-2026-98704 wifi: mac80211: keep fallback association elements alive 18.10.2026
CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit 18.10.2026
CVE-2026-98706 wifi: mac80211: drain PS delivery work during station teardown 18.10.2026
CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown 18.10.2026
CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive 18.10.2026
CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch 18.10.2026
CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove 18.10.2026
CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device 18.10.2026
CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq 18.10.2026
CVE-2026-98713 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT 18.10.2026
CVE-2026-98714 KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded 18.10.2026
CVE-2026-98715 KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN 18.10.2026
CVE-2026-98716 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted 18.10.2026
CVE-2026-98717 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 18.10.2026
CVE-2026-98718 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state 18.10.2026
CVE-2026-98719 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it 18.10.2026
CVE-2026-98720 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified 18.10.2026
CVE-2026-98721 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ 18.10.2026
CVE-2026-98722 mtd: block2mtd: Fix divide error when erase_size is zero 18.10.2026
CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs 18.10.2026
CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments 18.10.2026
CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() 18.10.2026
CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks 18.10.2026
CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known 18.10.2026
CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random() 18.10.2026
CVE-2026-98729 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h 18.10.2026
CVE-2026-98730 Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() 18.10.2026
CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() 18.10.2026
CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 18.10.2026
CVE-2026-98733 Bluetooth: hci_core: Serialize fragmented ISO packet queueing 18.10.2026
CVE-2026-98734 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 18.10.2026
CVE-2026-98735 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion 18.10.2026
CVE-2026-98736 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup 18.10.2026
CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free 18.10.2026
CVE-2026-98738 Bluetooth: Serialize SMP remote OOB data access 18.10.2026
CVE-2026-98739 Bluetooth: RFCOMM: Fix initial port reference race 18.10.2026
CVE-2026-98740 EDAC/altera: Drop __init from ECC setup paths for re-probe safety 18.10.2026
CVE-2026-98741 ALSA: ua101: reject mismatched capture/playback packet sizes 18.10.2026
CVE-2026-98742 ALSA: seq: Serialize compat port-info ioctls 18.10.2026
CVE-2026-98743 ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type 18.10.2026
CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type 18.10.2026
CVE-2026-98745 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 18.10.2026
CVE-2026-98746 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 18.10.2026
CVE-2026-98747 serial: core: fix NULL pointer dereference in serial_core_unregister_port() 18.10.2026
CVE-2026-98748 serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 18.10.2026
CVE-2026-98749 tty: serial: max3100: shut down timer before freeing port 18.10.2026
CVE-2026-98750 tty: fix saved termios reset race 18.10.2026
CVE-2026-98751 tty: abort break signalling on hangup 18.10.2026
CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race 18.10.2026
CVE-2026-98753 tty: tty_port: restore TTY_IO_ERROR on activation failure 18.10.2026
CVE-2026-98754 tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 18.10.2026
CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl() 18.10.2026
CVE-2026-98756 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe 18.10.2026
CVE-2026-98757 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 18.10.2026
CVE-2026-98758 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove 18.10.2026
CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() 18.10.2026
CVE-2026-98760 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() 18.10.2026
CVE-2026-98761 usb: typec: tcpm: recover after failure to start the frs ams 18.10.2026
CVE-2026-98762 USB: dwc2: shut down wakeup timer before freeing HCD state 18.10.2026
CVE-2026-98763 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints 18.10.2026
CVE-2026-98764 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 18.10.2026
CVE-2026-98765 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 18.10.2026
CVE-2026-98766 usb: gadget: aspeed-vhub: cancel wake work on device removal 18.10.2026
CVE-2026-98767 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count 18.10.2026
CVE-2026-98768 usb: typec: anx7411 - stop the IRQ before destroying the workqueue 18.10.2026
CVE-2026-98769 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 18.10.2026
CVE-2026-98770 usb: gadget: midi2: Fix the jack descriptor array sizes 18.10.2026
CVE-2026-98771 usb: storage: sierra_ms: reject short SWoC info transfers 18.10.2026
CVE-2026-98772 USB: serial: fix port tear down use-after-free 18.10.2026
CVE-2026-98773 USB: cdc-acm: skip URB restart in port_shutdown if disconnected 18.10.2026
CVE-2026-98774 rust_binder: cancel deferred work items in thread exit 18.10.2026
CVE-2026-98775 nitro_enclaves: fix use-after-free on SLOT_ALLOC failure 18.10.2026
CVE-2026-98776 binderfs: fix UAF write in binder_add_device 18.10.2026
CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede 18.10.2026
CVE-2026-98778 binder: fix is_failure flag for superseded transaction cleanup 18.10.2026
CVE-2026-98779 drm/amdgpu: fix ACP MFD device leak on init failure 18.10.2026
CVE-2026-98780 drm/amdgpu: fix IP instance memory leak on kobject add failure 18.10.2026
CVE-2026-98781 drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 18.10.2026
CVE-2026-98782 drm/mediatek: Fix ovl adaptor platform device leak 18.10.2026
CVE-2026-98783 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device 18.10.2026
CVE-2026-98784 drm/amdgpu/gfx6: fix firmware leak on teardown 18.10.2026
CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend 18.10.2026
CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation 18.10.2026
CVE-2026-98787 bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() 18.10.2026
CVE-2026-98788 futex: Fix private hash use-after-free on resize 18.10.2026
CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace 18.10.2026
CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task() 18.10.2026
CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference 18.10.2026
CVE-2026-98792 netfilter: flowtable: generalize pending status bit 18.10.2026
CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types 18.10.2026
CVE-2026-98794 ipvs: filter some flags received in the backup server 18.10.2026
CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped 18.10.2026
CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 18.10.2026
CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked 18.10.2026
CVE-2026-98798 net: bcmgenet: fix NULL dereference in set_coalesce before first open 18.10.2026
CVE-2026-98799 bpf: Skip detached progs in trampoline images that are still in use 18.10.2026
CVE-2026-98800 bpf: Wait for an RCU tasks grace period before freeing trampoline progs 18.10.2026
CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value 18.10.2026
CVE-2026-98802 seg6: ensure packet data is writable before modifying SRH and IPv6 DA 18.10.2026
CVE-2026-98803 net: stmmac: fix rx Scatter-Gather support 18.10.2026
CVE-2026-98804 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() 18.10.2026
CVE-2026-98805 tipc: prevent GCM nonce reuse on peer key changes 18.10.2026
CVE-2026-98520 drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping 18.10.2026
CVE-2026-98521 drm/i915: fix incorrect RCU teardown order 18.10.2026
CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() 18.10.2026
CVE-2026-98523 drm/client: fix restore of partially initialized client 18.10.2026
CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails 18.10.2026
CVE-2026-98525 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() 18.10.2026
CVE-2026-98526 llc: reserve device headroom for allocated frames 18.10.2026
CVE-2026-98527 gpio: zynq: fix runtime PM leak on request error path 18.10.2026
CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path 18.10.2026
CVE-2026-98529 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() 18.10.2026
CVE-2026-98530 kprobes: Fix permanent hang when flushing the kprobe optimizer 18.10.2026
CVE-2026-98531 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST 18.10.2026
CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end 18.10.2026
CVE-2026-98533 ipe: protect the dm-verity root hash with RCU 18.10.2026
CVE-2026-98534 ipe: fix use-after-free when auditing a newly loaded policy 18.10.2026
CVE-2026-98535 fsl/fman: Fix clk reference leak in read_dts_node() 18.10.2026
CVE-2026-98536 writeback: report a Tasks-RCU quiescent state per cgwb drain pass 18.10.2026
CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check 18.10.2026
CVE-2026-98538 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes 18.10.2026
CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga 18.10.2026
CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled 18.10.2026
CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT 18.10.2026
CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict 18.10.2026
CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir 18.10.2026
CVE-2026-98544 bna: prevent IOC timer rearm during teardown 18.10.2026
CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes 18.10.2026
CVE-2026-98546 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 18.10.2026
CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo() 18.10.2026
CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error 18.10.2026
CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue 18.10.2026
CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow 18.10.2026
CVE-2026-98551 perf/core: Fill branch entries with a single assignment 18.10.2026
CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data() 18.10.2026
CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb() 18.10.2026
CVE-2026-98554 vlan: ensure sufficient headroom in vlan_dev_hard_header() 18.10.2026
CVE-2026-98555 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure 18.10.2026
CVE-2026-98556 gve: DQO: reject TSO packets with an out of range MSS 18.10.2026
CVE-2026-98557 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO 18.10.2026
CVE-2026-98558 net: flush skb_defer_nodes in dev_cpu_dead() 18.10.2026
CVE-2026-98559 net/smc: fix UAF on lgr list traversal in smcr_port_err() 18.10.2026
CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with 18.10.2026
CVE-2026-98561 nfp: hold IPsec RX state under the XArray lock 18.10.2026
CVE-2026-98562 net: libwx: fix races in Tx timestamp handling 18.10.2026
CVE-2026-98563 net: phylink: record the PHY only once bringup cannot fail 18.10.2026
CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq 18.10.2026
CVE-2026-98565 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 18.10.2026
CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests 18.10.2026
CVE-2026-98567 net: xps: reject an out of range traffic class 18.10.2026
CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies 18.10.2026
CVE-2026-98569 ip_gre: Reject enabling collect metadata through changelink 18.10.2026
CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead() 18.10.2026
CVE-2026-98571 net: stmmac: clear stale buf->page after recycling on skb build failure 18.10.2026
CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32 18.10.2026
CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() 18.10.2026
CVE-2026-98574 net: bcmgenet: stop Tx NAPI before disabling the queues 18.10.2026
CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() 18.10.2026
CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names 18.10.2026
CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() 18.10.2026
CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length 18.10.2026
CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure 18.10.2026
CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle 18.10.2026
CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() 18.10.2026
CVE-2026-98582 nfc: st21nfca: validate received frame size 18.10.2026
CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull 18.10.2026
CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump() 18.10.2026
CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes 18.10.2026
CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers 18.10.2026
CVE-2026-98587 firewire: cdev: fix back-transition for iso_resource_auto client resource 18.10.2026
CVE-2026-98588 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc 18.10.2026
CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs 18.10.2026
CVE-2026-98590 bpf: Fix bpf_sock context code generation 18.10.2026
CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs 18.10.2026
CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure 18.10.2026
CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy() 18.10.2026
CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure 18.10.2026
CVE-2026-98595 udp: remove a disconnected socket from the 4-tuple hash table 18.10.2026
CVE-2026-98596 ipv6: Fix dst leak for uncached routes. 18.10.2026
CVE-2026-98597 net: usb: sr9700: include receive overhead in the length check 18.10.2026
CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info. 18.10.2026
CVE-2026-98599 bpf: Reject non-negative offsets in stack_slot_obj_get_spi() 18.10.2026
CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 18.10.2026
CVE-2026-98601 Bluetooth: btintel_pcie: validate device-supplied DMA indices 18.10.2026
CVE-2026-98602 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough 18.10.2026
CVE-2026-98603 ovpn: replace bind when clearing stale local source 18.10.2026
CVE-2026-98604 ovpn: replace bind when learning local endpoint 18.10.2026
CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach 18.10.2026
CVE-2026-98606 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors 18.10.2026
CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() 18.10.2026
CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() 18.10.2026
CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails 18.10.2026
CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget 18.10.2026
CVE-2026-98611 bpf: Check params size before reading reserved fields 18.10.2026
CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done() 18.10.2026
CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots 18.10.2026
CVE-2026-98614 sctp: avoid livelock while updating retransmit path 18.10.2026
CVE-2026-98615 eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox 18.10.2026
CVE-2026-98616 eth: fbnic: reset num_napi when the napi vectors are freed 18.10.2026
CVE-2026-98617 eth: fbnic: use the Rx queue napi pointer to find the napi vector 18.10.2026
CVE-2026-98618 eth: fbnic: Handle maximum standalone channels 18.10.2026
CVE-2026-98619 net: ethtool: keep rtnl_lock for the ioctl self test 18.10.2026
CVE-2026-98620 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure 18.10.2026
CVE-2026-98621 net: gue: reject invalid REMCSUM offsets 18.10.2026
CVE-2026-98622 net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure 18.10.2026
CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update 18.10.2026
CVE-2026-98624 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier 18.10.2026
CVE-2026-98625 netfilter: flowtable: publish HW_DEAD after worker is done 18.10.2026
CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions 18.10.2026
CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe() 18.10.2026
CVE-2026-98628 bpf: Make post-verification instruction rewrites killable 18.10.2026
CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing 18.10.2026
CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup 18.10.2026
CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup 18.10.2026
CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel 18.10.2026
CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() 18.10.2026
CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones 18.10.2026
CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report 18.10.2026
CVE-2026-98636 squashfs: Add dictionary size range check to prevent shift-out-of-bounds 18.10.2026
CVE-2026-98637 KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure 18.10.2026
CVE-2026-98638 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() 18.10.2026
CVE-2026-98639 KVM: riscv: Fix NACL hfence entry update order 18.10.2026
CVE-2026-98640 HID: amd_sfh: Validate PCI BAR size before mapping 18.10.2026
CVE-2026-98641 bpf, arm64: set up the frame pointer for the exception callback 18.10.2026
CVE-2026-98642 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk 18.10.2026
CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops 18.10.2026
CVE-2026-98644 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() 18.10.2026
CVE-2026-98645 HID: winwing: fix use-after-free in force feedback teardown 18.10.2026
CVE-2026-98646 tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context 18.10.2026
CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk() 18.10.2026
CVE-2026-98648 s390/uv: Prevent potential out-of-bounds read 18.10.2026
CVE-2026-98649 KVM: s390: Fix race in _destroy_pages_crste() 18.10.2026
CVE-2026-98650 KVM: s390: Fix potential races in dat skey functions 18.10.2026
CVE-2026-98651 KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() 18.10.2026
CVE-2026-98652 KVM: s390: Add missing srcu in kvm_s390_set_irq_state() 18.10.2026
CVE-2026-98653 KVM: s390: Fix _gaccess_shadow_fault() 18.10.2026
CVE-2026-98654 drm/amd/display: Atomize IRQ register read/modify/write ops 18.10.2026
CVE-2026-98440 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction 18.10.2026
CVE-2026-98441 net/sched: act_ct: avoid modifying shared unconfirmed ct entry 18.10.2026
CVE-2026-98442 net/sched: act_ct: fix helper UAF due to extensions realloc 18.10.2026
CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets 18.10.2026
CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush 18.10.2026
CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs 18.10.2026
CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init 18.10.2026
CVE-2026-98447 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots 18.10.2026
CVE-2026-98448 xfs: release orphanage dir inode if chown fails 18.10.2026
CVE-2026-98449 smb: client: delete compound mids on send failure before unlock 18.10.2026
CVE-2026-98450 smb: client: close completed creates on compound wait errors 18.10.2026
CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes 18.10.2026
CVE-2026-98452 smb: client: clean up failed cached directory opens 18.10.2026
CVE-2026-98453 smb: client: close handle after create-context parsing failure 18.10.2026
CVE-2026-98454 smb: client: fix create context out-of-bounds reads 18.10.2026
CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO 18.10.2026
CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list() 18.10.2026
CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access 18.10.2026
CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach 18.10.2026
CVE-2026-98459 Bluetooth: ISO: balance the parent hold in hci_bind_bis() 18.10.2026
CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values 18.10.2026
CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering 18.10.2026
CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse 18.10.2026
CVE-2026-98463 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags 18.10.2026
CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown 18.10.2026
CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration 18.10.2026
CVE-2026-98466 KVM: arm64: Transfer the hyp stack pages out of the host stage-2 18.10.2026
CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race 18.10.2026
CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race 18.10.2026
CVE-2026-98469 KVM: arm64: Fix AArch32 DBGBXVR<n> handling 18.10.2026
CVE-2026-98470 KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode 18.10.2026
CVE-2026-98471 KVM: SEV: Do cache maintenance on the source VM during intra-host migration 18.10.2026
CVE-2026-98472 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV 18.10.2026
CVE-2026-98473 s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config 18.10.2026
CVE-2026-98474 s390/pci: Fix missing device lock in zpci_report_status() 18.10.2026
CVE-2026-98475 s390/cmf: Fix virtual vs physical address confusion 18.10.2026
CVE-2026-98476 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() 18.10.2026
CVE-2026-98477 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() 18.10.2026
CVE-2026-98478 scsi: ufs: core: Keep internal commands dispatchable during error handling 18.10.2026
CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU 18.10.2026
CVE-2026-98480 nfc: trf7970a: power down on startup RX gain failure 18.10.2026
CVE-2026-98481 nfc: port100: reject frames whose declared length exceeds the received data 18.10.2026
CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() 18.10.2026
CVE-2026-98483 nfc: fix use-after-free in nfc_get_local_general_bytes 18.10.2026
CVE-2026-98484 netfilter: nf_tables: skip expired catchall elements on insert and delete 18.10.2026
CVE-2026-98485 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read 18.10.2026
CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure 18.10.2026
CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion 18.10.2026
CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read 18.10.2026
CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read 18.10.2026
CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc 18.10.2026
CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry 18.10.2026
CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths 18.10.2026
CVE-2026-98493 net: ipconfig: bound DHCP option construction 18.10.2026
CVE-2026-98494 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read 18.10.2026
CVE-2026-98495 net: arp: terminate device name before lookup 18.10.2026
CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ 18.10.2026
CVE-2026-98497 net/mlx5e: fix swapped IPv6 IPsec policy masks 18.10.2026
CVE-2026-98498 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() 18.10.2026
CVE-2026-98499 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() 18.10.2026
CVE-2026-98500 HID: hid-oxp: use cancel_delayed_work_sync() in remove 18.10.2026
CVE-2026-98501 HID: alps: fix use-after-free on input2 registration failure 18.10.2026
CVE-2026-98502 HID: alps: unregister DualPoint Stick input device on remove 18.10.2026
CVE-2026-98503 packet: use ubuf_info completion for TX_RING packets 18.10.2026
CVE-2026-98504 PCI: of_property: Omit bus properties without a subordinate bus 18.10.2026
CVE-2026-98505 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() 18.10.2026
CVE-2026-98506 mm/hugetlb: do not dissolve gigantic pages without runtime support 18.10.2026
CVE-2026-98507 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish 18.10.2026
CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure 18.10.2026
CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure 18.10.2026
CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs 18.10.2026
CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() 18.10.2026
CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched 18.10.2026
CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() 18.10.2026
CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init() 18.10.2026
CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor 18.10.2026
CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new() 18.10.2026
CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM 18.10.2026
CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range 18.10.2026
CVE-2026-98519 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() 18.10.2026
CVE-2026-111991 WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection 18.10.2026
CVE-2026-111990 kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection 18.10.2026
CVE-2026-98435 EDAC/altera: Use parent device for devres in altr_portb_setup() 18.10.2026
CVE-2026-98436 accel/amdxdna: Disable device buffer exporting 18.10.2026
CVE-2026-98437 media: qcom: iris: fix runtime PM reference leaks 18.10.2026
CVE-2026-98438 mptcp: options: fix uninit-value in mptcp_write_data_fin 18.10.2026
CVE-2026-98439 smb/server: cancel async requests when closing connection 18.10.2026
CVE-2026-98433 KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure 18.10.2026
CVE-2026-98434 sysctl: Check range in proc_dointvec_ms_jiffies_minmax 18.10.2026
CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults 18.10.2026 6.8
CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery 18.10.2026
CVE-2026-111987 AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting 18.10.2026
CVE-2026-111986 AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection 18.10.2026
CVE-2026-112046 OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve() 18.10.2026
CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions 18.10.2026
CVE-2026-112048 libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count 18.10.2026
CVE-2026-112049 Vita3K before build 4187 Path Traversal via VPK Package Installation 18.10.2026
CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation 18.10.2026
CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration 18.10.2026
CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing 18.10.2026
CVE-2026-112053 Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix 18.10.2026
CVE-2026-112054 Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing 18.10.2026
CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP 18.10.2026
CVE-2026-112056 wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH 18.10.2026
CVE-2026-112057 libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters 18.10.2026
CVE-2026-112058 libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT 18.10.2026
CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR 18.10.2026
CVE-2026-112060 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode 18.10.2026
CVE-2026-112061 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode 18.10.2026
CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler 18.10.2026
CVE-2026-112063 libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi 18.10.2026
CVE-2026-111985 AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources 18.10.2026
CVE-2026-111984 AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting 18.10.2026
CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway 18.10.2026
CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver 18.10.2026
CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs 18.10.2026
CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities 18.10.2026
CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password 18.10.2026
CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete 18.10.2026
CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint 18.10.2026
CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor 18.10.2026
CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation 18.10.2026
CVE-2026-112007 Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader 18.10.2026
CVE-2026-112008 libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr 18.10.2026
CVE-2026-112009 smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer 18.10.2026
CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp 18.10.2026
CVE-2026-112011 libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table 18.10.2026
CVE-2026-112012 libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count 18.10.2026
CVE-2026-112013 libtta through 2.3 Divide by Zero via tta_decoder_init_get_info 18.10.2026
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export 18.10.2026
CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd 18.10.2026
CVE-2026-112016 Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files 18.10.2026
CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass 18.10.2026
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats() 18.10.2026
CVE-2026-112019 cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats() 18.10.2026
CVE-2026-112020 LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced() 18.10.2026
CVE-2026-112021 snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer() 18.10.2026
CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval 18.10.2026
CVE-2026-107436 WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability 18.10.2026 8.8
CVE-2026-108485 WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability 18.10.2026 7.1
CVE-2026-109894 WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability 18.10.2026 9.3
CVE-2026-109895 WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability 18.10.2026 7.1
CVE-2026-110365 WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability 18.10.2026 6.5
CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 18.10.2026 9.8
CVE-2026-110373 WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability 18.10.2026 8.1
CVE-2026-110382 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability 18.10.2026 7.1
CVE-2026-110383 WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability 18.10.2026 7.5
CVE-2026-110880 WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability 18.10.2026 6.5
CVE-2026-110883 WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability 18.10.2026 6.5
CVE-2026-110885 WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability 18.10.2026 6.5
CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability 18.10.2026 9.8
CVE-2026-110895 WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability 18.10.2026 8.5
CVE-2026-110897 WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability 18.10.2026 7.1
CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block 18.10.2026
CVE-2026-110026 Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion 18.10.2026
CVE-2026-110031 Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key 18.10.2026
CVE-2026-110032 Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor 18.10.2026
CVE-2026-110033 Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' 18.10.2026
CVE-2026-110035 Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route 18.10.2026
CVE-2026-110069 Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions 18.10.2026
CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR 18.10.2026
CVE-2026-110976 AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media 18.10.2026
CVE-2026-110981 WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter 18.10.2026
CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media 18.10.2026
CVE-2026-111877 dext34-morgan Books4Cash search.php cross site scripting 18.10.2026
CVE-2026-111942 hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting 18.10.2026
CVE-2026-87844 Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection 18.10.2026
CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export 18.10.2026
CVE-2026-111876 alexpasmantier television entry.rs output command injection 18.10.2026
CVE-2026-111875 David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization 18.10.2026
CVE-2026-111874 OpenCATS Career Portal CareersUI.php processLogin excessive authentication 18.10.2026
CVE-2026-111873 itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection 18.10.2026
CVE-2026-111872 itsmeravitejak Online-Examination-System database.php getreport sql injection 18.10.2026
CVE-2026-111871 itsmeravitejak Online-Examination-System subjectsdb.php sql injection 18.10.2026
CVE-2026-111870 itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication 18.10.2026
CVE-2026-111869 makeplane API Endpoint reliance on untrusted inputs in a security decision 18.10.2026
CVE-2026-111868 datastax pulsar-jms PulsarObjectMessage.java decode deserialization 18.10.2026
CVE-2026-111997 18.10.2026
CVE-2026-111866 nemoTyrant manong func.php arr2sql sql injection 17.10.2026
CVE-2026-105391 17.10.2026
CVE-2026-107274 17.10.2026
CVE-2026-107345 17.10.2026
CVE-2026-107772 17.10.2026
CVE-2026-108117 17.10.2026