| CVE-2026-120198 |
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection |
01.11.2026 |
10 |
| CVE-2026-120197 |
WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection |
01.11.2026 |
9.4 |
| CVE-2026-120196 |
WAVLINK WN579X3-D wapi.cgi port_forward os command injection |
01.11.2026 |
9.4 |
| CVE-2026-120195 |
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection |
01.11.2026 |
10 |
| CVE-2026-120189 |
D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow |
01.11.2026 |
10 |
| CVE-2026-118636 |
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder |
31.10.2026 |
9.8 |
| CVE-2026-120201 |
Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header |
31.10.2026 |
9.3 |
| CVE-2026-120209 |
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token |
31.10.2026 |
9.3 |
| CVE-2026-103882 |
Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter |
31.10.2026 |
9.1 |
| CVE-2026-118235 |
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data |
31.10.2026 |
9.8 |
| CVE-2026-116512 |
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection |
31.10.2026 |
9.8 |
| CVE-2026-119096 |
Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter |
31.10.2026 |
9.8 |
| CVE-2026-109220 |
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field |
31.10.2026 |
9.8 |
| CVE-2026-116557 |
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action |
31.10.2026 |
9.1 |
| CVE-2026-89270 |
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters |
31.10.2026 |
9.1 |
| CVE-2026-117656 |
Unverified Sign in with Apple callback parameter can override verified ID token claims |
30.10.2026 |
9.3 |
| CVE-2026-63377 |
TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover |
30.10.2026 |
9.8 |
| CVE-2026-62863 |
MoLing: unauthenticated SSE and wildcard CORS expose tool sessions |
30.10.2026 |
9.6 |
| CVE-2026-62849 |
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection |
30.10.2026 |
9.1 |
| CVE-2026-62853 |
ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks |
30.10.2026 |
9.9 |
| CVE-2026-117666 |
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary |
30.10.2026 |
9.1 |
| CVE-2026-116238 |
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks |
30.10.2026 |
9.2 |
| CVE-2026-116241 |
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier |
30.10.2026 |
9.4 |
| CVE-2026-61620 |
HoneySQL unchecked entity names can lead to SQL injection results |
30.10.2026 |
9.8 |
| CVE-2026-55598 |
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation) |
30.10.2026 |
9.1 |
| CVE-2026-61850 |
Kargo: Privilege escalation via Project RBAC management in the Kargo API |
30.10.2026 |
9.3 |
| CVE-2026-78403 |
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server |
30.10.2026 |
9.3 |
| CVE-2026-116386 |
WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-116852 |
WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability |
30.10.2026 |
9.1 |
| CVE-2026-119526 |
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-39732 |
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability |
30.10.2026 |
9.3 |
| CVE-2026-39738 |
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-90888 |
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-118697 |
|
31.10.2026 |
9 |
| CVE-2026-119978 |
Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore |
30.10.2026 |
9 |
| CVE-2026-61826 |
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery |
30.10.2026 |
10 |
| CVE-2026-112816 |
Improper certificate validation in the HTTPS listener in LXD |
31.10.2026 |
10 |
| CVE-2026-119706 |
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization |
30.10.2026 |
9.3 |
| CVE-2026-119716 |
pybars3 through 0.9.7 Code Injection via Bracketed Path Segments |
30.10.2026 |
9.2 |
| CVE-2026-119717 |
pybars4 through 0.9.13 Code Injection via Bracketed Path Segments |
30.10.2026 |
9.2 |
| CVE-2026-93327 |
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution |
30.10.2026 |
9.4 |
| CVE-2026-61737 |
ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin |
30.10.2026 |
9.8 |
| CVE-2026-61738 |
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) |
30.10.2026 |
10 |
| CVE-2026-61729 |
SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection |
30.10.2026 |
9.4 |
| CVE-2026-61730 |
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount |
30.10.2026 |
9.3 |
| CVE-2026-110799 |
Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover |
30.10.2026 |
9.8 |
| CVE-2026-112905 |
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft |
30.10.2026 |
9 |
| CVE-2026-119660 |
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key |
30.10.2026 |
9.3 |
| CVE-2026-61728 |
SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover |
30.10.2026 |
9.9 |
| CVE-2026-119597 |
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery |
30.10.2026 |
9.3 |
| CVE-2026-119418 |
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() |
30.10.2026 |
9.2 |
| CVE-2026-119419 |
CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation |
30.10.2026 |
9.2 |
| CVE-2026-119568 |
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking |
30.10.2026 |
9.1 |
| CVE-2026-116366 |
Unauthenticated RCE vulnerability against ClickHouse Server |
30.10.2026 |
9.5 |
| CVE-2025-31704 |
Dahua Intelligent Connection Center command injection |
30.10.2026 |
9.8 |
| CVE-2026-82104 |
API permission bypass via logic bug |
30.10.2026 |
9.4 |
| CVE-2026-103039 |
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field |
30.10.2026 |
9.8 |
| CVE-2023-22793 |
|
30.10.2026 |
9.3 |
| CVE-2026-61707 |
SOCFortress CoPilot: Stored case-report template injection permits backend code execution |
30.10.2026 |
9 |
| CVE-2026-61645 |
Docat has Arbitrary File Upload exists in Upload API |
30.10.2026 |
9.1 |
| CVE-2026-103093 |
Sandbox Escape via Table Rotation in ServiceNow AI Platform |
29.10.2026 |
9.4 |
| CVE-2026-118769 |
Botan: Integer overflow when reporting block size in FFI can cause memory corruption |
29.10.2026 |
9.2 |
| CVE-2026-118762 |
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN |
29.10.2026 |
9.3 |
| CVE-2026-119128 |
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie |
29.10.2026 |
9.1 |
| CVE-2026-119145 |
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload |
29.10.2026 |
9.4 |
| CVE-2026-90865 |
Command Injection via FTP Notification Variables in Progress WS_FTP Server |
30.10.2026 |
9 |
| CVE-2026-90866 |
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server |
30.10.2026 |
9.1 |
| CVE-2026-90868 |
OS Command Injection in Progress WS_FTP Server |
30.10.2026 |
9.9 |
| CVE-2026-84295 |
Improper Authentication in Progress WS_FTP Server |
30.10.2026 |
10 |
| CVE-2026-90863 |
Privilege Escalation via Missing Authorization in WS_FTP Manager |
30.10.2026 |
9.1 |
| CVE-2026-90864 |
Host Administrator Path Containment Bypass in Progress WS_FTP Server |
30.10.2026 |
9.1 |
| CVE-2026-111732 |
Out-of-bounds write when parsing AR Vendor Block requests |
29.10.2026 |
9.3 |
| CVE-2026-112256 |
Logon bypass (trust of attacker-controlled completed-methods list) |
29.10.2026 |
9.2 |
| CVE-2026-104339 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.8 |
| CVE-2026-107327 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.9 |
| CVE-2026-107328 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.9 |
| CVE-2026-107329 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.9 |
| CVE-2026-54856 |
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-54857 |
WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-54858 |
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-54859 |
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-54860 |
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-61991 |
WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability |
30.10.2026 |
10 |
| CVE-2026-61992 |
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-61997 |
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-61998 |
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62001 |
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62002 |
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62003 |
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62004 |
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62005 |
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62006 |
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62008 |
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62009 |
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62010 |
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62011 |
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62012 |
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62013 |
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62014 |
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62015 |
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62016 |
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-62017 |
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62018 |
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability |
29.10.2026 |
9.8 |
| CVE-2026-62131 |
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability |
30.10.2026 |
9.8 |
| CVE-2026-93680 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.8 |
| CVE-2026-110186 |
Langflow OSS is affected by multiple vulnerabilities |
30.10.2026 |
9.8 |
| CVE-2026-119050 |
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection |
29.10.2026 |
9.2 |
| CVE-2026-97854 |
|
29.10.2026 |
9.3 |
| CVE-2026-115964 |
WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability |
29.10.2026 |
9.3 |
| CVE-2026-114358 |
SQL Injection Vulnerability in Radius Xenia M2M Platform |
29.10.2026 |
9.3 |
| CVE-2026-109516 |
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token |
29.10.2026 |
9.8 |
| CVE-2026-42922 |
|
29.10.2026 |
9.8 |
| CVE-2026-66088 |
Unrestricted Command Execution via system.execute |
29.10.2026 |
9.4 |
| CVE-2026-118579 |
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor |
29.10.2026 |
9.3 |
| CVE-2026-61564 |
AVideo-Encoder: unauthenticated installer PHP code injection |
28.10.2026 |
10 |
| CVE-2026-61567 |
AVideo-Encoder: unauthenticated command execution through streamer login trust |
28.10.2026 |
10 |
| CVE-2026-118690 |
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |
29.10.2026 |
9.3 |
| CVE-2026-117574 |
Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization |
28.10.2026 |
9.1 |
| CVE-2026-63190 |
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS |
29.10.2026 |
9.4 |
| CVE-2026-118264 |
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
30.10.2026 |
9.1 |
| CVE-2026-118633 |
|
28.10.2026 |
9.2 |
| CVE-2026-103406 |
Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. |
28.10.2026 |
9.8 |
| CVE-2026-103409 |
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed |
28.10.2026 |
9.8 |
| CVE-2026-44179 |
XWiki Pro Macros: excerpt-include title and content injection executes code |
28.10.2026 |
9.9 |
| CVE-2026-115968 |
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability |
28.10.2026 |
9.8 |
| CVE-2026-105420 |
Path Traversal in Wing WFTP Server leading to Remote Code Execution |
28.10.2026 |
9.4 |
| CVE-2026-111411 |
WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability |
30.10.2026 |
9.3 |
| CVE-2026-115607 |
WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability |
29.10.2026 |
9.3 |
| CVE-2026-115904 |
Topluyo Desktop for Linux has an OS Command Injection issue |
28.10.2026 |
9.6 |
| CVE-2026-67074 |
HCL BigFix AEX is affected by multiple security vulnerabilities. |
28.10.2026 |
9.1 |
| CVE-2026-114278 |
Unauthenticated Command Injection via kubeconfig Username in che-machine-exec |
28.10.2026 |
9.8 |
| CVE-2026-99153 |
scsi: libiscsi: Validate the ITT reflected in a Reject PDU |
31.10.2026 |
9.8 |
| CVE-2026-99154 |
scsi: libiscsi: Reject a negative task index from parse_pdu_itt |
31.10.2026 |
9.8 |
| CVE-2026-103792 |
|
29.10.2026 |
9.6 |
| CVE-2026-103799 |
|
28.10.2026 |
9.6 |
| CVE-2026-112197 |
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App |
28.10.2026 |
9.4 |
| CVE-2026-103780 |
|
29.10.2026 |
9.8 |
| CVE-2026-86384 |
|
29.10.2026 |
9.8 |
| CVE-2026-14571 |
SQL injection (SQLi) in the user authentication module of Futurum Software |
28.10.2026 |
9.1 |
| CVE-2026-86397 |
|
30.10.2026 |
9.8 |
| CVE-2026-86400 |
|
30.10.2026 |
9.8 |
| CVE-2026-90717 |
|
30.10.2026 |
9.1 |
| CVE-2026-109218 |
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass |
29.10.2026 |
9.8 |
| CVE-2026-104383 |
Code injection in EagleCloud Aquila on-premises version |
28.10.2026 |
9.4 |
| CVE-2026-84999 |
Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler |
29.10.2026 |
9.8 |
| CVE-2026-118375 |
llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |
28.10.2026 |
9.2 |
| CVE-2026-106013 |
Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter |
29.10.2026 |
9.8 |
| CVE-2026-110879 |
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) |
28.10.2026 |
9.8 |
| CVE-2026-58256 |
GRR vulnerable to Remote Code Execution Via PHP Code Injection |
27.10.2026 |
9.1 |
| CVE-2026-116692 |
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules |
27.10.2026 |
9.8 |
| CVE-2026-112352 |
Sunhillo SureLine Authentication Bypass via Session Cookie |
28.10.2026 |
9.1 |
| CVE-2026-104350 |
Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79) |
27.10.2026 |
9.3 |
| CVE-2026-104351 |
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
27.10.2026 |
9.9 |
| CVE-2026-104353 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) |
27.10.2026 |
9.9 |
| CVE-2026-104354 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
28.10.2026 |
9.1 |
| CVE-2026-105489 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
28.10.2026 |
9.9 |
| CVE-2026-105779 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
27.10.2026 |
9.1 |
| CVE-2026-105780 |
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
27.10.2026 |
9.9 |
| CVE-2026-105781 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
27.10.2026 |
10 |
| CVE-2026-108015 |
eMudhra Compromised Certificate vulnerability impacts HCL Notes Client |
27.10.2026 |
9.1 |
| CVE-2026-114595 |
Integer overflow or wraparound in EPICS Base |
27.10.2026 |
9.3 |
| CVE-2026-108014 |
eMudhra Compromised Certificate vulnerability impacts HCL Domino Server |
27.10.2026 |
9.1 |
| CVE-2026-48360 |
Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
29.10.2026 |
9.6 |
| CVE-2026-106076 |
|
27.10.2026 |
9 |
| CVE-2026-108142 |
|
27.10.2026 |
9.1 |
| CVE-2026-103593 |
Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution |
29.10.2026 |
9.1 |
| CVE-2026-103594 |
Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution |
27.10.2026 |
9.5 |
| CVE-2026-112709 |
Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution |
27.10.2026 |
9.2 |
| CVE-2026-112710 |
Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution |
27.10.2026 |
9.2 |
| CVE-2026-116863 |
WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability |
29.10.2026 |
9.6 |
| CVE-2026-93857 |
Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution |
29.10.2026 |
9.2 |
| CVE-2026-93865 |
Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection |
29.10.2026 |
9.2 |
| CVE-2026-93866 |
Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write |
27.10.2026 |
9.2 |
| CVE-2026-117564 |
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret |
28.10.2026 |
9.3 |
| CVE-2026-117601 |
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions |
28.10.2026 |
9.3 |
| CVE-2026-117603 |
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass |
27.10.2026 |
9.3 |
| CVE-2026-65145 |
|
27.10.2026 |
10 |
| CVE-2026-115216 |
Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials |
27.10.2026 |
9.1 |
| CVE-2026-112362 |
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets |
27.10.2026 |
9.1 |
| CVE-2026-117532 |
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin |
27.10.2026 |
9.3 |
| CVE-2026-102788 |
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 |
27.10.2026 |
9.3 |
| CVE-2026-76932 |
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.4 |
| CVE-2026-76933 |
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.4 |
| CVE-2026-76934 |
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.8 |
| CVE-2026-76935 |
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.4 |
| CVE-2026-76936 |
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.4 |
| CVE-2026-76937 |
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.4 |
| CVE-2026-76938 |
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.8 |
| CVE-2026-76939 |
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 |
27.10.2026 |
9.8 |
| CVE-2026-82116 |
Missing Authentication for Critical Function Vulnerability in HiRDB |
27.10.2026 |
9.8 |
| CVE-2026-82117 |
Authentication Bypass by Spoofing Vulnerability in HiRDB |
27.10.2026 |
9.8 |
| CVE-2026-82118 |
Stack-based Buffer Overflow Vulnerability in HiRDB |
27.10.2026 |
9.8 |
| CVE-2026-82119 |
OS Command Injection Vulnerability in HiRDB |
27.10.2026 |
9.8 |
| CVE-2026-82120 |
Heap-based Buffer Overflow Vulnerability in HiRDB |
27.10.2026 |
9.8 |
| CVE-2026-82122 |
Stack-based Buffer Overflow Vulnerability in HiRDB |
27.10.2026 |
9.4 |
| CVE-2026-86574 |
Heap-based Buffer Overflow Vulnerability in JP1/Base |
27.10.2026 |
9.8 |
| CVE-2026-86575 |
Stack-based Buffer Overflow Vulnerability in JP1 Products |
27.10.2026 |
9.4 |
| CVE-2026-86576 |
Heap-based Buffer Overflow Vulnerability in JP1 Products |
27.10.2026 |
9.4 |
| CVE-2026-86577 |
Out-of-bounds Write Vulnerability in JP1 Products |
27.10.2026 |
9.4 |
| CVE-2026-102789 |
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 |
27.10.2026 |
9.3 |
| CVE-2026-92885 |
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login |
27.10.2026 |
9.8 |
| CVE-2026-18450 |
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability |
27.10.2026 |
9.8 |
| CVE-2026-116747 |
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret |
26.10.2026 |
9.2 |
| CVE-2026-116508 |
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow |
31.10.2026 |
10 |
| CVE-2026-116506 |
TOTOLINK A950RG firewall.so apmib_set command injection |
26.10.2026 |
9.4 |
| CVE-2026-116505 |
TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection |
31.10.2026 |
9.4 |
| CVE-2026-116504 |
TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection |
27.10.2026 |
9.4 |
| CVE-2026-110720 |
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules |
26.10.2026 |
9.9 |
| CVE-2026-10757 |
BUG-000187511 - ArcGIS Server has a security vulnerability. |
29.10.2026 |
9.8 |
| CVE-2026-102649 |
Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset |
31.10.2026 |
9.9 |
| CVE-2026-115905 |
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
26.10.2026 |
10 |
| CVE-2026-112346 |
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE |
26.10.2026 |
9.3 |
| CVE-2026-65184 |
Avocent ACS8000 wsserver command injection |
26.10.2026 |
9.8 |
| CVE-2026-77055 |
Improper Privilege Assignment in boneIO |
26.10.2026 |
9.3 |
| CVE-2026-93328 |
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
26.10.2026 |
9.3 |
| CVE-2026-107656 |
|
27.10.2026 |
9.6 |
| CVE-2026-110475 |
Improper Authentication Vulnerability in CreditNirvana Collections Platform |
26.10.2026 |
9.3 |
| CVE-2026-115188 |
|
26.10.2026 |
9.9 |
| CVE-2026-115693 |
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
26.10.2026 |
9.1 |
| CVE-2026-116214 |
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code |
26.10.2026 |
9.3 |
| CVE-2026-116485 |
danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints |
26.10.2026 |
9.3 |
| CVE-2026-59106 |
Unauthenticated RCE Vulnerability in WolfProt interface implementation |
26.10.2026 |
9.3 |
| CVE-2026-59107 |
Shared SSH Authentication Key in vSolution Matrix File Sharing |
26.10.2026 |
9.2 |
| CVE-2026-116237 |
Oray Pugongying X5 Pro Dnsmasq crlf injection |
26.10.2026 |
9.3 |
| CVE-2026-116235 |
Oray Pugongying X5 Pro L2TP Authentication crlf injection |
26.10.2026 |
9.4 |
| CVE-2026-116233 |
Oray Pugongying X5 Pro Dnsmasq crlf injection |
31.10.2026 |
9.4 |
| CVE-2026-116234 |
Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection |
26.10.2026 |
9.4 |
| CVE-2026-116231 |
Oray Pugongying X5 Pro Ser2net crlf injection |
26.10.2026 |
9.4 |
| CVE-2026-116232 |
Oray Pugongying X5 Pro SNMP snmp_set crlf injection |
26.10.2026 |
9.4 |
| CVE-2026-116116 |
Yoosee GM8135S Camera Secure Boot signature verification |
26.10.2026 |
9.3 |
| CVE-2026-116163 |
Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses |
26.10.2026 |
9.1 |
| CVE-2026-116199 |
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback |
26.10.2026 |
9.2 |