CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-121802 04.11.2026 9.1
CVE-2026-121615 Linksys E5600 Login mesh_login.cgi improper authentication 04.11.2026 10
CVE-2026-121609 Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials 04.11.2026 10
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 04.11.2026 10
CVE-2026-121606 Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 04.11.2026 10
CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow 04.11.2026 9.4
CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow 04.11.2026 9.4
CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow 04.11.2026 9.4
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow 04.11.2026 9.4
CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 03.11.2026 9.8
CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability 03.11.2026 9.8
CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 03.11.2026 9.8
CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 03.11.2026 9.8
CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality 03.11.2026 9.3
CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 03.11.2026 9.1
CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials 03.11.2026 9.3
CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 03.11.2026 9.2
CVE-2026-82158 03.11.2026 9
CVE-2026-115731 Report Deserialization Code Execution 03.11.2026 9.4
CVE-2026-115732 Certificate Name Authorization Bypass 03.11.2026 9
CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 03.11.2026 9.1
CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access 03.11.2026 9.8
CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 03.11.2026 9.3
CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 03.11.2026 9.3
CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 03.11.2026 9.3
CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall 04.11.2026 9.2
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 03.11.2026 9.8
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 03.11.2026 9.8
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability 04.11.2026 9.9
CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 03.11.2026 9.4
CVE-2026-121392 FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 03.11.2026 9.1
CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 03.11.2026 9.2
CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client 03.11.2026 9.2
CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 03.11.2026 9.8
CVE-2026-13594 Improper Access Control vulnerability 04.11.2026 9.1
CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler 03.11.2026 9.1
CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 03.11.2026 9.8
CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 02.11.2026 9.8
CVE-2026-116769 Authentication bypass in Secure Access Servers 02.11.2026 9.3
CVE-2026-97718 CSRF in Secure Access Server v14.60 02.11.2026 9.4
CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 03.11.2026 9.8
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 03.11.2026 9.5
CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 03.11.2026 9.3
CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 03.11.2026 9.4
CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench 03.11.2026 9.4
CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 02.11.2026 9.3
CVE-2026-88811 Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy 03.11.2026 9.1
CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller 03.11.2026 9.1
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 02.11.2026 9.3
CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 02.11.2026 9.2
CVE-2026-120459 python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key 02.11.2026 9.1
CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway 03.11.2026 9.3
CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters 02.11.2026 9.1
CVE-2025-11969 Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions 02.11.2026 9.4
CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection 02.11.2026 10
CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection 02.11.2026 10
CVE-2026-120322 Termix-SSH Termix transferToHost path traversal 02.11.2026 9.4
CVE-2026-120283 Linksys E8450 portal.cgi strcpy stack-based overflow 02.11.2026 10
CVE-2026-120281 WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow 02.11.2026 10
CVE-2026-120282 WAVLINK WN536AX6-A protocol.csp host_black os command injection 02.11.2026 9.4
CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection 02.11.2026 10
CVE-2026-120280 WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection 02.11.2026 10
CVE-2026-120277 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 01.11.2026 10
CVE-2026-120276 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 01.11.2026 10
CVE-2026-120240 WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection 02.11.2026 9.4
CVE-2026-120239 WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection 02.11.2026 9.4
CVE-2026-120238 WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection 01.11.2026 9.4
CVE-2026-62048 WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability 01.11.2026 9.3
CVE-2026-120338 Prefab UI Pyodide sandbox escape to host RCE 02.11.2026 9.9
CVE-2026-120232 Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption 02.11.2026 9.3
CVE-2026-120231 WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection 02.11.2026 9.4
CVE-2026-120230 WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection 01.11.2026 9.4
CVE-2026-120229 WAVLINK WN553X1-B ioos sub_416B50 os command injection 01.11.2026 9.4
CVE-2026-120228 WAVLINK WN553X1-B ioos Service sub_416D88 os command injection 02.11.2026 9.4
CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal 02.11.2026 9.9
CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation 02.11.2026 9.9
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths 02.11.2026 9.9
CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection 02.11.2026 9.4
CVE-2026-120225 Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal 01.11.2026 9.4
CVE-2026-120224 Oray Pugongying X5 Pro API Authorization run_async_task improper authorization 02.11.2026 9.4
CVE-2026-120198 WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection 02.11.2026 10
CVE-2026-120197 WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection 02.11.2026 9.4
CVE-2026-120196 WAVLINK WN579X3-D wapi.cgi port_forward os command injection 01.11.2026 9.4
CVE-2026-120195 WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection 01.11.2026 10
CVE-2026-120189 D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow 01.11.2026 10
CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder 31.10.2026 9.8
CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header 02.11.2026 9.3
CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token 02.11.2026 9.3
CVE-2026-103882 Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter 31.10.2026 9.1
CVE-2026-118235 SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data 02.11.2026 9.8
CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection 02.11.2026 9.8
CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter 02.11.2026 9.8
CVE-2026-109220 PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field 03.11.2026 9.8
CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action 31.10.2026 9.1
CVE-2026-89270 Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters 02.11.2026 9.1
CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims 30.10.2026 9.3
CVE-2026-63377 TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover 30.10.2026 9.8
CVE-2026-62863 MoLing: unauthenticated SSE and wildcard CORS expose tool sessions 30.10.2026 9.6
CVE-2026-62849 ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection 30.10.2026 9.1
CVE-2026-62853 ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks 30.10.2026 9.9
CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary 30.10.2026 9.1
CVE-2026-116238 pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks 30.10.2026 9.2
CVE-2026-116241 pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier 30.10.2026 9.4
CVE-2026-61620 HoneySQL unchecked entity names can lead to SQL injection results 30.10.2026 9.8
CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation) 30.10.2026 9.1
CVE-2026-61850 Kargo: Privilege escalation via Project RBAC management in the Kargo API 30.10.2026 9.3
CVE-2026-78403 Unauthenticated Stack Buffer Overflow in Sentinel Keys Server 30.10.2026 9.3
CVE-2026-116386 WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability 30.10.2026 9.8
CVE-2026-116852 WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability 30.10.2026 9.1
CVE-2026-119526 WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-39732 WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability 30.10.2026 9.3
CVE-2026-39738 WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability 01.11.2026 9.8
CVE-2026-90888 WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-118697 02.11.2026 9
CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 02.11.2026 9
CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery 30.10.2026 10
CVE-2026-112816 Improper certificate validation in the HTTPS listener in LXD 31.10.2026 10
CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization 02.11.2026 9.3
CVE-2026-119716 pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments 02.11.2026 9.3
CVE-2026-93327 Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution 30.10.2026 9.4
CVE-2026-61737 ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin 30.10.2026 9.8
CVE-2026-61738 SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) 30.10.2026 10
CVE-2026-61729 SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection 30.10.2026 9.4
CVE-2026-61730 SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount 30.10.2026 9.3
CVE-2026-110799 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover 30.10.2026 9.8
CVE-2026-112905 Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft 30.10.2026 9
CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key 30.10.2026 9.3
CVE-2026-61728 SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover 30.10.2026 9.9
CVE-2026-119597 OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery 30.10.2026 9.3
CVE-2026-119418 CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() 30.10.2026 9.2
CVE-2026-119419 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation 30.10.2026 9.2
CVE-2026-119568 vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking 30.10.2026 9.1
CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server 30.10.2026 9.5
CVE-2025-31704 Dahua Intelligent Connection Center command injection 30.10.2026 9.8
CVE-2026-82104 API permission bypass via logic bug 30.10.2026 9.4
CVE-2026-103039 Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field 30.10.2026 9.8
CVE-2023-22793 30.10.2026 9.3
CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution 30.10.2026 9
CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API 30.10.2026 9.1
CVE-2026-103093 Sandbox Escape via Table Rotation in ServiceNow AI Platform 29.10.2026 9.4
CVE-2026-118769 Botan: Integer overflow when reporting block size in FFI can cause memory corruption 29.10.2026 9.2
CVE-2026-118762 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN 04.11.2026 9.3
CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie 03.11.2026 9.1
CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload 29.10.2026 9.4
CVE-2026-90865 Command Injection via FTP Notification Variables in Progress WS_FTP Server 30.10.2026 9
CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server 30.10.2026 9.1
CVE-2026-90868 OS Command Injection in Progress WS_FTP Server 30.10.2026 9.9
CVE-2026-84295 Improper Authentication in Progress WS_FTP Server 30.10.2026 10
CVE-2026-90863 Privilege Escalation via Missing Authorization in WS_FTP Manager 30.10.2026 9.1
CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server 30.10.2026 9.1
CVE-2026-111732 Out-of-bounds write when parsing AR Vendor Block requests 29.10.2026 9.3
CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list) 29.10.2026 9.2
CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.8
CVE-2026-107327 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.9
CVE-2026-107328 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.9
CVE-2026-107329 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.9
CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability 30.10.2026 10
CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62011 WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62012 WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62013 WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62014 WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62015 WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62016 WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-62017 WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62018 WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability 30.10.2026 9.8
CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.8
CVE-2026-110186 Langflow OSS is affected by multiple vulnerabilities 30.10.2026 9.8
CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection 04.11.2026 9.2
CVE-2026-97854 29.10.2026 9.3
CVE-2026-115964 WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability 29.10.2026 9.3
CVE-2026-114358 SQL Injection Vulnerability in Radius Xenia M2M Platform 29.10.2026 9.3
CVE-2026-109516 Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token 29.10.2026 9.8
CVE-2026-42922 29.10.2026 9.8
CVE-2026-66088 Unrestricted Command Execution via system.execute 29.10.2026 9.4
CVE-2026-118579 D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor 29.10.2026 9.3
CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection 03.11.2026 10
CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust 03.11.2026 10
CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs 29.10.2026 9.3
CVE-2026-117574 Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization 03.11.2026 9.1
CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS 29.10.2026 9.4
CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 30.10.2026 9.1
CVE-2026-118633 28.10.2026 9.2
CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. 28.10.2026 9.8
CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed 28.10.2026 9.8
CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code 02.11.2026 9.9
CVE-2026-115968 WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability 28.10.2026 9.8
CVE-2026-105420 Path Traversal in Wing WFTP Server leading to Remote Code Execution 28.10.2026 9.4
CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability 30.10.2026 9.3
CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability 29.10.2026 9.3
CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue 03.11.2026 9.6
CVE-2026-67074 HCL BigFix AEX is affected by multiple security vulnerabilities. 28.10.2026 9.1
CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec 28.10.2026 9.8
CVE-2026-99153 scsi: libiscsi: Validate the ITT reflected in a Reject PDU 31.10.2026 9.8
CVE-2026-99154 scsi: libiscsi: Reject a negative task index from parse_pdu_itt 31.10.2026 9.8
CVE-2026-103792 29.10.2026 9.6
CVE-2026-103799 03.11.2026 9.6
CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App 28.10.2026 9.4
CVE-2026-103780 29.10.2026 9.8
CVE-2026-86384 29.10.2026 9.8

Latest Updates

CVE Title Updated Score
CVE-2026-110944 Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer) 04.11.2026
CVE-2026-54851 WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability 04.11.2026 7.1
CVE-2026-62000 WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability 04.11.2026 7.5
CVE-2026-121818 About Time Technologies｜Herowatch Go - Security Misconfiguration 04.11.2026
CVE-2026-121816 About Time Technologies｜Herowatch Mini - Missing Authentication 04.11.2026
CVE-2026-121817 About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference 04.11.2026
CVE-2026-101165 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay 04.11.2026
CVE-2026-101166 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order 04.11.2026
CVE-2026-104719 CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts 04.11.2026
CVE-2026-105191 WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log 04.11.2026
CVE-2026-105413 Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values 04.11.2026
CVE-2026-106000 Booking Package < 1.7.34 - Unauthenticated Payment Bypass 04.11.2026
CVE-2026-106649 Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action 04.11.2026
CVE-2026-108041 SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings 04.11.2026
CVE-2026-108067 FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR 04.11.2026
CVE-2026-108068 FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard 04.11.2026
CVE-2026-110692 PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import 04.11.2026
CVE-2026-110964 Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR 04.11.2026
CVE-2026-111740 Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure 04.11.2026
CVE-2026-111962 WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File 04.11.2026
CVE-2026-112243 Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter 04.11.2026
CVE-2026-112244 Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points 04.11.2026
CVE-2026-114431 Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload 04.11.2026
CVE-2026-115241 WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID 04.11.2026
CVE-2026-115242 WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path 04.11.2026
CVE-2026-115243 WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files 04.11.2026
CVE-2026-115250 Text Typing < 2.2.2 - Contributor+ Stored XSS 04.11.2026
CVE-2026-115257 WP Roster < 2.36 - Unauthenticated Roster Data Modification 04.11.2026
CVE-2026-115262 Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore 04.11.2026
CVE-2026-115426 WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting 04.11.2026
CVE-2026-118403 Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure 04.11.2026
CVE-2026-118404 Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR 04.11.2026
CVE-2026-118407 Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover 04.11.2026
CVE-2026-118422 Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path 04.11.2026
CVE-2026-118523 EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override 04.11.2026
CVE-2026-118637 Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode 04.11.2026
CVE-2026-118783 All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute 04.11.2026
CVE-2026-118983 VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks 04.11.2026
CVE-2026-16511 Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory 04.11.2026 8.8
CVE-2026-85036 Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue 04.11.2026 5.7
CVE-2026-87038 Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode 04.11.2026 7
CVE-2026-87039 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers 04.11.2026 7.8
CVE-2026-87040 Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write 04.11.2026 8.3
CVE-2026-87041 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory 04.11.2026 7.8
CVE-2026-87043 sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready 04.11.2026 4.8
CVE-2026-87044 Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service 04.11.2026 6.5
CVE-2026-77690 Command injection vulnerability 04.11.2026 8.8
CVE-2025-11229 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server 04.11.2026 7.2
CVE-2026-77779 Improper access control vulnerability 04.11.2026 7.7
CVE-2026-11749 04.11.2026
CVE-2026-11753 04.11.2026
CVE-2026-105296 04.11.2026
CVE-2026-121803 04.11.2026
CVE-2026-79405 Improper Input Validation in Modem Firmware 04.11.2026 7.5
CVE-2026-80335 Out-of-bounds Write in Bootloader 04.11.2026 8.4
CVE-2026-121618 Linksys E5600 Factory Quality Control fqc.cgi information disclosure 04.11.2026
CVE-2026-121617 Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write 04.11.2026
CVE-2026-121802 04.11.2026 9.1
CVE-2026-121616 Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write 04.11.2026
CVE-2026-121615 Linksys E5600 Login mesh_login.cgi improper authentication 04.11.2026
CVE-2026-110464 04.11.2026
CVE-2026-112116 04.11.2026
CVE-2026-121610 funadmin Frontend List Endpoint index selectList sql injection 04.11.2026
CVE-2026-84729 04.11.2026
CVE-2026-84730 04.11.2026
CVE-2026-121609 Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials 04.11.2026
CVE-2026-121608 Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection 04.11.2026
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 04.11.2026
CVE-2026-121606 Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 04.11.2026
CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow 04.11.2026
CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow 04.11.2026
CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow 04.11.2026
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow 04.11.2026
CVE-2026-92185 Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability 03.11.2026
CVE-2026-92186 Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92191 Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92192 Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92194 Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92195 Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92196 Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92197 Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92198 Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability 03.11.2026
CVE-2026-92199 Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability 03.11.2026
CVE-2026-92200 Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability 03.11.2026
CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability 03.11.2026
CVE-2026-114550 libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability 03.11.2026
CVE-2026-114551 MailEnable Auth Cleartext Storage Information Disclosure Vulnerability 03.11.2026
CVE-2026-114552 MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability 03.11.2026
CVE-2026-118623 MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability 03.11.2026
CVE-2026-118624 MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability 03.11.2026
CVE-2026-118625 MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability 03.11.2026
CVE-2026-118626 MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability 03.11.2026
CVE-2026-118627 MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability 03.11.2026
CVE-2026-118628 MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability 03.11.2026
CVE-2026-121589 spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion 03.11.2026
CVE-2026-92187 Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 03.11.2026
CVE-2026-92193 Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability 03.11.2026
CVE-2026-92211 Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability 03.11.2026
CVE-2026-120631 CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse 03.11.2026
CVE-2026-120632 CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type 03.11.2026
CVE-2026-120633 CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port 03.11.2026
CVE-2026-120634 CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer 03.11.2026
CVE-2026-120635 CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs 03.11.2026
CVE-2026-120636 CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form 03.11.2026
CVE-2026-120637 CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD 03.11.2026
CVE-2026-120638 CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect 03.11.2026
CVE-2026-120639 CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push 03.11.2026
CVE-2026-120640 CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields 03.11.2026
CVE-2026-120641 CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths 03.11.2026
CVE-2026-120642 CGI versions before 5.00 for Perl return request-derived values untainted under taint mode 03.11.2026
CVE-2026-120643 CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url 03.11.2026
CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values 03.11.2026
CVE-2026-120645 CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list 03.11.2026
CVE-2026-120646 CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo 03.11.2026
CVE-2026-120647 CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename 03.11.2026
CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment 03.11.2026
CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits 03.11.2026
CVE-2026-120651 CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set 03.11.2026
CVE-2026-121585 InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization 03.11.2026
CVE-2026-121583 Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization 03.11.2026
CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality 03.11.2026 9.8
CVE-2022-30267 Emerson Ovation Insufficient Verification of Data Authenticity 03.11.2026 7.5
CVE-2026-121582 Umami Record API Endpoint route.ts authorization 03.11.2026
CVE-2026-121727 Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv() 03.11.2026
CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2 03.11.2026
CVE-2026-121729 emailflare before commit cf31f33 Missing Authorization via /api/keys Routes 03.11.2026
CVE-2026-121730 emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint 03.11.2026
CVE-2026-121731 RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report 03.11.2026
CVE-2026-121732 RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment 03.11.2026
CVE-2026-121733 Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload 03.11.2026
CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView 03.11.2026
CVE-2026-121735 blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens 03.11.2026
CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation 03.11.2026
CVE-2026-104608 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service 03.11.2026
CVE-2026-109836 03.11.2026
CVE-2026-110288 Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console 03.11.2026
CVE-2026-118237 Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service 03.11.2026
CVE-2026-121581 ArcReel Provider Test-Connection Endpoint test server-side request forgery 03.11.2026
CVE-2026-121539 miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control 03.11.2026
CVE-2026-103429 03.11.2026
CVE-2026-107916 03.11.2026
CVE-2026-108516 03.11.2026
CVE-2026-111085 03.11.2026
CVE-2026-116650 Tanium addressed an unauthorized code execution vulnerability in Threat Response. 03.11.2026 7.5
CVE-2026-116661 Tanium addressed an improper access controls vulnerability in Enforce. 03.11.2026 6.5
CVE-2026-116666 Tanium addressed an information disclosure vulnerability in Discover. 03.11.2026 4.3
CVE-2026-116668 Tanium addressed an uncontrolled resource consumption vulnerability in Discover. 03.11.2026 4.3
CVE-2026-108324 Tanium addressed a denial of service vulnerability in Tanium Client. 03.11.2026 6.5
CVE-2026-108327 Tanium addressed a path traversal vulnerability in Tanium Data Service. 03.11.2026 5
CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. 03.11.2026 4.3
CVE-2026-116648 Tanium addressed an improper output sanitization vulnerability in Discover. 03.11.2026 4.1
CVE-2026-116651 Tanium addressed an unauthorized code execution vulnerability in Threat Response. 03.11.2026 7.5
CVE-2026-116652 Tanium addressed a business logic error in Threat Response. 03.11.2026 4.3
CVE-2026-116653 Tanium addressed an improper input validation vulnerability in Threat Response. 03.11.2026 4.3
CVE-2026-116654 Tanium addressed an improper input validation vulnerability in Threat Response. 03.11.2026 6.5
CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. 03.11.2026 6.5
CVE-2026-116664 Tanium addressed an improper access controls vulnerability in Discover. 03.11.2026 3.1
CVE-2026-116665 Tanium addressed an information disclosure vulnerability in Discover. 03.11.2026 4.3
CVE-2026-116667 Tanium addressed an improper access controls vulnerability in Discover. 03.11.2026 4.2
CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. 03.11.2026 6.5
CVE-2026-120775 Tanium addressed a heap-based buffer overflow vulnerability in Deploy. 03.11.2026 7.2
CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory 03.11.2026
CVE-2026-121535 miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication 03.11.2026
CVE-2026-121565 Tanium addressed an improper certificate validation vulnerability in multiple products 03.11.2026 7.4
CVE-2026-121522 Possible panic from Git source resolver 03.11.2026
CVE-2026-115541 HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation 03.11.2026
CVE-2026-118865 Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component 03.11.2026
CVE-2026-121541 Bake filesystem path entitlements approval can be skipped in some multi-target builds 03.11.2026
CVE-2026-121542 Bake filesystem path entitlements approval can be skipped for path using basename prefix 03.11.2026
CVE-2026-121614 Docker Sandboxes host Git executes repository-controlled programs 03.11.2026
CVE-2026-121531 Umami 2FA Policy route.ts single-factor authentication 03.11.2026
CVE-2026-22060 CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 03.11.2026
CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 03.11.2026
CVE-2026-121524 sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection 03.11.2026
CVE-2026-120930 03.11.2026
CVE-2026-120931 03.11.2026
CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials 03.11.2026
CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 03.11.2026 8.1
CVE-2026-111751 Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) 03.11.2026
CVE-2026-121517 IrfanView TIFF Wang Annotation heap-based overflow 03.11.2026
CVE-2026-121621 Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration 03.11.2026
CVE-2026-82160 03.11.2026 3.3
CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) 03.11.2026
CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) 03.11.2026
CVE-2026-82158 03.11.2026 9
CVE-2026-82159 03.11.2026 8.8
CVE-2026-82161 03.11.2026 6.8
CVE-2026-121514 EasySoft ZenTao PMS User model.php checkGroupChange privileges management 03.11.2026
CVE-2026-28531 03.11.2026
CVE-2026-55186 Silverstripe MFA: Can bypass MFA during password reset flow 03.11.2026 4.2
CVE-2026-115731 Report Deserialization Code Execution 03.11.2026
CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie() 03.11.2026
CVE-2026-119636 03.11.2026
CVE-2026-120716 03.11.2026
CVE-2026-121029 03.11.2026
CVE-2026-121030 03.11.2026
CVE-2026-121031 03.11.2026
CVE-2026-121032 03.11.2026
CVE-2026-121033 03.11.2026
CVE-2026-121034 03.11.2026
CVE-2026-121035 04.11.2026
CVE-2026-121036 03.11.2026
CVE-2026-121037 04.11.2026
CVE-2026-121038 03.11.2026
CVE-2026-121039 03.11.2026
CVE-2026-121040 03.11.2026
CVE-2026-121041 03.11.2026
CVE-2026-121042 03.11.2026
CVE-2026-121043 03.11.2026
CVE-2026-121044 04.11.2026
CVE-2026-121045 03.11.2026
CVE-2026-121046 03.11.2026
CVE-2026-121047 04.11.2026
CVE-2026-121048 03.11.2026
CVE-2026-121049 03.11.2026
CVE-2026-121050 03.11.2026
CVE-2026-121051 03.11.2026
CVE-2026-121052 04.11.2026
CVE-2026-121053 03.11.2026
CVE-2026-121054 03.11.2026
CVE-2026-121055 03.11.2026
CVE-2026-121057 03.11.2026
CVE-2026-121059 03.11.2026
CVE-2026-121060 03.11.2026
CVE-2026-121061 03.11.2026
CVE-2026-121062 03.11.2026
CVE-2026-121063 03.11.2026
CVE-2026-121064 03.11.2026
CVE-2026-121065 03.11.2026
CVE-2026-121066 03.11.2026
CVE-2026-121067 03.11.2026
CVE-2026-121068 03.11.2026
CVE-2026-121069 03.11.2026
CVE-2026-121070 03.11.2026
CVE-2026-121071 04.11.2026
CVE-2026-121072 03.11.2026
CVE-2026-121073 03.11.2026
CVE-2026-121074 04.11.2026
CVE-2026-121075 03.11.2026
CVE-2026-121076 03.11.2026
CVE-2026-121077 03.11.2026
CVE-2026-121078 03.11.2026
CVE-2026-121079 03.11.2026
CVE-2026-121080 04.11.2026
CVE-2026-121081 03.11.2026
CVE-2026-121082 04.11.2026
CVE-2026-121083 04.11.2026
CVE-2026-121084 03.11.2026
CVE-2026-121085 03.11.2026
CVE-2026-121086 03.11.2026
CVE-2026-121087 03.11.2026
CVE-2026-121088 03.11.2026
CVE-2026-121089 04.11.2026
CVE-2026-121090 03.11.2026
CVE-2026-121091 03.11.2026
CVE-2026-121092 03.11.2026
CVE-2026-121093 03.11.2026
CVE-2026-121094 03.11.2026
CVE-2026-121095 03.11.2026
CVE-2026-121096 03.11.2026
CVE-2026-121097 03.11.2026
CVE-2026-121098 04.11.2026
CVE-2026-121099 03.11.2026
CVE-2026-121100 04.11.2026
CVE-2026-121101 03.11.2026
CVE-2026-121102 03.11.2026
CVE-2026-121103 03.11.2026
CVE-2026-121104 03.11.2026
CVE-2026-121105 03.11.2026
CVE-2026-121106 03.11.2026
CVE-2026-121107 03.11.2026
CVE-2026-121108 03.11.2026
CVE-2026-121109 03.11.2026
CVE-2026-121110 03.11.2026
CVE-2026-121111 03.11.2026
CVE-2026-121112 04.11.2026
CVE-2026-121113 03.11.2026
CVE-2026-121114 03.11.2026
CVE-2026-121115 03.11.2026
CVE-2026-121116 03.11.2026
CVE-2026-121117 03.11.2026
CVE-2026-121118 04.11.2026
CVE-2026-121119 03.11.2026
CVE-2026-121120 03.11.2026
CVE-2026-121121 03.11.2026
CVE-2026-121122 03.11.2026
CVE-2026-121123 03.11.2026
CVE-2026-121124 04.11.2026
CVE-2026-121125 03.11.2026
CVE-2026-121126 04.11.2026
CVE-2026-121127 03.11.2026
CVE-2026-121128 03.11.2026
CVE-2026-121129 03.11.2026
CVE-2026-121130 03.11.2026
CVE-2026-121131 04.11.2026
CVE-2026-121132 03.11.2026
CVE-2026-121133 03.11.2026
CVE-2026-121134 03.11.2026
CVE-2026-121135 03.11.2026
CVE-2026-121136 03.11.2026
CVE-2026-121137 03.11.2026
CVE-2026-121138 03.11.2026
CVE-2026-121140 04.11.2026
CVE-2026-121141 03.11.2026
CVE-2026-121142 03.11.2026
CVE-2026-121143 03.11.2026
CVE-2026-121148 04.11.2026
CVE-2026-121156 04.11.2026
CVE-2026-121157 03.11.2026
CVE-2026-121158 03.11.2026
CVE-2026-121159 03.11.2026
CVE-2026-121160 03.11.2026
CVE-2026-121161 03.11.2026
CVE-2026-121162 03.11.2026
CVE-2026-121163 03.11.2026
CVE-2026-121164 03.11.2026
CVE-2026-121165 03.11.2026
CVE-2026-121166 04.11.2026
CVE-2026-121167 03.11.2026
CVE-2026-121168 03.11.2026
CVE-2026-121169 03.11.2026
CVE-2026-121170 03.11.2026
CVE-2026-121171 03.11.2026
CVE-2026-121172 03.11.2026
CVE-2026-121173 03.11.2026
CVE-2026-121174 03.11.2026
CVE-2026-121175 03.11.2026
CVE-2026-121176 03.11.2026
CVE-2026-121177 03.11.2026
CVE-2026-121178 04.11.2026
CVE-2026-121179 04.11.2026
CVE-2026-121180 04.11.2026
CVE-2026-121181 04.11.2026
CVE-2026-121182 03.11.2026
CVE-2026-121183 03.11.2026
CVE-2026-121184 03.11.2026
CVE-2026-121185 04.11.2026
CVE-2026-121186 03.11.2026
CVE-2026-121187 03.11.2026
CVE-2026-121188 04.11.2026
CVE-2026-121189 03.11.2026
CVE-2026-121190 03.11.2026
CVE-2026-121193 03.11.2026
CVE-2026-121194 03.11.2026
CVE-2026-121195 03.11.2026
CVE-2026-121196 03.11.2026
CVE-2026-121197 03.11.2026
CVE-2026-121198 03.11.2026
CVE-2026-121199 03.11.2026
CVE-2026-121200 03.11.2026
CVE-2026-121201 03.11.2026
CVE-2026-121202 03.11.2026
CVE-2026-121203 04.11.2026
CVE-2026-121204 03.11.2026
CVE-2026-121205 03.11.2026
CVE-2026-121206 03.11.2026
CVE-2026-121207 03.11.2026
CVE-2026-121208 03.11.2026
CVE-2026-121209 03.11.2026
CVE-2026-121210 03.11.2026
CVE-2026-121211 03.11.2026
CVE-2026-121212 03.11.2026
CVE-2026-121213 03.11.2026
CVE-2026-121214 03.11.2026
CVE-2026-121215 03.11.2026
CVE-2026-121216 03.11.2026
CVE-2026-121217 03.11.2026
CVE-2026-121218 03.11.2026
CVE-2026-121219 03.11.2026
CVE-2026-121220 03.11.2026
CVE-2026-121221 03.11.2026
CVE-2026-121222 03.11.2026
CVE-2026-121223 03.11.2026
CVE-2026-121224 03.11.2026
CVE-2026-121225 03.11.2026
CVE-2026-121226 03.11.2026
CVE-2026-121227 03.11.2026
CVE-2026-121228 04.11.2026
CVE-2026-121229 04.11.2026
CVE-2026-121230 03.11.2026
CVE-2026-121231 03.11.2026
CVE-2026-121232 03.11.2026
CVE-2026-121233 04.11.2026
CVE-2026-121234 03.11.2026
CVE-2026-121235 03.11.2026
CVE-2026-121236 03.11.2026
CVE-2026-121237 03.11.2026
CVE-2026-121238 03.11.2026
CVE-2026-121239 03.11.2026
CVE-2026-121240 03.11.2026
CVE-2026-121241 03.11.2026
CVE-2026-121242 03.11.2026
CVE-2026-121243 03.11.2026
CVE-2026-121244 03.11.2026
CVE-2026-121245 03.11.2026
CVE-2026-121246 04.11.2026
CVE-2026-121247 04.11.2026
CVE-2026-121248 03.11.2026
CVE-2026-121249 03.11.2026
CVE-2026-121250 03.11.2026
CVE-2026-121251 03.11.2026
CVE-2026-121252 03.11.2026
CVE-2026-121253 03.11.2026
CVE-2026-121254 03.11.2026
CVE-2026-121255 03.11.2026
CVE-2026-121256 03.11.2026
CVE-2026-121257 03.11.2026
CVE-2026-64672 Terragrunt catalog predictable temp symlink clobber 03.11.2026
CVE-2026-115732 Certificate Name Authorization Bypass 03.11.2026
CVE-2026-120715 03.11.2026
CVE-2026-120733 03.11.2026
CVE-2026-120734 03.11.2026
CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure 03.11.2026
CVE-2026-76894 CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) 03.11.2026 3.1
CVE-2026-82154 03.11.2026 2.4
CVE-2026-82155 03.11.2026 7.8
CVE-2026-121580 03.11.2026
CVE-2026-115878 Stanza: RCE via pickle deserialization in the lemmatizer 03.11.2026 7.8
CVE-2026-61496 03.11.2026
CVE-2026-61497 TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser 03.11.2026
CVE-2026-120952 MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write 03.11.2026
CVE-2026-120959 MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes 03.11.2026
CVE-2026-121502 mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection 03.11.2026
CVE-2026-61495 TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string() 03.11.2026
CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 03.11.2026 9.1
CVE-2026-88066 Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable 03.11.2026
CVE-2026-88968 Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace 03.11.2026
CVE-2026-54161 upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution 03.11.2026 8.1
CVE-2026-95722 Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client 03.11.2026 8.8
CVE-2026-95723 Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in Virtual Intranet Access (VIA) Client 03.11.2026 8.4
CVE-2026-95724 Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA) 03.11.2026 8.1
CVE-2026-95725 Authenticated Local Command Injection Vulnerability in the VIA Client for Linux 03.11.2026 7.8
CVE-2026-95726 Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA 03.11.2026 7.5
CVE-2026-95727 Authenticated Command Injection Vulnerability in HPE Networking VIA 03.11.2026 7.2
CVE-2026-95728 Local Privilege Escalation in Virtual Intranet Access (VIA) Client for Linux 03.11.2026 7.1
CVE-2026-95729 Authenticated Sensitive Information Disclosure in VIA 03.11.2026 6.5
CVE-2026-95730 Authenticated Buffer Overflow Vulnerability Leads to Denial-of-Service in HPE Networking VIA 03.11.2026 6.5
CVE-2025-71452 Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp 03.11.2026
CVE-2026-121577 Unescaped header separators in whatstk build a regular expression that backtracks exponentially 03.11.2026
CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated 03.11.2026 7.2
CVE-2026-63395 isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE) 03.11.2026 8.8
CVE-2026-63433 MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value 03.11.2026 6.8
CVE-2026-63434 MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning 03.11.2026 4.3
CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access 03.11.2026 9.8
CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95734 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API 03.11.2026 8.8
CVE-2026-95735 Improper Certificate Validation in HPE Networking Fabric Composer 03.11.2026 8.7
CVE-2026-95736 Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer 03.11.2026 8.3
CVE-2026-95737 Local Privilege Escalation in HPE Networking Fabric Composer 03.11.2026 8.2
CVE-2026-95738 Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer 03.11.2026 8.1
CVE-2026-95739 Unauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric Composer 03.11.2026 8.1
CVE-2026-95740 Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer 03.11.2026 8
CVE-2026-95741 Authenticated Missing Integrity Verification in API of HPE Networking Fabric Composer 03.11.2026 8
CVE-2026-95742 Authenticated Local Arbitrary File Write Vulnerability in HPE Networking Fabric Composer 03.11.2026 7.8
CVE-2026-95743 Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer 03.11.2026 7.8
CVE-2026-95744 Authenticated Adjacent Sensitive Information Disclosure in HPE Networking Fabric Composer 03.11.2026 7.7
CVE-2026-95745 Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95746 Authentication Bypass in the API Endpoint of HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95747 Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95748 Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95749 Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95750 Unauthenticated Improper Certificate Validation in HPE Networking Fabric Composer 03.11.2026 7.5
CVE-2026-95751 Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer 03.11.2026 7.4
CVE-2026-95752 Local Privilege Escalation in HPE Networking Fabric Composer 03.11.2026 7.1
CVE-2026-95753 Privilege Escalation in HPE Networking Fabric Composer API 03.11.2026 7.1
CVE-2026-95755 Unauthenticated Adjacent Improper Certificate Validation allows Interception of Management Traffic in HPE Networking Fabric Composer 03.11.2026 6.8
CVE-2026-95756 Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric Composer 03.11.2026 6.6
CVE-2026-95757 Authentication Bypass Vulnerability in HPE Networking Fabric Composer API 03.11.2026 6.5
CVE-2026-95758 Authenticated Authorization Bypass in the API of HPE Networking Fabric Composer 03.11.2026 6.5
CVE-2026-95759 Authenticated Audit Log Bypass in the API of HPE Networking Fabric Composer 03.11.2026 6.5
CVE-2026-95760 Privilege Escalation Vulnerability in HPE Networking Fabric Composer API 03.11.2026 6.4
CVE-2026-95761 Authenticated Improper Certificate Validation leads to Information Disclosure in HPE Networking Fabric Composer 03.11.2026 5.9
CVE-2026-95762 Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer 03.11.2026 5.9
CVE-2026-95763 Unauthenticated Improper Certificate Validation allows Information Disclosure in HPE Networking Fabric Composer 03.11.2026 5.9
CVE-2026-95764 Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric Composer 03.11.2026 5.7
CVE-2026-95765 Unauthenticated Sensitive Information Disclosure in Web-Based Management Interface of HPE Networking Fabric Composer 03.11.2026 5.4
CVE-2026-95766 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer 03.11.2026 5.3
CVE-2026-95767 Unauthenticated Information Disclosure in HPE Networking Fabric Composer 03.11.2026 5.3
CVE-2026-95768 Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer API 03.11.2026 5.3
CVE-2026-95769 Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric Composer 03.11.2026 5.3
CVE-2026-95770 Authenticated Local Sensitive Information Disclosure in HPE Networking Fabric Composer 03.11.2026 4.7
CVE-2026-95771 Authenticated Information Disclosure in HPE Networking Fabric Composer API Endpoint 03.11.2026 4.3
CVE-2026-95772 Authenticated Race Condition in API of HPE Networking Fabric Composer 03.11.2026 4.2
CVE-2026-95773 Authenticated Local Denial-of-Service Vulnerability in HPE Networking Fabric Composer 03.11.2026 3.8
CVE-2026-95774 Unauthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer 03.11.2026 3.7
CVE-2026-95775 Authenticated Local Information Disclosure Vulnerability in HPE Networking Fabric Composer 03.11.2026 3.3
CVE-2026-95776 Authenticated Path Traversal Vulnerability in HPE Networking Fabric Composer API Allows for Limited File Read 03.11.2026 3.1
CVE-2026-95777 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer Management Interface 03.11.2026 3.1
CVE-2025-71451 Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp 03.11.2026
CVE-2026-63475 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) 03.11.2026 4.3
CVE-2026-63476 isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS) 03.11.2026 4.3
CVE-2026-105821 Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy 03.11.2026
CVE-2026-105822 Server-Side Request Forgery in Tapo Cloud MQTT Proxy 03.11.2026
CVE-2026-120567 ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions 03.11.2026
CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout 03.11.2026 5.3
CVE-2026-63500 Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export 03.11.2026 7.1
CVE-2026-63502 Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write 03.11.2026 8.3
CVE-2026-93325 Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx 03.11.2026
CVE-2026-63482 Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data 03.11.2026 7.5
CVE-2026-63489 Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters 03.11.2026 7.6
CVE-2026-63501 ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass) 03.11.2026 7.5
CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change 03.11.2026
CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 03.11.2026
CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 03.11.2026
CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 03.11.2026
CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall 04.11.2026
CVE-2026-121501 mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation 03.11.2026
CVE-2026-120953 Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler 03.11.2026
CVE-2026-39379 GeoNetwork: Reflected XSS through client-side template injection 03.11.2026 7.1
CVE-2026-120678 MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) 03.11.2026
CVE-2026-120684 MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password 03.11.2026
CVE-2026-120954 Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views 03.11.2026
CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata 03.11.2026
CVE-2026-120956 remote abort and memory disclosure from a malformed cursor.ns 03.11.2026
CVE-2026-121382 Netcore NBR100V2 auto_ac msg_aes_dec integer overflow 03.11.2026
CVE-2026-121652 Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering 03.11.2026 5.4
CVE-2026-46487 GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field 03.11.2026 7.5
CVE-2026-63198 traQ: Privilege escalation by OAuth prompt=none request 03.11.2026 7.3
CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 03.11.2026
CVE-2026-120673 Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command 03.11.2026
CVE-2026-63197 traQ: XSS in the User Uploaded File Retrieval API 03.11.2026 7.3
CVE-2026-63417 Logging Redactor: PII data in str/repr of non primitive objects was not being redacted 03.11.2026
CVE-2026-119922 Babelfish for PostgreSQL Privilege Escalation 03.11.2026 8.8
CVE-2026-57154 OPNsense: Configuration line injection via multiple GUI text fields 03.11.2026 8.1
CVE-2026-63418 Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary 03.11.2026 7
CVE-2026-63436 zt-zip: Path traversal in fluent API unpack 03.11.2026 6.1
CVE-2026-63492 03.11.2026
CVE-2026-63494 03.11.2026
CVE-2026-63499 zt-zip: ZipUtil.unpack can change file permissions of output directory 03.11.2026
CVE-2026-116845 NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView 03.11.2026
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 03.11.2026 9.8
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 03.11.2026 9.8
CVE-2026-44265 Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields 03.11.2026 7.4
CVE-2026-121263 phpMyAdmin MoTranslator Loader.php getTranslator path traversal 03.11.2026
CVE-2026-121624 Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation 03.11.2026
CVE-2026-121625 GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing 03.11.2026
CVE-2026-121626 GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler 03.11.2026
CVE-2026-121627 buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL 03.11.2026
CVE-2026-121628 Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting 03.11.2026
CVE-2026-114187 WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-119509 WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints 03.11.2026
CVE-2026-97072 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 03.11.2026 4.3
CVE-2026-103077 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 03.11.2026 4.3
CVE-2026-114185 WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability 03.11.2026 6.5
CVE-2026-119485 WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-121262 phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion 03.11.2026
CVE-2026-38600 03.11.2026
CVE-2026-38601 03.11.2026
CVE-2026-39777 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability 03.11.2026 4.3
CVE-2026-119487 WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-120843 WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability 03.11.2026 6.5
CVE-2026-38595 03.11.2026
CVE-2026-114183 WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability 03.11.2026 6.5
CVE-2026-115289 Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure 03.11.2026 4.3
CVE-2026-115290 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 03.11.2026 7.5
CVE-2026-115292 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure 03.11.2026 4.3
CVE-2026-115293 Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure 03.11.2026 6.5
CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion 03.11.2026 7.3
CVE-2026-115295 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure 03.11.2026 4.3
CVE-2026-115297 NULL Pointer Dereference in Packetbeat Leading to Denial of Service 03.11.2026 6.5
CVE-2026-115298 Incorrect Authorization in Elasticsearch Leading to Information Disclosure 03.11.2026 4.3
CVE-2026-115710 Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure 03.11.2026 4.2
CVE-2026-115714 Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections 03.11.2026 7.4
CVE-2026-115715 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service 03.11.2026 6.5
CVE-2026-115716 Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service 03.11.2026 6.5
CVE-2026-116858 WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability 03.11.2026 4.3
CVE-2026-116859 WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-119495 WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-119521 WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability 03.11.2026 6.5
CVE-2026-120846 WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-39743 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability 03.11.2026 5.3
CVE-2026-121259 Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator 03.11.2026
CVE-2026-121261 phpMyAdmin ShapeFile SHP File loadFromFile infinite loop 03.11.2026
CVE-2026-109593 03.11.2026
CVE-2026-109594 03.11.2026
CVE-2026-121587 Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints 03.11.2026
CVE-2026-121588 TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import 03.11.2026
CVE-2026-121602 Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN 03.11.2026
CVE-2026-121603 Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler 03.11.2026
CVE-2026-121604 wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c 03.11.2026
CVE-2026-103916 Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory 03.11.2026
CVE-2026-119674 mongorestore may restore encoded collection names into an unintended collection 03.11.2026
CVE-2026-28327 SolarWinds Dameware DLL Hijacking Vulnerability 04.11.2026 8.2
CVE-2026-28335 SolarWinds Dameware Buffer Overflow Vulnerability 04.11.2026 8.4
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability 04.11.2026 9.9
CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename 03.11.2026
CVE-2026-119673 mongofiles may write outside the working directory through a symlink 03.11.2026
CVE-2026-119675 mongorestore may bypass collection guards through a system.buckets prefix 03.11.2026
CVE-2026-118505 AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource 03.11.2026
CVE-2026-119215 AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account 03.11.2026
CVE-2026-108147 Potential memory exhaustion in MultiPartParser via base64-encoded file upload 03.11.2026
CVE-2026-111211 Potential log injection via unescaped geometry form values 03.11.2026
CVE-2026-111362 Server-side request forgery via crs member of GeoJSON geometries 03.11.2026
CVE-2026-113593 Potential exposure of private data via empty and missing Vary headers 03.11.2026
CVE-2026-113733 Password hash disclosure to "view only" admin users with custom user models 03.11.2026
CVE-2026-114582 Server-side request forgery via SpatialReference string input 03.11.2026
CVE-2026-120756 Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize 03.11.2026
CVE-2026-120757 Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse 03.11.2026
CVE-2026-120758 NULL Pointer Dereference in H5HL_unprotect via Corrupted File 03.11.2026
CVE-2026-121578 CVE-2026-121578 03.11.2026
CVE-2026-65109 03.11.2026 4.7
CVE-2026-65138 03.11.2026 6.3
CVE-2026-65139 03.11.2026 6.3
CVE-2026-65140 03.11.2026 5.7
CVE-2026-65165 03.11.2026 5.3
CVE-2026-65168 03.11.2026 7
CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser 03.11.2026 7.5
CVE-2026-119741 rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions 03.11.2026
CVE-2026-120755 Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter 03.11.2026
CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 03.11.2026
CVE-2026-120754 Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter 03.11.2026
CVE-2026-121564 Silent loss of messages when merging overlapping chat exports in whatstk 03.11.2026
CVE-2026-65107 03.11.2026 6.3
CVE-2026-65108 03.11.2026 6.3
CVE-2026-97350 Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows 03.11.2026
CVE-2026-121450 CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID 03.11.2026
CVE-2026-121451 AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF 03.11.2026
CVE-2026-121452 bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service 03.11.2026
CVE-2026-121453 SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint 03.11.2026
CVE-2026-121454 Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests 03.11.2026
CVE-2026-121455 DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save 03.11.2026
CVE-2026-121543 smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation 03.11.2026
CVE-2026-121544 Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers 03.11.2026
CVE-2026-121545 Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler 03.11.2026
CVE-2026-121546 ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following 03.11.2026
CVE-2026-121547 dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata 03.11.2026
CVE-2026-121548 nnn through 5.3 OS Command Injection via togglex Plugin 03.11.2026
CVE-2026-121549 nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins 03.11.2026
CVE-2026-121550 nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling 03.11.2026
CVE-2026-121551 PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description 03.11.2026
CVE-2026-121552 domain-admin before 1.6.79 Missing Authorization via getGroupUserList 03.11.2026
CVE-2026-121553 Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) 03.11.2026
CVE-2026-121554 cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects 03.11.2026
CVE-2026-121555 Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb 03.11.2026
CVE-2026-121556 FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints 03.11.2026
CVE-2026-121557 WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot 03.11.2026
CVE-2026-121558 AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id 03.11.2026
CVE-2026-121559 GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning 03.11.2026
CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts 03.11.2026
CVE-2026-121561 Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads 03.11.2026
CVE-2026-121562 CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint 03.11.2026
CVE-2026-73328 Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/ 03.11.2026
CVE-2026-100493 03.11.2026
CVE-2026-110265 runZero search SQL injection 03.11.2026 6.5
CVE-2026-118488 Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client 03.11.2026 5.9
CVE-2026-40652 03.11.2026
CVE-2026-40659 03.11.2026
CVE-2026-40660 03.11.2026
CVE-2026-40661 03.11.2026
CVE-2026-43603 03.11.2026
CVE-2026-118489 CachingWebClient shares user-specific HTTP responses across users via the shared cache tier 03.11.2026 7.5
CVE-2026-118527 03.11.2026 4.3
CVE-2026-121386 FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers 03.11.2026
CVE-2026-121387 FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder 03.11.2026
CVE-2026-121388 FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST 03.11.2026
CVE-2026-121389 FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging 03.11.2026
CVE-2026-121390 FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response 03.11.2026
CVE-2026-121391 FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE 03.11.2026
CVE-2026-121392 FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 03.11.2026
CVE-2026-121393 FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion 03.11.2026
CVE-2026-121394 FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder 03.11.2026
CVE-2026-121395 FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder 03.11.2026
CVE-2026-121396 FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion 03.11.2026
CVE-2026-121397 FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer() 03.11.2026
CVE-2026-121398 FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module 03.11.2026
CVE-2026-121399 FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length 03.11.2026
CVE-2026-121400 FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet 03.11.2026
CVE-2026-121401 FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet 03.11.2026
CVE-2026-121402 FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics 03.11.2026
CVE-2026-121403 FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP 03.11.2026
CVE-2026-121404 FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA 03.11.2026
CVE-2026-121405 FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control 03.11.2026
CVE-2026-121406 FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload 03.11.2026
CVE-2026-121407 FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel 03.11.2026
CVE-2026-121408 FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel 03.11.2026
CVE-2026-121409 FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token 03.11.2026
CVE-2026-121410 FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2 03.11.2026
CVE-2026-121411 FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry 03.11.2026
CVE-2026-121412 FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly 03.11.2026
CVE-2026-121413 Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession 03.11.2026
CVE-2026-121414 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update 03.11.2026
CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key 03.11.2026
CVE-2026-121416 SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations 03.11.2026
CVE-2026-121417 SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends 03.11.2026
CVE-2026-121418 SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner 03.11.2026
CVE-2026-121419 SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision 03.11.2026
CVE-2026-121420 SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses 03.11.2026
CVE-2026-121421 SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass 03.11.2026
CVE-2026-121422 SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass 03.11.2026
CVE-2026-121423 SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization 03.11.2026
CVE-2026-121424 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments 03.11.2026
CVE-2026-121425 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing 03.11.2026
CVE-2026-121426 Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser 03.11.2026
CVE-2026-121427 AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config 03.11.2026
CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone 03.11.2026
CVE-2026-121429 AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() 03.11.2026
CVE-2026-121430 AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints 03.11.2026
CVE-2026-121431 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors 03.11.2026
CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist 03.11.2026
CVE-2026-121433 AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export 03.11.2026
CVE-2026-121434 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API 03.11.2026
CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API 03.11.2026
CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php 03.11.2026
CVE-2026-121437 Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters 03.11.2026
CVE-2026-121438 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing 03.11.2026
CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http 03.11.2026
CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass 03.11.2026
CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling 03.11.2026
CVE-2026-121442 Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API 03.11.2026
CVE-2026-121443 svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag 03.11.2026
CVE-2026-121444 svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph 03.11.2026
CVE-2026-121445 svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping 03.11.2026
CVE-2026-121446 svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes 03.11.2026
CVE-2026-121447 svg-sanitizer before 1.1.0 XSS via animateTransform on Safari 03.11.2026
CVE-2026-121448 Dockhand before 1.0.54 Path Traversal via Stack Environment Routes 03.11.2026
CVE-2026-121449 Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook 03.11.2026
CVE-2026-106991 03.11.2026 7.1
CVE-2026-121505 Out-of-bounds Read in NTPsec 03.11.2026 3.7
CVE-2026-121506 Out-of-bounds Write in NTPsec 03.11.2026 7.4
CVE-2026-121507 Double Free in µD3TN 03.11.2026 5.9
CVE-2026-121508 Use After Free in µD3TN 03.11.2026 5.9
CVE-2026-121510 Out-of-bounds Write in µD3TN 03.11.2026 7.5
CVE-2026-121511 Out-of-bounds Read in µD3TN 03.11.2026 7.1
CVE-2026-121512 Missing Release of Memory after Effective Lifetime in µD3TN 03.11.2026 7.5
CVE-2026-121513 Out-of-bounds Write in µD3TN 03.11.2026 7.5
CVE-2026-120572 Incorrect boundary conditions in the Layout: Block and Inline component 03.11.2026
CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php 03.11.2026
CVE-2026-119179 MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data 03.11.2026
CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress 03.11.2026 4.8
CVE-2026-85033 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer 03.11.2026 4.6
CVE-2026-85034 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers 03.11.2026 6.7
CVE-2026-85035 Use-after-free via dynamically allocated message queue retained by the CAN RX filter 03.11.2026 8.8
CVE-2026-89295 Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter 03.11.2026
CVE-2026-65160 03.11.2026 5.5
CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools 03.11.2026
CVE-2026-76124 BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint 03.11.2026 8.8
CVE-2026-99270 tcp: Fix potential UAF in reqsk_timer_handler(). 03.11.2026 8.1
CVE-2026-108046 Direct Object Reference (IDOR) vulnerability in Alosuite 03.11.2026
CVE-2026-108047 Inadequate authorization vulnerability in Alosuite’s user invitation functionality 03.11.2026
CVE-2026-108048 Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. 03.11.2026
CVE-2026-108049 Clickjacking vulnerability in the Alosuite web application. 03.11.2026
CVE-2026-108050 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108051 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108052 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108053 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108054 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108055 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108056 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108057 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108058 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108059 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-108060 Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. 03.11.2026
CVE-2026-99262 io_uring/timeout: don't lose a cancel as io-wq arms a timeout 03.11.2026
CVE-2026-99263 io_uring/poll: avoid retry wakeup loss when dropping ownership 03.11.2026
CVE-2026-99264 io_uring/net: don't retry recv on uncommitted buffers 03.11.2026 7.8
CVE-2026-99265 io_uring/openclose: keep the lock in io_pipe_fixed() 03.11.2026
CVE-2026-99266 io_uring/zcrx: fix buffer offsets in areas above 4GB 03.11.2026
CVE-2026-99267 io_uring/napi: make stale entries time out after 60s 03.11.2026
CVE-2026-99268 io_uring: wake ring pollers for local task_work 03.11.2026
CVE-2026-99269 sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs 03.11.2026 7.8
CVE-2026-99252 io_uring/mpscq: disable preemption while pushing 03.11.2026
CVE-2026-99253 io_uring/cancel: rearm local work wake up before sleep 03.11.2026
CVE-2026-99254 io_uring: don't flood a cancelling task with task_work 03.11.2026
CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations 03.11.2026
CVE-2026-99256 dm cache: fix issue with background work locking 03.11.2026
CVE-2026-99257 gpio: shared: gracefully handle no-device lookup of shared GPIOs 03.11.2026
CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() 03.11.2026
CVE-2026-99259 soc/tegra: pmc: Fix uninitialised clock rate 03.11.2026
CVE-2026-99260 ntfs: fix resident conversion in ntfs_new_attr_flags 03.11.2026
CVE-2026-99261 drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction 03.11.2026
CVE-2026-99243 io-wq: order the exit bit against worker creation task work 03.11.2026
CVE-2026-99244 pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper 03.11.2026
CVE-2026-99245 KEYS: Fix key_reject_and_link() race with keyring restriction 03.11.2026
CVE-2026-99246 tipc: protect node reset trace dump with node lock 03.11.2026 8.1
CVE-2026-99247 tracing: Do not initialize tracefs work if tracing is disabled 03.11.2026
CVE-2026-99248 i2c: xiic: restore non-managed runtime PM to fix clk WARN flood 03.11.2026
CVE-2026-99249 pid_namespace: make zap_pid_ns_processes() freezable 03.11.2026
CVE-2026-99250 printk: Postpone kthread startup 03.11.2026
CVE-2026-99251 Drivers: hv: Avoid infinite retry loop in init_vp_index() 03.11.2026
CVE-2026-114442 Apache HertzBeat: incomplete XPath expression validation in aliasFields 03.11.2026
CVE-2026-120327 Open Redirection in extension "Mail" (mail) 03.11.2026
CVE-2026-120328 Information Disclosure in extension "Mail" (mail) 03.11.2026
CVE-2026-120329 Broken Access Control in extension "Mail" (mail) 03.11.2026
CVE-2026-120330 Broken Access Control in extension "Mail" (mail) 03.11.2026
CVE-2026-120331 Server-Side Request Forgery in extension "Mail" (mail) 03.11.2026
CVE-2026-120332 Cross-Site Scripting in extension "Mail" (mail) 03.11.2026
CVE-2026-120333 Broken Access Control in extension "Frontend User Registration" (sf_register) 03.11.2026
CVE-2026-77691 Command injection vulnerability 04.11.2026 8.1
CVE-2026-119843 Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags 03.11.2026
CVE-2026-89229 03.11.2026
CVE-2026-119641 Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership 03.11.2026
CVE-2026-119724 Apache JClouds: XML External Entity (XXE) in provider-response parsing 03.11.2026
CVE-2026-77778 Improper access control vulnerability 03.11.2026 7.1
CVE-2026-89293 Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering 03.11.2026
CVE-2026-77777 Improper access control vulnerability 03.11.2026 7.1
CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 03.11.2026