CVE-2026 list

CVE-2026 records published in October 2026

Page 11 of 14: records 10,001 to 11,000 of the 13,324 published in October 2026, newest first. The first page carries the figures for October 2026.

CVE-2026 records published in October 2026, newest first: records 10,001 to 11,000 of 13,324
CVE Summary CVSS EPSS Published Signals
CVE-2026-95599Taskbuilder WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-09Fix
CVE-2026-95598Search in Place WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-95597워드프레스 결제 심플페이 WordPress plugin settings Change vulnerability6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-95596ShopBuilder Elementor WooCommerce Builder Addons WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-95591VikBooking Hotel Booking Engine and PMS WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-95589Deposits and Partial Payments for WooCommerce WordPress plugin broken access control6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-94668Salon booking system WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94667JetReviews WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-94666Generate PDF using Contact Form 7 WordPress plugin arbitrary file download7.5CNA v3.10.4%2026-10-09Fix
CVE-2026-94665Classified Listing WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-94664PDF for Contact Form 7 WordPress plugin arbitrary file download7.5CNA v3.10.4%2026-10-09Fix
CVE-2026-94663ProfileGrid WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-09Fix
CVE-2026-94661JetBlog WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94641UsersWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94632BlockStrap Page Builder - Bootstrap Blocks WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94568Pay with Vipps for WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-09Fix
CVE-2026-94503Zombify WordPress plugin arbitrary file upload10.0CNA v3.10.3%2026-10-09Reported exploitedExploit code
CVE-2026-94415Betheme WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09
CVE-2026-94170Sassy Social Share WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09
CVE-2026-94167Kubio AI Page Builder WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94166UpSolution Core WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09
CVE-2026-94161Grand Restaurant WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-94159Total Donations WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09
CVE-2026-94158Gloria Admin Panel WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09
CVE-2026-94067The Voux WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-09
CVE-2026-94066Pond WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-94065ColorFolio WordPress theme PHP object injection8.8CNA v3.10.3%2026-10-09
CVE-2026-94064Neo Barber Shop WordPress theme PHP object injection8.8CNA v3.10.3%2026-10-09
CVE-2026-94063Education Center WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-94062Werkstatt WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-09
CVE-2026-94061Whistle - Sports Club WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-94060Voldor WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-94059Ogency WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-94058Treck WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09
CVE-2026-93947Traveler WordPress theme SQL injection9.3CNA v3.10.2%2026-10-09Fix
CVE-2026-93548FooSales WordPress plugin Subscriber+ privilege escalation via user Impersonation8.8CISA ADP v3.10.2%2026-10-09Fix
CVE-2026-92990SendPress WordPress plugin unauthenticated Newsletter Sending Log disclosure via hard-coded token5.3CISA ADP v3.10.2%2026-10-09
CVE-2026-92989SendPress Newsletters WordPress plugin Subscriber+ Mailing List Sync and Newsletter Queueing4.3CISA ADP v3.10.2%2026-10-09
CVE-2026-92705Aegisub executes arbitrary code through automatically loaded Automation scripts7.8CNA v3.10.1%2026-10-09Fix
CVE-2026-92085Stored XSS in TMT Machine's Talassoft Industrial Management Software5.4CNA v3.10.1%2026-10-09Fix
CVE-2026-90983OTP Code Exposure in Hayat Hospital's Hayat Mobile8.2CNA v3.10.3%2026-10-09Fix
CVE-2026-89235Testimonials by BestWebSoft - unauthenticated SQLi via offset parameter6.8CNA v3.10.2%2026-10-09
CVE-2026-88931Social Web Suite WordPress plugin unauthenticated arbitrary plugin settings update5.3CISA ADP v3.10.2%2026-10-09
CVE-2026-87846Shipping for Nova Poshta - Unauthenticated Order Shipment Record Deletion5.3CNA v3.10.2%2026-10-09
CVE-2026-87841UnitechPay WordPress plugin unauthenticated order Payment bypass via Unsigned Webhook5.3CISA ADP v3.10.2%2026-10-09
CVE-2026-87110Ops Manager uncontrolled resource consumption in Monitoring endpoints6.9CNA v4.00.3%2026-10-09Fix
CVE-2026-87109Ops Manager Sensitive MFA Enrollment information exposure in User Listings6.0CNA v4.00.2%2026-10-09Fix
CVE-2026-87108Ops Manager improper authorization in Daily Host Monitoring Retrieval2.3CNA v4.00.1%2026-10-09Fix
CVE-2026-86851Livees Checkout - Unauthenticated Order Status Change, Order Note injection and order key disclosure6.5CNA v3.10.2%2026-10-09
CVE-2026-86850SKU Error Fixer for WooCommerce WordPress plugin unauthenticated Orphaned Product Variation deletion6.5CISA ADP v3.10.2%2026-10-09
CVE-2026-86463Apache CXF: FIQL Query parser denial of service7.5CISA ADP v3.10.4%2026-10-09Fix
CVE-2026-86405Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop9.8CNA v3.10.2%2026-10-09Fix
CVE-2026-85531Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.9.8CNA v3.10.2%2026-10-09Fix
CVE-2026-85479Grid Protection Alliance openPDC and openHistorian missing authentication for critical function6.9CNA v4.00.3%2026-10-09Fix
CVE-2026-85348GDPR Data Request Form - DPO Email Update via CSRF4.3CNA v3.10.1%2026-10-09
CVE-2026-84224Kirki WordPress plugin Editor+ blind SSRF via remote Template URL4.1CNA v3.10.2%2026-10-09Fix
CVE-2026-84220Kirki WordPress plugin unauthenticated arbitrary shortcode execution via comments Collection4.8CNA v3.10.1%2026-10-09Fix
CVE-2026-81929Ocean Pro Demos and Ocean eComm Treasure Box WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-09Fix
CVE-2026-79650Apache CXF: OIDC RP open redirect6.1CISA ADP v3.10.4%2026-10-09Fix
CVE-2026-79363Cloudron Branding Footer feature stored cross-site scripting5.9CISA ADP v3.10.2%2026-10-09
CVE-2026-78835Rocket Remote Desktop insufficiently protected credentials9.8CISA ADP v3.10.3%2026-10-09
CVE-2026-78797iStoreOS tasks-lib.lua vulnerability9.8CISA ADP v3.10.6%2026-10-09
CVE-2026-78796Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router upgrade file vulnerability9.8CISA ADP v3.10.5%2026-10-09
CVE-2026-78795Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router information disclosure7.5CISA ADP v3.10.5%2026-10-09
CVE-2026-78384Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (decompression bomb)7.5CISA ADP v3.10.4%2026-10-09Fix
CVE-2026-78341Dell Secure Connect Gateway (SCG) Policy Manager incorrect authorization6.5CNA v3.10.3%2026-10-09Fix
CVE-2026-78340Dell Secure Connect Gateway (SCG) Policy Manager path traversal6.3CNA v3.10.1%2026-10-09Fix
CVE-2026-78339Dell Secure Connect Gateway (SCG) Policy Manager incorrect permission assignment6.3CNA v3.10.1%2026-10-09Fix
CVE-2026-78027Dell Secure Connect Gateway (SCG) Policy Manager server-side request forgery5.8CNA v3.10.2%2026-10-09Fix
CVE-2026-78026Dell Secure Connect Gateway (SCG) Policy Manager insecure direct object reference4.3CNA v3.10.2%2026-10-09Fix
CVE-2026-78025Dell Secure Connect Gateway (SCG) Policy Manager missing authentication7.5CNA v3.10.4%2026-10-09Fix
CVE-2026-78024Dell Secure Connect Gateway (SCG) Policy Manager server-side request forgery7.7CNA v3.10.2%2026-10-09Fix
CVE-2026-78023Dell Secure Connect Gateway (SCG) Policy Manager insecure direct object reference7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-78022Dell Secure Connect Gateway (SCG) Policy Manager fail-open behavior6.8CNA v3.10.2%2026-10-09Fix
CVE-2026-78021Dell Secure Connect Gateway (SCG) Policy Manager information disclosure through error messages3.7CNA v3.10.2%2026-10-09Fix
CVE-2026-78020Dell Secure Connect Gateway (SCG) Policy Manager improper certificate validation7.5CNA v3.10.2%2026-10-09Fix
CVE-2026-78019Dell Secure Connect Gateway (SCG) Policy Manager inclusion of untrusted functionality7.5CNA v3.10.3%2026-10-09Fix
CVE-2026-78018Dell Secure Connect Gateway (SCG) Policy Manager insecure default initialization6.3CNA v3.10.1%2026-10-09Fix
CVE-2026-78017Dell Secure Connect Gateway (SCG) Policy Manager improper check for exceptional conditions3.8CNA v3.10.2%2026-10-09Fix
CVE-2026-78016Dell Secure Connect Gateway (SCG) Policy Manager improper type validation3.1CNA v3.10.2%2026-10-09Fix
CVE-2026-78015Dell Secure Connect Gateway (SCG) Policy Manager use of a less trusted source3.7CNA v3.10.1%2026-10-09Fix
CVE-2026-78013Dell Secure Connect Gateway (SCG) Policy Manager insecure default initialization5.2CNA v3.10.1%2026-10-09Fix
CVE-2026-76779Dell Secure Connect Gateway (SCG) Policy Manager missing brute-force protection7.4CNA v3.10.3%2026-10-09Fix
CVE-2026-76769Dell Secure Connect Gateway (SCG) Policy Manager missing authorization4.3CNA v3.10.2%2026-10-09Fix
CVE-2026-75597pyLoad webui vulnerability5.3CNA v3.10.3%2026-10-09Fix
CVE-2026-75353OpENer EtherNet/IP ForwardOpen connection-path parser out-of-bounds read7.5CISA ADP v3.10.3%2026-10-09
CVE-2026-75352OpENer EtherNet/IP ForwardOpen connection-path parser integer underflow7.5CISA ADP v3.10.3%2026-10-09
CVE-2026-75351OpENer EtherNet/IP ForwardOpen connection-path parser out-of-bounds read7.5CISA ADP v3.10.4%2026-10-09
CVE-2026-75350EIPStackGroup OpENer GetAttributeList implementation buffer overflow7.5CNA v3.10.5%2026-10-09
CVE-2026-75349EIPStackGroup OpENer Connection Manager request parsing out-of-bounds read7.5CNA v3.10.5%2026-10-09
CVE-2026-75348EIPStackGroup OpENer EtherNet/IP TCP SendRRData Common Packet Format parser out-of-bounds read7.5CNA v3.10.5%2026-10-09
CVE-2026-75347EIPStackGroup OpENer EtherNet/IP Common Packet Format handling logic vulnerability7.5CNA v3.10.4%2026-10-09
CVE-2026-75346EIPStackGroup OpENer v2.3 and master out-of-bounds read7.5CISA ADP v3.10.5%2026-10-09
CVE-2026-75345OpENer unconnected explicit messaging path out-of-bounds read7.5CNA v3.10.5%2026-10-09
CVE-2026-73179Apache CXF: JPA authorization-code consume is non-atomic8.1CISA ADP v3.10.4%2026-10-09Fix
CVE-2026-71884Bouncy Castle BC-LTS-JAVA native one-shot CTR packet cipher nonce reuse8.2CNA v4.00.4%2026-10-09Fix
CVE-2026-71575Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter9.1CISA ADP v3.10.4%2026-10-09Fix
CVE-2026-62376Vikunja user_tokens table cleartext storage of sensitive information8.1CNA v3.10.2%2026-10-09Fix
CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover7.5CNA v4.00.1%2026-10-09Fix
CVE-2026-62049JetBlocks For Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-62042Scripts n Styles WordPress plugin broken access control5.3CNA v3.10.2%2026-10-09
CVE-2026-62041WP Event Manager WordPress plugin broken access control5.4CNA v3.10.1%2026-10-09
CVE-2026-62040Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.5.3CNA v3.10.2%2026-10-09Fix
CVE-2026-62039Html5 Audio Player WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-09
CVE-2026-62036All Bootstrap Blocks WordPress plugin sensitive data exposure4.3CNA v3.10.2%2026-10-09
CVE-2026-62029WPFunnels WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-09
CVE-2026-62028Before After Image Comparison Image comparison for WP WordPress plugin broken access control5.4CNA v3.10.1%2026-10-09
CVE-2026-62026Dashboard Notes WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2026-10-09
CVE-2026-57458Vikunja: Scoped API token can mint unrestricted OAuth session credentials8.1CNA v3.10.3%2026-10-09Fix
CVE-2026-55797argoproj argo-cd argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL8.8CNA v3.11.5%2026-10-09Fix
CVE-2026-48484pyLoad: Lack of Input Size Validation leads to denial of service (DoS) and Process Termination6.5CNA v3.10.3%2026-10-09Fix
CVE-2026-42695FV Flowplayer Video Player WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-09Fix
CVE-2026-39779Asgaros Forum WordPress plugin broken access control4.3CNA v3.10.2%2026-10-09
CVE-2026-39460Red Lion Controls N-Tron 700 Series insufficiently protected credentials9.3CNA v4.00.3%2026-10-09Fix
CVE-2026-39453Red Lion Controls N-Tron 700 Series reachable assertion8.5CNA v4.00.3%2026-10-09Fix
CVE-2026-33367Red Lion Controls N-Tron 700 Series missing authentication for critical function9.3CNA v4.00.3%2026-10-09Fix
CVE-2026-33272Red Lion Controls N-Tron 700 Series authentication bypass using an alternate path or channel6.8CNA v4.00.2%2026-10-09Fix
CVE-2026-32645Red Lion Controls N-Tron 700 Series use of hard-coded credentials9.2CNA v4.00.1%2026-10-09Fix
CVE-2026-29797Red Lion Controls N-Tron 700 Series download of code without integrity check8.4CNA v4.00.2%2026-10-09Fix
CVE-2026-28745Red Lion Controls N-Tron 700 Series storing passwords in a recoverable format9.3CNA v4.00.2%2026-10-09Fix
CVE-2026-22061Debug Log information disclosure vulnerability in Trident8.2CNA v4.00.1%2026-10-09Fix
CVE-2026-19575zephyrproject zephyr device_deinit system call type confusion7.8CNA v3.10.1%2026-10-09
CVE-2026-19574zephyrproject zephyr ARM64 MMU back-end improper access control7.0CNA v3.10.1%2026-10-09
CVE-2026-19571zephyrproject zephyr ITE IT8xxx2 SHI host-command backend race condition6.7CNA v3.10.1%2026-10-09Fix
CVE-2026-19570zephyrproject zephyr LE Audio Broadcast Sink out-of-bounds write8.8CNA v3.10.3%2026-10-09
CVE-2026-19569zephyrproject zephyr kernel userspace integer overflow8.8CNA v3.10.1%2026-10-09
CVE-2026-15340Savannah lwIP SMTP client Classic buffer overflow9.3CNA v4.00.6%2026-10-09Fix
CVE-2026-8374SwitchBot Lock Series Bluetooth communication vulnerability8.5CNA v4.00.1%2026-10-09
CVE-2026-7827Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB9.2CNA v4.00.6%2026-10-09Fix
CVE-2026-7826Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB8.8CNA v4.00.4%2026-10-09Fix
CVE-2026-5759Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution9.3CNA v4.00.6%2026-10-09Fix
CVE-2026-4264Reflected cross-site scripting in BeeTienda eCommerce platform5.1CNA v4.00.3%2026-10-09Fix
CVE-2026-107831Jivejdon CSRF via GET-based Account and Thread Actions5.3CNA v4.00.2%2026-10-08
CVE-2026-107830Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS endpoint6.9CNA v4.00.4%2026-10-08
CVE-2026-107829Jivejdon Unsalted MD5 Password Storage via AccountDaoSql8.2CNA v4.00.2%2026-10-08
CVE-2026-107828Jivejdon Predictable Passwords via Sina Weibo OAuth Login6.9CNA v4.00.3%2026-10-08
CVE-2026-107802SumatraPDF Windows command-line argument injection in AI selection-translate7.1CNA v4.00.1%2026-10-08
CVE-2026-107801Jivejdon stored XSS via Attachment Upload Content-Type5.1CNA v4.00.2%2026-10-08
CVE-2026-107800Jivejdon stored XSS via Private Short messages5.1CNA v4.00.3%2026-10-08
CVE-2026-107799Jivejdon stored XSS via messageListBody.jsp Forum Message Rendering5.1CNA v4.00.2%2026-10-08
CVE-2026-107798Jivejdon through commit ee67a65e stored XSS via Markdown Links in TextStyle Rendering Filter5.1CNA v4.00.2%2026-10-08
CVE-2026-107797Jivejdon reflected XSS via postThread.jsp to and tag parameters5.3CNA v4.00.2%2026-10-08
CVE-2026-107796Jivejdon through commit ee67a65e reflected XSS via taggedThreadList.jsp tagID and count parameters5.3CNA v4.00.3%2026-10-08
CVE-2026-107793Jivejdon IDOR via subSaveAction Subscription Delete5.3CNA v4.00.3%2026-10-08
CVE-2026-107792Jivejdon through commit ee67a65e missing authorization via /message/threadToForum/save Thread Move5.3CNA v4.00.2%2026-10-08
CVE-2026-107782System Informer incorrect authorization in phsvc ALPC Port8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-107781Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById9.1CNA v4.00.3%2026-10-08
CVE-2026-107780Dromara Skyeye Unauthenticated OS command injection via textToSpeech format parameter9.3CNA v4.02.1%2026-10-08
CVE-2026-107779Dromara Skyeye xxl-job-admin missing authentication on Job endpoints allows RCE9.3CNA v4.00.5%2026-10-08
CVE-2026-107778MIT krb5 null pointer dereference via krb5_rd_cred7.1CNA v4.00.4%2026-10-08Fix
CVE-2026-107738SumatraPDF: Untrusted binary record offset used without lower-bound validation6.8CNA v4.00.1%2026-10-08
CVE-2026-107737SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup5.7CNA v4.00.1%2026-10-08
CVE-2026-107736SumatraPDF: Stack buffer overflow while processing EXIF Orientation metadata6.8CNA v4.00.1%2026-10-08
CVE-2026-107735SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)5.4CNA v4.00.1%2026-10-08
CVE-2026-107734SumatraPDF: SyncTeX argument injection in Inverse Search enables arbitrary command execution7.1CNA v4.00.1%2026-10-08
CVE-2026-107733SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open6.8CNA v4.00.1%2026-10-08
CVE-2026-107732SumatraPDF: Markup/command-link injection into UI notification text8.4CNA v4.00.1%2026-10-08
CVE-2026-107731SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service5.5CNA v3.10.1%2026-10-08
CVE-2026-107730SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read5.5CNA v3.10.1%2026-10-08
CVE-2026-107729SumatraPDF MOBI parsing out-of-bounds read5.5CNA v3.10.1%2026-10-08
CVE-2026-107728Strawberry GraphQL PermissionExtension incorrect authorization7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107727Strawberry legacy graphql-ws retains naturally completed subscription slots3.7CNA v3.10.4%2026-10-08Fix
CVE-2026-107726Hazelcast: Arbitrary member memory access by low-privileged client9.3CNA v4.00.4%2026-10-08Fix
CVE-2026-107725Hazelcast: Authorization bypass in IMap Predicates API8.7CNA v4.00.4%2026-10-08Fix
CVE-2026-107724fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery7.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107723nearform fast-jwt createVerifier improper type validation8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-107722nearform fast-jwt src/crypto.js improper signature verification9.8CNA v3.10.3%2026-10-08Fix
CVE-2026-107721fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-107720nearform fast-jwt createVerifier improper signature verification7.4CNA v3.10.3%2026-10-08Fix
CVE-2026-107719nearform fast-jwt verifier cache insufficient session expiration4.2CNA v3.10.2%2026-10-08Fix
CVE-2026-107718AdonisJS: Unencoded route parameters can produce open redirects6.1CNA v3.10.3%2026-10-08Fix
CVE-2026-107717Banks: User-controlled prompt input can be parsed as privileged chat messages6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107716Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry7.3CNA v4.00.1%2026-10-08Fix
CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirect6.8CNA v3.10.4%2026-10-08Fix
CVE-2026-107714Mechanize sends credential headers to a different scheme or port after a redirect5.9CNA v3.10.2%2026-10-08Fix
CVE-2026-107709Bower Decompress-Zip has a path traversal7.8CISA ADP v3.10.2%2026-10-08
CVE-2026-107708MIT krb5 KDC null pointer dereference via S4U2Proxy PAC6.9CNA v4.00.5%2026-10-08Fix
CVE-2026-107707Intego Antivirus local privilege escalation via Optimization Module Junction8.5CNA v4.00.1%2026-10-08
CVE-2026-107706Dolibarr incorrect authorization via updateextrafield.php5.3CNA v4.00.2%2026-10-08Fix
CVE-2026-107705Poppler stack buffer overflow via Decrypt::revision6Hash8.3CNA v4.00.3%2026-10-08Fix
CVE-2026-107704image_optimizer OS command injection via identify_format9.3CNA v4.01.7%2026-10-08
CVE-2026-107703@enmaso/node-convert OS command injection via filepath and convertTo9.3CNA v4.01.8%2026-10-08
CVE-2026-107702QloApps authorization bypass via id_hotel in Admin Room Booking5.3CNA v4.00.3%2026-10-08
CVE-2026-107701dot-access prototype pollution via set path argument8.8CNA v4.00.3%2026-10-08
CVE-2026-107700dot-access code injection via get Path argument9.3CNA v4.00.5%2026-10-08
CVE-2026-107699ppt2png OS command injection via input and output paths9.3CNA v4.01.5%2026-10-08
CVE-2026-107698FFmpeg and SSRF via RTSP Redirect Handling5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-107697FFmpeg HLS Demuxer Security Check Bypass via parse_playlist5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-107696FFmpeg infinite loop via RTSP Redirect Handling in rtsp.c7.1CNA v4.00.4%2026-10-08Fix
CVE-2026-107695FFmpeg HLS Demuxer infinite loop via Self-Referencing Playlist7.1CNA v4.00.5%2026-10-08Fix
CVE-2026-107678FFmpeg stack exhaustion via Recursive Free of pssh Boxes5.7CNA v4.00.1%2026-10-08Fix
CVE-2026-107677FFmpeg DASH Demuxer infinite loop via Empty SegmentTemplate Media5.7CNA v4.00.1%2026-10-08Fix
CVE-2026-107676FFmpeg uninitialized memory Disclosure via HDR10+ Metadata Serializer4.8CNA v4.00.1%2026-10-08Fix
CVE-2026-107675FFmpeg Missing SSH Host Key Verification in sftp protocol6.0CNA v4.00.2%2026-10-08Fix
CVE-2026-107660FFmpeg and mbedTLS Hostname Verification Bypass for IP Hosts6.3CNA v4.00.1%2026-10-08Fix
CVE-2026-107651Red Hat Enterprise Linux 6 eog: Eog: Arbitrary code execution5.5CNA v3.10.2%2026-10-08Fix
CVE-2026-107640Integrics Enswitch authentication bypass via Password Reset API9.3CNA v4.00.4%2026-10-08
CVE-2026-107639ILIAS,, and argument injection via Image Map Question Upload Filename8.7CNA v4.00.7%2026-10-08Fix
CVE-2026-107638pH7Builder 2FA brute force via VerificationCodeFormProcess.php7.6CNA v4.00.4%2026-10-08Fix
CVE-2026-107637pH7Builder improper authorization via Note module delete action5.3CNA v4.00.2%2026-10-08Fix
CVE-2026-107636pH7Builder Payment Bypass via Payment Module MainController7.1CNA v4.00.3%2026-10-08Fix
CVE-2026-107635Dislocker Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow6.9CNA v4.00.1%2026-10-08
CVE-2026-107634Dislocker Heap out-of-bounds read via BitLocker Metadata Dataset Size6.9CNA v4.00.1%2026-10-08
CVE-2026-107623Red Hat Keycloak OIDC Dynamic Client Registration missing authorization4.3CNA v3.10.2%2026-10-08
CVE-2026-107615DLL search order hijacking via screenhooks libraries in TightVNC Server7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-107614Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read6.1CNA v3.10.1%2026-10-08Fix
CVE-2026-107613Null pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-107612World-accessible IPC shared memory with predictable name in TightVNC Server7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-107611Out-of-bounds read in TightVNC Viewer ZRLE palette decoding7.1CNA v3.10.2%2026-10-08Fix
CVE-2026-107608Improper link resolution in asset bundling output handling in aws-cdk-lib6.8CNA v4.00.1%2026-10-08Fix
CVE-2026-107604Red Hat Keycloak installation provider and client registration endpoints information disclosure4.9CNA v3.10.2%2026-10-08
CVE-2026-107589Authentication bypass by spoofing in Jacamar CI7.5CNA v3.10.1%2026-10-08Fix
CVE-2026-107587Improper certificate validation in hMailServer5.9CNA v3.10.2%2026-10-08Fix
CVE-2026-107586Allocation of resources without limits or throttling in hMailServer4.3CNA v3.10.3%2026-10-08Fix
CVE-2026-107585Allocation of resources without limits or throttling in hMailServer5.3CNA v3.10.4%2026-10-08Fix
CVE-2026-107584Not failing securely (Failing Open) in hMailServer7.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107583Inefficient algorithmic complexity in hMailServer6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107582Inefficient algorithmic complexity in hMailServer6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107581Inefficient algorithmic complexity in hMailServer6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-107580Inefficient algorithmic complexity in hMailServer6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107579Inefficient algorithmic complexity in hMailServer7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107578Improper link resolution before file access (link following) in hMailServer6.7CNA v3.10.1%2026-10-08Fix
CVE-2026-107577Loop with unreachable exit condition (infinite loop) in hMailServer7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107576Inefficient algorithmic complexity in hMailServer7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107575Inefficient algorithmic complexity in hMailServer5.3CNA v3.10.4%2026-10-08Fix
CVE-2026-107574Inefficient algorithmic complexity in hMailServer7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107573Incorrect default permissions in hMailServer7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-107572Inefficient regular expression complexity in hMailServer6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107570mutt convert_file_from_to out-of-bounds write2.5CNA v3.10.1%2026-10-08Fix
CVE-2026-107565Red Hat Enterprise Linux 10 improper quantity validation5.1CNA v3.10.1%2026-10-08
CVE-2026-107510Authenticated argument injection in NIOS command line leading to privilege escalation9.1CNA v3.10.3%2026-10-08
CVE-2026-107503Eclipse Ditto Ditto Explorer UI external control of a configuration setting7.1CNA v4.00.2%2026-10-08Fix
CVE-2026-107466Red Hat Enterprise Linux 10 flatpak-builder: Local file exfiltration via `file6.1CNA v3.10.2%2026-10-08Fix
CVE-2026-107459Openfind｜SecuShare Pro OS command injection9.3CNA v4.01.5%2026-10-08
CVE-2026-107450stumpapp Stump incorrect authorization5.4CNA v3.10.2%2026-10-08
CVE-2026-107449LinuxServer Heimdall server-side request forgery3.4CNA v3.10.2%2026-10-08
CVE-2026-107448Wizards of the Coast Magic: The Gathering Arena resource injection3.4CNA v3.10.1%2026-10-08
CVE-2026-107446containerd overlaybd integer overflow6.8CNA v3.10.4%2026-10-08
CVE-2026-107445Red Hat Satellite 6 Katello Flatpak Remote Repositories API authorization bypass5.4CNA v3.10.2%2026-10-08
CVE-2026-107444Red Hat Satellite 6 Katello Docker Tags repositories API authorization bypass4.3CNA v3.10.2%2026-10-08
CVE-2026-107406NetScaler ADC memory overflow vulnerability leading to remote code execution or denial of service9.5CNA v4.00.5%2026-10-08Fix
CVE-2026-107399Mechanize sends credential headers to another origin after a meta refresh6.8CNA v3.10.4%2026-10-08Fix
CVE-2026-107397Indico: Cross-site-scripting in minutes editor4.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107396Indico: Cross-site-scripting in link fields5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107395Indico: Missing access check in legacy session export API4.3CNA v3.10.2%2026-10-08Fix
CVE-2026-107394Indico: Incomplete server-side request forgery (SSRF) check6.8CNA v3.10.3%2026-10-08Fix
CVE-2026-107393FreeScout: Stored HTML injection in Administrator Alert Emails via Spoofed CF-Connecting-IP header6.1CNA v3.10.2%2026-10-08Fix
CVE-2026-107392Borewit music-metadata DSF parser vulnerability6.2CNA v3.10.4%2026-10-08Fix
CVE-2026-107391Borewit music-metadata MP4 stsd sample-description parser denial of service6.2CNA v3.10.3%2026-10-08Fix
CVE-2026-107390Borewit music-metadata MP4 parser denial of service6.2CNA v3.10.3%2026-10-08Fix
CVE-2026-107389Borewit music-metadata EBML parser denial of service6.2CNA v3.10.1%2026-10-08Fix
CVE-2026-107388Borewit music-metadata ID3v2 parser denial of service6.2CNA v3.10.1%2026-10-08Fix
CVE-2026-107387Borewit music-metadata APEv2 parser vulnerability6.2CNA v3.10.2%2026-10-08Fix
CVE-2026-107386rabbitmq amqp091-go resource exhaustion6.3CNA v4.00.5%2026-10-08Fix
CVE-2026-107385MariaDB Corporation MariaDB Connector/Node.js text protocol SQL injection7.4CNA v3.10.4%2026-10-08Fix
CVE-2026-107384mariadb-corporation mariadb-connector-nodejs MariaDB Connector/Node.js: SQL injection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-107383MariaDB Connector/Node.js GeoJSON binary encoders information disclosure7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107382MariaDB Corporation MariaDB Connector/Node.js Ed25519PasswordAuth uncaught exception5.9CNA v3.10.2%2026-10-08Fix
CVE-2026-107380darylldoyle svg-sanitizer enshrined/svg-sanitize: Stored XSS5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107379darylldoyle svg-sanitizer enshrined/svg-sanitize: Denial of service6.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107378Kozea CairoSVG path tokenizer denial of service8.7CNA v4.00.4%2026-10-08Fix
CVE-2026-107377datamodel-code-generator protobuf parser path traversal7.5CNA v3.10.5%2026-10-08Fix
CVE-2026-107376webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input8.2CNA v3.10.4%2026-10-08Fix
CVE-2026-107375JHipster: SQL injection in the parameter of JHipster-Generated Reactive Applicationssort8.8CNA v3.10.3%2026-10-08Fix
CVE-2026-107362Server-side request forgery in Malcolm7.1CNA v3.10.3%2026-10-08Fix
CVE-2026-107361Authentication bypass using an alternate path or channel in Malcolm4.2CNA v3.10.2%2026-10-08Fix
CVE-2026-107337Cross-site request forgery in Malcolm7.1CNA v3.10.1%2026-10-08Fix
CVE-2026-107336Authentication bypass by spoofing in Malcolm6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-107335Improper Handling of Highly Compressed Data in Malcolm6.5CNA v3.10.5%2026-10-08Fix
CVE-2026-107334Incorrect authorization in Malcolm5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-107333Incorrect authorization in Malcolm8.1CNA v3.11.0%2026-10-08Fix
CVE-2026-107332Insecure default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code6.8CNA v4.00.1%2026-10-08Fix
CVE-2026-107325Application denial of service via missing BSON array length validation in MongoDB Go Driver8.2CNA v4.00.2%2026-10-08Fix
CVE-2026-107324MongoDB Go Driver BSON value-length handling in the MongoDB integer overflow8.2CNA v4.00.2%2026-10-08Fix
CVE-2026-107322OS command injection in Amazon agent plugins for AWS databases-on-aws8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-107318@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports7.4CNA v3.10.1%2026-10-08Fix
CVE-2026-107303JHipster: Generated Applications allow stored XSS7.6CNA v3.10.3%2026-10-08Fix
CVE-2026-107302mcollina msgpack5 decoder out-of-bounds read7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107301mcollina msgpack5 prototype pollution6.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107300mcollina msgpack5 streaming decoder uncontrolled recursion7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107299mcollina msgpack5 streaming decoder vulnerability5.9CNA v3.10.4%2026-10-08Fix
CVE-2026-107298mcollina msgpack5 decoder denial of service5.3CNA v3.10.4%2026-10-08Fix
CVE-2026-107297mcollina msgpack5 streaming decoder vulnerability5.9CNA v3.10.4%2026-10-08Fix
CVE-2026-107296mcollina msgpack5 modification of assumed-immutable data3.7CNA v3.10.3%2026-10-08Fix
CVE-2026-107295pydantic-ai web UI chat endpoint cross-site request forgery7.6CNA v3.10.2%2026-10-08Fix
CVE-2026-107294Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl6.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107293pydantic-ai OpenTelemetry instrumentation information disclosure2.3CNA v4.00.3%2026-10-08Fix
CVE-2026-107292Pydantic AI Web chat UI: The local chat endpoint does not validate the `Host` header6.4CNA v3.10.1%2026-10-08Fix
CVE-2026-107291pydantic-ai OpenTelemetry instrumentation information disclosure2.3CNA v4.00.5%2026-10-08Fix
CVE-2026-107290Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`6.5CNA v3.10.4%2026-10-08Fix
CVE-2026-107289Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for and)6.8CNA v3.10.3%2026-10-08Fix
CVE-2026-107288pydantic-ai web_fetch_tool server-side request forgery3.7CNA v3.10.4%2026-10-08Fix
CVE-2026-107287Pydantic AI: Excessive resource use when local web fetching converts nested HTML6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-107286Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early7.5CNA v3.10.5%2026-10-08Fix
CVE-2026-107275@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed6.8CNA v3.10.3%2026-10-08Fix
CVE-2026-106611Forminator WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2026-10-08Fix
CVE-2026-106603HollerBox WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-106600GiveWP WordPress plugin broken access control5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-106596Visual Composer Website Builder WordPress plugin broken access control5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-106438Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver5.1CNA v4.00.1%2026-10-08Fix
CVE-2026-106437Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver5.9CNA v4.00.1%2026-10-08Fix
CVE-2026-106436MongoDB PHP Driver BSON encoder denial of service6.3CNA v4.00.3%2026-10-08Fix
CVE-2026-106435Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver5.9CNA v4.00.1%2026-10-08Fix
CVE-2026-106434Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt5.3CNA v4.00.1%2026-10-08Fix
CVE-2026-106433Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt8.7CNA v4.00.3%2026-10-08Fix
CVE-2026-106432Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver2.0CNA v4.00.2%2026-10-08Fix
CVE-2026-106431One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver5.9CNA v4.00.1%2026-10-08Fix
CVE-2026-106430Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver6.0CNA v4.00.2%2026-10-08Fix
CVE-2026-106429Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt7.1CNA v4.00.3%2026-10-08Fix
CVE-2026-106428Out-of-bounds read in SCRAM response parsing in MongoDB C Driver6.3CNA v4.00.2%2026-10-08Fix
CVE-2026-106177HP Sure Click Kernel buffer overflow6.4CNA v3.10.1%2026-10-08Fix
CVE-2026-106126Tenable Identity Exposure (SaaS) command injection9.4CNA v4.02.0%2026-10-08Fix
CVE-2026-105893Event Tickets WordPress plugin broken access control5.3CNA v3.10.3%2026-10-08Fix
CVE-2026-105891Event Tickets WordPress plugin broken access control4.3CNA v3.10.2%2026-10-08Fix
CVE-2026-105890Gutenberg Blocks by Kadence Blocks WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-105888Event Tickets WordPress plugin broken access control5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-105887Robo Gallery WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-105886Ultimate Post Kit WordPress plugin broken access control6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-105878YITH WooCommerce Product Bundles WordPress plugin broken access control5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-105833EspoCRM IDOR via PersonalAccount service exposes IMAP Passwords8.3CNA v4.00.2%2026-10-08Fix
CVE-2026-105832EspoCRM Two-Factor authentication bypass on Unauthenticated Routes5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-105831EspoCRM unauthenticated stored HTML injection via lead Capture form5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-105830League/commonmark Quadratic DoS via TableStartParser8.7CNA v4.00.4%2026-10-08Fix
CVE-2026-105829League CommonMark stored XSS via DisallowedRawHtml Bypass5.3CNA v4.00.2%2026-10-08Fix
CVE-2026-105828parse-community parse-server Parse Server Class Name Disclosure via GraphQL Errors6.3CNA v4.00.3%2026-10-08Fix
CVE-2026-105674Predictable Media Stream Pre-Shared Key vulnerability in TP-Link Tapo C325WB8.7CNA v4.00.2%2026-10-08Fix
CVE-2026-105673Unauthenticated RTSP Tunnel denial of service vulnerability in TP-Link Tapo C325WB7.1CNA v4.00.2%2026-10-08Fix
CVE-2026-105672Unauthenticated JSON API authorization bypass vulnerability in TP-Link Tapo C325WB8.7CNA v4.00.2%2026-10-08Fix
CVE-2026-105570Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host6.7CNA v4.00.1%2026-10-08Fix
CVE-2026-105452Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts5.9CNA v4.00.1%2026-10-08Fix
CVE-2026-105436MainWP Child WordPress plugin deserialization of untrusted data8.8CNA v3.10.3%2026-10-08Fix
CVE-2026-105331Checkmk mk-oracle: Local privilege escalation via malicious Oracle Instant client5.2CNA v4.00.1%2026-10-08Fix
CVE-2026-105275Satel Netco Design relative path traversal5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-105269Satel Netco Design cross-site scripting8.5CNA v4.00.4%2026-10-08Fix
CVE-2026-105260Database Addon For WPForms WordPress plugin arbitrary form Entry deletion via CSRF4.3CISA ADP v3.10.1%2026-10-08Fix
CVE-2026-105198Appointment Booking Plugin information disclosure5.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-105197Appointment Booking Plugin incorrect authorization2.7CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-105196Appointment Booking Plugin Abilities API information disclosure3.3CISA ADP v3.10.1%2026-10-08Fix
CVE-2026-105195Booking Calendar - Editor+ arbitrary Option Disclosure2.7CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-105194Easy Digital Downloads WordPress plugin sensitive information disclosure4.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-105193Booking Calendar WordPress plugin unauthenticated Booking information disclosure and modification4.8CISA ADP v3.10.1%2026-10-08Fix
CVE-2026-105190Easy Digital Downloads WordPress plugin unauthenticated account creation with Registration Disabled5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-105110Iskratel Innbox unauthenticated remote code execution via login.xgi CLI parameter9.3CNA v4.02.8%2026-10-08
CVE-2026-105079MasterStudy LMS WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-105078WP Store Locator WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-105076Vitepos WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-08Fix
CVE-2026-104704Cleartext transmission of sensitive information in hMailServer7.4CNA v3.10.2%2026-10-08Fix
CVE-2026-104671TutorStarter WordPress theme unauthenticated user Registration bypass via AJAX5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-104660Missing authorization in hMailServer7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-104659Origin validation error in hMailServer7.5CNA v3.10.1%2026-10-08Fix
CVE-2026-104658Reliance on untrusted inputs in a security decision in hMailServer7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-104646Image Photo Gallery Final Tiles Grid WordPress plugin stored XSS6.8CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-104645Image Photo Gallery Final Tiles Grid plugin incorrect authorization2.7CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-104634ScriptKittyOS beam_mcp BeamMCP.Server incorrect type conversion2.3CNA v4.00.3%2026-10-08Fix
CVE-2026-104628Satel Netco Design inefficient regular expression complexity7.1CNA v4.00.3%2026-10-08Fix
CVE-2026-104078Obsidian Desktop RCE via MathJax Safe Filter Bypass8.4CNA v4.00.2%2026-10-08Fix
CVE-2026-104077Obsidian Desktop RCE via Slides Plugin Markdown8.5CNA v4.00.3%2026-10-08Fix
CVE-2026-104076TVU Networks Receiver/Transceiver missing authentication via REST API9.3CNA v4.00.4%2026-10-08Fix
CVE-2026-104075TVU Networks Receiver/Transceiver authentication bypass via /tvu/Login9.3CNA v4.00.6%2026-10-08Fix
CVE-2026-103692Frontend Dashboard - unauthenticated privilege escalation via arbitrary Function Call9.8CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-103663Path traversal leading to remote code execution in Ollama6.9CNA v4.00.7%2026-10-08Fix
CVE-2026-103649Synchronous Access of Remote Resource without Timeout in hMailServer7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-103647Improper neutralization of input during web page generation (cross-site scripting) in hMailServer8.0CNA v3.10.2%2026-10-08Fix
CVE-2026-103646Ultimate Multisite WordPress plugin unauthenticated authentication bypass9.8CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-103517Airwallex Online Payments Gateway WordPress plugin unauthenticated Payment bypass via Forged Webhook5.3CNA v3.10.1%2026-10-08Fix
CVE-2026-103309GPTranslate WordPress plugin unauthenticated stored XSS via REST API Translation Storage7.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-103072VillaTheme Core WordPress plugin broken access control4.3CNA v3.10.2%2026-10-08Fix
CVE-2026-103070ShortPixel Image Optimizer WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-103011Heap-based buffer overflow in hMailServer6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-103010Heap-based buffer overflow in hMailServer7.8CNA v3.10.2%2026-10-08Fix
CVE-2026-102784Joomla extension balbooa.com CSRF in language installation feature Gridbox8.7CNA v4.00.2%2026-10-08
CVE-2026-102783Joomla extension balbooa.com path traversal in image preview Gridbox6.3CNA v4.00.5%2026-10-08
CVE-2026-102488Octopus Deploy Octopus Server incorrect authorization8.7CNA v4.00.2%2026-10-08Fix
CVE-2026-102368Plaintext storage of a Device-Specific Private Key in Tapo S505 firmware5.4CNA v4.00.1%2026-10-08Fix
CVE-2026-101998Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials5.9CNA v4.00.2%2026-10-08Fix
CVE-2026-101024Satel Netco Design relative path traversal8.7CNA v4.00.4%2026-10-08Fix
CVE-2026-97147OpenStack Mistral incorrect authorization7.2CNA v4.00.3%2026-10-08Fix
CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/http7.5CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-97031Go standard library crypto/tls resource amplification7.5CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-97030Recognize yield as regexp preceder keyword in html/template6.1CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-96207Microsoft Partner Center elevation of privilege10.0CNA v3.10.5%2026-10-08Fix
CVE-2026-95210gnutls v3.8.13 improper certificate validation4.8CISA ADP v3.10.1%2026-10-08
CVE-2026-95209An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).5.9CISA ADP v3.10.2%2026-10-08
CVE-2026-95208An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority certificates, leading to valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS7.5CISA ADP v3.10.2%2026-10-08
CVE-2026-95184gnutls v3.8.13 improper certificate validation5.9CISA ADP v3.10.2%2026-10-08
CVE-2026-95125libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.6.5CISA ADP v3.10.3%2026-10-08
CVE-2026-95116An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.7.5CISA ADP v3.10.4%2026-10-08
CVE-2026-94587Brocade Fabric OS buffer overflow6.9CNA v4.00.2%2026-10-08Fix
CVE-2026-94586Brocade Fabric OS command injection8.5CNA v4.01.4%2026-10-08Fix
CVE-2026-94585Brocade Fabric OS web management interface authentication bypass7.7CNA v4.00.2%2026-10-08Fix
CVE-2026-94584Brocade Fabric OS web management daemon race condition2.1CNA v4.00.1%2026-10-08Fix
CVE-2026-94583Brocade Fabric OS race condition2.1CNA v4.00.1%2026-10-08Fix
CVE-2026-94582Brocade Fabric OS memory buffer overflow6.8CNA v4.00.1%2026-10-08Fix
CVE-2026-94581Brocade Fabric OS REST API management interface OS command injection8.5CNA v4.01.5%2026-10-08Fix
CVE-2026-94580Brocade Fabric OS path traversal5.7CNA v4.00.2%2026-10-08Fix
CVE-2026-94579Brocade Fabric OS PAM OS command injection5.4CNA v4.03.1%2026-10-08Fix
CVE-2026-94578Brocade Fabric OS improper privilege management7.5CNA v4.00.4%2026-10-08Fix
CVE-2026-94577Brocade Fabric OS internal Command-Line interface privilege escalation7.3CNA v4.00.1%2026-10-08Fix
CVE-2026-94576Brocade Fabric OS authentication bypass5.9CNA v4.00.4%2026-10-08Fix
CVE-2026-94575A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for th6.9CNA v4.00.2%2026-10-08Fix
CVE-2026-94510Microsoft Bookings elevation of privilege9.9CNA v3.10.4%2026-10-08Fix
CVE-2026-94448Reset context tracking on consecutive template expressions in html/template6.1CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-94447Checksum database bypass for golang.org/toolchain in cmd/go7.8CISA ADP v3.10.1%2026-10-08Fix
CVE-2026-94444Checksum bypass for golang.org/fips140 in cmd/go7.8CISA ADP v3.10.1%2026-10-08Fix
CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart7.5CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http7.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-94275Track Orders for WooCommerce WordPress plugin unauthenticated PII disclosure via email parameter5.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-94258SMS Alert - Admin+ Network User Billing Phone Disclosure via Bulk User Actions2.7CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-94246Wallet System for WooCommerce - Subscriber+ Forged Wallet Withdrawal request via IDOR6.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-94245Wallet System for WooCommerce - Subscriber+ arbitrary Wallet Balance Theft via IDOR6.5CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-94244Wallet System for WooCommerce WordPress plugin Store-Wide Wallet Transaction disclosure via export4.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-93861OpenStack Mistral incorrect authorization6.0CNA v4.00.3%2026-10-08Fix
CVE-2026-93860OpenStack Mistral missing authorization7.1CNA v4.00.3%2026-10-08Fix
CVE-2026-93858OpenStack Mistral OS command injection8.7CNA v4.00.4%2026-10-08Fix
CVE-2026-93699WebPros WP Toolkit argument injection8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-93509Wallet System for WooCommerce - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-93034SGLang ZMQ message decoder deserialization of untrusted data9.8CISA ADP v3.10.5%2026-10-08
CVE-2026-93017Red Hat OpenShift Container Platform insights-operator improper privilege management7.7CNA v3.10.3%2026-10-08Fix
CVE-2026-92862The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.4.6CNA v4.00.1%2026-10-08
CVE-2026-92861Wavedash Ticket Ryutsu Center hard-coded credentials5.1CNA v4.00.1%2026-10-08
CVE-2026-92555Database credentials disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel9.8CNA v3.10.4%2026-10-08Exploit codeFix
CVE-2026-91844Remote code execution via unrestricted file upload in İzometri Informatics' eimzamip7.3CNA v3.10.2%2026-10-08Fix
CVE-2026-89290HTML injection in İzometri Informatics' eimzamip3.5CNA v3.10.2%2026-10-08Fix
CVE-2026-89191Stored cross-site scripting in SQLView KRIS6.8CNA v3.10.2%2026-10-08
CVE-2026-89091Red Hat ansible-core ansible-galaxy collection install arbitrary file write8.8CNA v3.10.5%2026-10-08Fix
CVE-2026-88648GnuTLS X.509 implementation vulnerability3.7CISA ADP v3.10.2%2026-10-08
CVE-2026-88647A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.6.5CISA ADP v3.10.2%2026-10-08
CVE-2026-88257ScriptKittyOS beam_mcp BeamMCP.Schema improper input validation5.3CNA v4.00.3%2026-10-08Fix
CVE-2026-88131Microsoft Dataverse remote code execution9.8CNA v3.10.8%2026-10-08Fix
CVE-2026-87980Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection3.1CNA v3.10.2%2026-10-08Fix
CVE-2026-87726NxpNfcRdLib out-of-bounds write3.9CNA v3.10.1%2026-10-08Fix
CVE-2026-87688Brocade Fabric OS command injection8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-87687Brocade Fabric OS argument injection8.5CNA v4.00.2%2026-10-08Fix
CVE-2026-87686Brocade Fabric OS authentication bypass by spoofing5.3CNA v4.00.2%2026-10-08Fix
CVE-2026-87685Brocade Fabric OS external control of a file path8.4CNA v4.00.2%2026-10-08Fix
CVE-2026-87684Brocade Fabric OS SNMP daemon request handling stack-based buffer overflow8.7CNA v4.00.6%2026-10-08Fix
CVE-2026-87683Brocade Fabric OS REST API management component stack-based buffer overflow8.6CNA v4.00.5%2026-10-08Fix
CVE-2026-87682Brocade Fabric OS OS command injection8.6CNA v4.01.7%2026-10-08Fix
CVE-2026-87681Brocade Fabric OS improper privilege management7.1CNA v4.00.2%2026-10-08Fix
CVE-2026-87680Brocade Fabric OS REST API management interface command injection8.5CNA v4.01.9%2026-10-08Fix
CVE-2026-87679Brocade Fabric OS heap-based buffer overflow8.5CNA v4.00.4%2026-10-08Fix
CVE-2026-87678Brocade Fabric OS CRLF injection6.9CNA v4.00.2%2026-10-08Fix
CVE-2026-87677Brocade Fabric OS account management subsystem OS command injection5.4CNA v4.00.6%2026-10-08Fix
CVE-2026-87676Brocade Fabric OS security library component stack-based buffer overflow6.9CNA v4.00.1%2026-10-08Fix
CVE-2026-87675Brocade Fabric OS configuration management subsystem OS command injection7.3CNA v4.00.7%2026-10-08Fix
CVE-2026-87674Brocade Fabric OS system logging daemon local privilege escalation8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-87673Brocade Fabric OS maintenance command-line diagnostic utilities OS command injection7.0CNA v4.01.8%2026-10-08Fix
CVE-2026-87672Brocade Fabric OS SupportLink diagnostic collection utilities information disclosure6.8CNA v4.00.1%2026-10-08Fix
CVE-2026-87671Brocade Fabric OS out-of-bounds read7.1CNA v4.00.4%2026-10-08Fix
CVE-2026-87670Brocade Fabric OS authentication bypass by spoofing5.1CNA v4.00.2%2026-10-08Fix
CVE-2026-87669Brocade Fabric OS missing authorization5.1CNA v4.00.2%2026-10-08Fix
CVE-2026-87668Brocade Fabric OS diagnostic execution utility stack-based buffer overflow6.9CNA v4.00.4%2026-10-08Fix
CVE-2026-87667Brocade Fabric OS configuration management command-line utility argument injection8.4CNA v4.00.2%2026-10-08Fix
CVE-2026-87666Brocade Fabric OS time and zone management subsystem OS command injection8.6CNA v4.02.6%2026-10-08Fix
CVE-2026-87665Brocade Fabric OS Internet Key Exchange stack-based buffer overflow6.0CNA v4.00.8%2026-10-08Fix
CVE-2026-87664Brocade Fabric OS missing authentication8.5CNA v4.00.1%2026-10-08Fix
CVE-2026-87663Brocade Fabric OS inter-switch remote execution service authentication bypass7.1CNA v4.00.7%2026-10-08Fix
CVE-2026-87662Brocade Fabric OS OS command injection7.0CNA v4.00.3%2026-10-08Fix
CVE-2026-87661Brocade Fabric OS CRLF injection6.8CNA v4.00.2%2026-10-08Fix
CVE-2026-87660Brocade Fabric OS incorrect permission assignment7.0CNA v4.00.1%2026-10-08Fix
CVE-2026-87659Brocade Fabric OS Management Server handling authorization bypass7.1CNA v4.00.2%2026-10-08Fix
CVE-2026-87428Brocade Active Support Connectivity Gateway insufficiently protected credentials8.4CNA v4.00.1%2026-10-08Fix
CVE-2026-87426Brocade Active Support Connectivity Gateway information disclosure5.3CNA v4.00.1%2026-10-08Fix
CVE-2026-87425Brocade Active Support Connectivity Gateway improper certificate validation7.6CNA v4.00.1%2026-10-08Fix
CVE-2026-87424Brocade Active Support Connectivity Gateway hard-coded cryptographic key8.6CNA v4.00.2%2026-10-08Fix
CVE-2026-86828BackWPup WordPress plugin Admin+ path traversal to RCE via Restore PclZip Fallback6.6CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-86827BackWPup - Unauthenticated Backup Job Execution via wp-cron.php5.3CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-86826BackWPup WordPress plugin unauthenticated sensitive data disclosure5.9CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-85490Brocade Active Support Connectivity Gateway path traversal7.7CNA v4.00.3%2026-10-08Fix
CVE-2026-85489Brocade Active Support Connectivity Gateway missing authentication8.7CNA v4.00.2%2026-10-08Fix
CVE-2026-85488Brocade Active Support Connectivity Gateway hard-coded credentials7.0CNA v4.00.1%2026-10-08Fix
CVE-2026-85487Brocade Active Support Connectivity Gateway HTTP service component path traversal8.6CNA v4.00.2%2026-10-08Fix
CVE-2026-85486Brocade Active Support Connectivity Gateway eval injection8.6CNA v4.00.3%2026-10-08Fix
CVE-2026-85423Brocade Active Support Connectivity Gateway missing authentication8.6CNA v4.00.2%2026-10-08Fix
CVE-2026-85422Brocade Active Support Connectivity Gateway hard-coded credentials8.4CNA v4.00.1%2026-10-08Fix
CVE-2026-85421Brocade Active Support Connectivity Gateway missing authentication8.7CNA v4.00.2%2026-10-08Fix
CVE-2026-85097Bricksforge WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.10.3%2026-10-08Reported exploitedNucleiExploit codeFix
CVE-2026-84891Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-84875Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-84290Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection5.1CNA v3.10.1%2026-10-08Fix
CVE-2026-84278IBM Guardium Data Protection command injection7.2CNA v3.12.2%2026-10-08Fix
CVE-2026-84276IBM Guardium Data Protection denial of service7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-84275IBM Guardium Data Protection path traversal7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-84274IBM Guardium Data Protection information disclosure6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-84272IBM Guardium Data Protection missing authentication9.8CNA v3.10.4%2026-10-08Fix
CVE-2026-84271IBM Guardium Data Protection signature verification Bypass7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-84250IBM Guardium Data Protection hard-coded credentials8.4CNA v3.10.1%2026-10-08Fix
CVE-2026-84249IBM Guardium Data Protection missing authentication9.8CNA v3.10.4%2026-10-08Fix
CVE-2026-84247IBM Guardium Data Protection path traversal8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84246Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84245IBM Guardium Data Protection privilege escalation7.8CNA v3.10.1%2026-10-08Fix
CVE-2026-84244IBM Guardium Data Protection cross-site scripting9.3CNA v3.10.2%2026-10-08Fix
CVE-2026-84230IBM Guardium Data Protection race condition7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-84209IBM Guardium Data Protection SQL injection8.1CNA v3.10.3%2026-10-08Fix
CVE-2026-84198Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84058Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84057IBM Guardium Data Protection OS command injection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84035Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-84032IBM Guardium Data Protection improper certificate validation5.6CNA v3.10.2%2026-10-08Fix
CVE-2026-83947Microsoft Azure Event Grid spoofing7.7CNA v3.10.4%2026-10-08Fix
CVE-2026-83943Microsoft Azure API Center information disclosure8.7CNA v3.10.4%2026-10-08Fix
CVE-2026-82900IBM Guardium Data Protection path traversal8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-82895Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-82627Uncanny Automator WordPress plugin PHP object injection7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-82344IBM Guardium Data Protection buffer overflow8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-82335IBM Guardium Data Protection buffer overflow8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-82334IBM Guardium Data Protection out-of-bounds read8.1CNA v3.10.3%2026-10-08Fix
CVE-2026-81932Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.6CNA v3.10.3%2026-10-08Fix
CVE-2026-80381Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection9.8CNA v3.10.3%2026-10-08Fix
CVE-2026-79842HPE Intelligent Management Center (IMC) authentication bypass9.1CNA v3.10.3%2026-10-08Fix
CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/http7.5CISA ADP v3.10.6%2026-10-08Fix
CVE-2026-78667Lack of limit on size of parsed Range headers in net/http7.5CISA ADP v3.10.4%2026-10-08Fix
CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/http9.1CISA ADP v3.10.6%2026-10-08Fix
CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/http7.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/http7.5CISA ADP v3.10.6%2026-10-08Fix
CVE-2026-78407IBM Security Verify Access and Verify Identity Access Web UI cross-site scripting5.4CNA v3.10.1%2026-10-08Fix
CVE-2026-78406IBM Security Verify Access and Verify Identity Access deserialization of untrusted data9.8CNA v3.10.5%2026-10-08Fix
CVE-2026-78401IBM Security Verify Access and Verify Identity Access deserialization of untrusted data9.8CNA v3.10.6%2026-10-08Fix
CVE-2026-78399IBM Security Verify Access and Verify Identity Access denial of service6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-78388IBM Security Verify Access and Verify Identity Access cross-site request forgery4.3CNA v3.10.1%2026-10-08Fix
CVE-2026-77900Microsoft Azure App Service remote code execution9.8CNA v3.10.5%2026-10-08Fix
CVE-2026-75875Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection9.8CNA v3.10.6%2026-10-08Fix
CVE-2026-71896Apache DolphinScheduler /dolphinscheduler/users/list-all endpoint incorrect authorization6.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-71895Apache DolphinScheduler missing authorization7.1CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-71183Apache DolphinScheduler incorrect authorization7.1CISA ADP v3.10.2%2026-10-08Fix
CVE-2026-69435Microsoft Azure SRE Agent elevation of privilege9.6CNA v3.10.4%2026-10-08Fix
CVE-2026-67693gnutls information disclosure3.7CISA ADP v3.10.2%2026-10-08
CVE-2026-66479WPComplete WordPress plugin CSRF to stored XSS7.1CNA v3.10.1%2026-10-08Fix
CVE-2026-66087Apache DolphinScheduler: Project authorization bypass in the Task instance stop/savepoint endpoint8.1CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-66084Apache DolphinScheduler: Project authorization bypass in the Task Definition with-upstream endpoint8.1CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-66082Apache DolphinScheduler An authorization bypass6.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-62142WP 2FA WordPress plugin cross-site request forgery (CSRF)8.8CNA v3.10.1%2026-10-08Fix
CVE-2026-62128Creator LMS WordPress plugin broken access control5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-62127WP plugin Info Card WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-61801Github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files5.5CNA v3.10.1%2026-10-08Fix
CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/http7.5CISA ADP v3.10.3%2026-10-08Fix
CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in os9.8CISA ADP v3.10.5%2026-10-08Fix
CVE-2026-50055Zimbra Collaboration Suite Sieve notify filter action incorrect authorization6.5CNA v3.10.3%2026-10-08Exploit codeFix
CVE-2026-50054Zimbra Collaboration Suite GrantRightsRequest SOAP handler improper privilege management7.1CNA v3.10.2%2026-10-08Fix
CVE-2026-44038Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding4.8CNA v4.00.1%2026-10-08
CVE-2026-44037Uncontrolled recursion in DCMTK JSON reader allows denial of service6.8CNA v4.00.1%2026-10-08
CVE-2026-44036Uncontrolled recursion in DCMTK xml2dcm allows denial of service6.8CNA v4.00.1%2026-10-08
CVE-2026-44035Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service6.8CNA v4.00.1%2026-10-08
CVE-2026-44034Heap out-of-bounds read in DCMTK RLE decodeFrame4.8CNA v4.00.1%2026-10-08
CVE-2026-44033Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service6.8CNA v4.00.1%2026-10-08
CVE-2026-44031OFFIS DCMTK uncontrolled recursion8.7CNA v4.00.4%2026-10-08
CVE-2026-42698Tutor LMS WordPress plugin race condition5.3CNA v3.10.2%2026-10-08
CVE-2026-40804aBlocks WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-08
CVE-2026-27420Zotpress WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-08
CVE-2026-19878IBM Security Verify Access and Verify Identity Access improper workflow enforcement6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-19585HashiCorp go-getter S3 and GCS directory download handling path traversal5.3CNA v3.10.2%2026-10-08Fix
CVE-2026-19498IBM Security Verify Access and Verify Identity Access denial of service5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-19494IBM Security Verify Access and Verify Identity Access improper authentication8.1CNA v3.10.3%2026-10-08Fix
CVE-2026-19493IBM Security Verify Access and Verify Identity Access path traversal7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-19491IBM Security Verify Access and Verify Identity Access improper authentication9.1CNA v3.10.3%2026-10-08Fix
CVE-2026-19482IBM Security Verify Access and Verify Identity Access argument injection8.8CNA v3.10.4%2026-10-08Fix
CVE-2026-19218Password reset code brute force leading to account takeover in AKIN Software's MyRezzta9.1CNA v3.10.2%2026-10-08Fix
CVE-2026-19083IDOR in AKIN Software's OctoCloud8.8CNA v3.10.2%2026-10-08Fix
CVE-2026-18740IBM Security Verify Access and Verify Identity Access argument injection8.8CNA v3.10.4%2026-10-08Fix
CVE-2026-17609WebRehab Super Forms submit_form function vulnerability9.1CNA v3.10.3%2026-10-08Fix
CVE-2026-17196Super Forms WordPress plugin arbitrary file upload8.8CNA v3.10.5%2026-10-08Fix
CVE-2026-17189IBM Security Verify Access and Verify Identity Access Web UI cross-site scripting8.2CNA v3.10.1%2026-10-08Fix
CVE-2026-16916IBM Security Verify Access and Verify Identity Access protection mechanism failure9.1CNA v3.10.4%2026-10-08Fix
CVE-2026-16830IBM Security Verify Access and Verify Identity Access SQL injection5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-16823IBM Security Verify Access and Verify Identity Access improper authentication9.1CNA v3.10.3%2026-10-08Fix
CVE-2026-16340IBM DataPower Gateway out-of-bounds write9.8CNA v3.10.5%2026-10-08Fix
CVE-2026-16182IBM DataPower Gateway null pointer dereference5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-16181IBM DataPower Gateway improper authorization7.4CNA v3.10.3%2026-10-08Fix
CVE-2026-16179IBM DataPower Gateway buffer underwrite7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-16178IBM DataPower Gateway out-of-bounds write7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-16177IBM DataPower Gateway out-of-bounds read5.3CNA v3.10.3%2026-10-08Fix
CVE-2026-16176IBM DataPower Gateway denial of service7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-16170IBM DataPower Gateway out-of-bounds write7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-16169IBM DataPower Gateway denial of service7.5CNA v3.10.4%2026-10-08Fix
CVE-2026-16167IBM DataPower Gateway out-of-bounds write7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-16165IBM DataPower Gateway null pointer dereference7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-16164IBM DataPower Gateway out-of-bounds write7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-16163IBM DataPower Gateway out-of-bounds write8.6CNA v3.10.3%2026-10-08Fix
CVE-2026-16161IBM DataPower Gateway out-of-bounds read7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-16159IBM DataPower Gateway out-of-bounds write8.6CNA v3.10.3%2026-10-08Fix
CVE-2026-16111IBM DataPower Gateway type confusion7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-15824IBM DataPower Gateway denial of service8.2CNA v3.10.3%2026-10-08Fix
CVE-2026-15822IBM DataPower Gateway denial of service7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-15819IBM DataPower Gateway out-of-bounds write7.5CNA v3.10.3%2026-10-08Fix
CVE-2026-15784IBM DataPower Gateway out-of-bounds write8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-15781IBM DataPower Gateway buffer overflow8.0CNA v3.10.4%2026-10-08Fix
CVE-2026-15762IBM DataPower Gateway out-of-bounds write9.8CNA v3.10.5%2026-10-08Fix
CVE-2026-14999IBM DataPower Gateway improper verification of cryptographic signature7.4CNA v3.10.2%2026-10-08Fix
CVE-2026-14992IBM DataPower Gateway out-of-bounds write9.8CNA v3.10.3%2026-10-08Fix
CVE-2026-14991IBM DataPower Gateway out-of-bounds write9.8CNA v3.10.4%2026-10-08Fix
CVE-2026-14990IBM DataPower Gateway affected by cross-site scripting9.3CNA v3.10.3%2026-10-08Fix
CVE-2026-14988IBM DataPower Gateway out-of-bounds read6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-14905IBM DataPower Gateway XXE8.2CNA v3.10.3%2026-10-08Fix
CVE-2026-14888IBM DataPower Gateway buffer overflow8.1CNA v3.10.4%2026-10-08Fix
CVE-2026-14521IBM DataPower Gateway affected by server-side request forgery4.9CNA v3.10.1%2026-10-08Fix
CVE-2026-14509IBM DataPower Gateway denial of service5.9CNA v3.10.3%2026-10-08Fix
CVE-2026-14508IBM DataPower Gateway use-after-free6.5CNA v3.10.3%2026-10-08Fix
CVE-2026-14507IBM DataPower Gateway out-of-bounds write7.7CNA v3.10.3%2026-10-08Fix
CVE-2026-14502IBM DataPower Gateway improper authentication9.8CNA v3.10.4%2026-10-08Fix
CVE-2026-14497IBM DataPower Gateway improper verification of cryptographic signature8.1CNA v3.10.6%2026-10-08Fix
CVE-2026-14496IBM DataPower Gateway out-of-bounds read8.2CNA v3.10.3%2026-10-08Fix
CVE-2026-14273IBM DataPower Gateway incorrect authorization6.5CNA v3.10.1%2026-10-08Fix
CVE-2026-14269IBM DataPower Gateway buffer overflow9.8CNA v3.10.5%2026-10-08Fix
CVE-2026-13258IBM DataPower Gateway cross-site scripting5.4CNA v3.10.2%2026-10-08Fix
CVE-2026-13257IBM DataPower Gateway insufficient verification of data authenticity6.5CNA v3.10.1%2026-10-08Fix
CVE-2026-12859IDOR in Caz Informatics' Advancity ALMS Cloud6.5CNA v3.10.2%2026-10-08
CVE-2026-12260SQL injection in the NetBoard CRM demo platform10.0CNA v4.00.2%2026-10-08Fix
CVE-2026-12109IBM Security Verify Access and Verify Identity Access local management interface out-of-bounds write5.5CNA v3.10.2%2026-10-08Fix
CVE-2026-12091IBM Security Verify Access and Verify Identity Access out-of-bounds read3.7CNA v3.10.3%2026-10-08Fix
CVE-2026-11939IBM Security Verify Access and Verify Identity Access audit log argument injection2.7CNA v3.10.2%2026-10-08Fix
CVE-2026-11936IBM Security Verify Access and Verify Identity Access cross-site scripting4.9CNA v3.10.1%2026-10-08Fix
CVE-2026-11930IBM Security Verify Access and Verify Identity Access web servers improper authorization5.9CNA v3.10.2%2026-10-08Fix
CVE-2026-11888IBM Security Verify Access and Verify Identity Access information disclosure6.4CNA v3.10.2%2026-10-08Fix
CVE-2026-11318DeskIn XPC service privilege escalation via Unauthenticated Installer8.5CNA v4.00.2%2026-10-08Exploit code
CVE-2026-10631Zimbra Collaboration Suite EWS extension authorization bypass6.5CNA v3.10.2%2026-10-08Fix
CVE-2026-9209mJobTime Unauthenticated SQL execution RCE via Login.aspx9.3CNA v4.00.7%2026-10-08
CVE-2026-5769Brocade SANnav cleartext storage of sensitive information5.6CNA v4.00.1%2026-10-08Fix
CVE-2026-5049Brocade SANnav path traversal6.9CNA v4.00.2%2026-10-08Fix
CVE-2026-5048Brocade SANnav SQL injection6.1CNA v4.00.2%2026-10-08Fix
CVE-2026-5047Brocade SANnav insecure storage of sensitive information8.2CNA v4.00.2%2026-10-08Fix
CVE-2026-4894Authentication bypass in multiple products from Frappe Technologies6.9CNA v4.00.4%2026-10-08
CVE-2026-107363OpenStack Zaqar web parameter tampering6.1CNA v4.00.5%2026-10-07Fix
CVE-2026-107353ljharb traverse set function prototype pollution6.9CNA v4.00.3%2026-10-07Fix
CVE-2026-107352AWS Amazon Athena missing authorization6.3CNA v4.00.2%2026-10-07Fix
CVE-2026-107315pgjdbc pads a value shorter than its declared length with bytes of earlier statements5.3CNA v3.10.1%2026-10-07Fix
CVE-2026-107314pgjdbc does not enforce requireAuth when the value excludes every authentication method5.9CNA v3.10.3%2026-10-07Fix
CVE-2026-107313pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections4.2CNA v3.10.1%2026-10-07Fix
CVE-2026-107285AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel5.9CNA v3.10.2%2026-10-07Fix
CVE-2026-107284AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check3.7CNA v3.10.1%2026-10-07Fix
CVE-2026-107283AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source3.7CNA v3.10.3%2026-10-07Fix
CVE-2026-107282async-http-client information disclosure9.4CNA v4.00.2%2026-10-07Fix
CVE-2026-107281async-http-client connection pool incorrect authorization7.6CNA v4.00.2%2026-10-07Fix
CVE-2026-107280async-http-client ThreadSafeCookieStore vulnerability6.9CNA v4.00.3%2026-10-07Fix
CVE-2026-107279AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int8.8CNA v4.00.4%2026-10-07
CVE-2026-107278MISP Object Sync Drops Objects and attributes when Description is Empty5.3CNA v4.00.3%2026-10-07Fix
CVE-2026-107276MISP email-based one-time password race condition6.3CNA v4.00.2%2026-10-07Fix
CVE-2026-107273Gophish SSRF via POST /API/import/site5.3CNA v4.00.2%2026-10-07
CVE-2026-107272Gophish XSS via Unescaped SMTP Server Error messages2.3CNA v4.00.2%2026-10-07
CVE-2026-107271Gophish Login Rate Limit Bypass via X-Forwarded-for spoofing6.9CNA v4.00.2%2026-10-07
CVE-2026-107270Gophish object takeover via Client-Supplied ID on API Create endpoints7.1CNA v4.00.2%2026-10-07
CVE-2026-107269Gophish Username Enumeration via POST /login Timing Discrepancy6.3CNA v4.00.2%2026-10-07
CVE-2026-107232AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT7.5CNA v3.10.2%2026-10-07Fix
CVE-2026-107231async-http-client Realm.Builder cleartext transmission of sensitive information8.7CNA v4.00.2%2026-10-07Fix
CVE-2026-107230AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins7.4CNA v3.10.2%2026-10-07Fix
CVE-2026-107229async-http-client ThreadSafeCookieStore session fixation4.0CNA v3.10.3%2026-10-07Fix
CVE-2026-107228AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie header via setHeader6.8CNA v3.10.3%2026-10-07Fix
CVE-2026-107227async-http-client WebSocket permessage-deflate decompression denial of service7.5CNA v3.10.4%2026-10-07Fix
CVE-2026-107225Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107224Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107223qax-os excelize flatCols excessive memory allocation7.1CNA v4.00.3%2026-10-07Fix
CVE-2026-107222qax-os excelize GetConditionalFormats null pointer dereference6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107221qax-os excelize checkRow out-of-bounds write6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-107219Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107218Excelize: RIGHT on supplementary-plane text slices with a negative index and panics5.3CNA v3.10.3%2026-10-07Fix
CVE-2026-107217qax-os excelize ColumnNameToNumber integer overflow7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107216qax-os excelize ANCHORARRAY uncontrolled recursion7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107215qax-os excelize extractPart denial of service7.5CNA v3.10.2%2026-10-07Fix
CVE-2026-107214Excelize Decrypt: Unrecoverable panics on malformed OLE/CFB encrypted workbooks7.5CNA v3.10.2%2026-10-07Fix
CVE-2026-107213qax-os excelize GetSlicers null pointer dereference8.7CNA v4.00.2%2026-10-07Fix
CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic8.7CNA v4.00.2%2026-10-07Fix
CVE-2026-107210ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data5.3CNA v3.10.3%2026-10-07Fix
CVE-2026-107209ImageMagick RSVG decoder use-after-free5.9CNA v3.10.3%2026-10-07Fix
CVE-2026-107208ImageMagick: Denial of service with crafted XMP profile5.3CNA v3.10.3%2026-10-07Fix
CVE-2026-107207LMCache missing authentication in Frontend Node Catalog allows SSRF Allowlist Bypass6.9CNA v4.00.3%2026-10-07
CVE-2026-107206LMCache missing authentication in MP HTTP Server Management API8.8CNA v4.00.6%2026-10-07
CVE-2026-107205LMCache missing authentication in MP Coordinator Fleet Control API8.8CNA v4.00.4%2026-10-07
CVE-2026-107204LMCache unauthenticated RCE via /run_script endpoint9.3CNA v4.00.8%2026-10-07
CVE-2026-107202jonssonyan h-ui command injection9.1CISA ADP v3.10.8%2026-10-07
CVE-2026-107194SunGrow iSolarCloud authentication bypass9.2CNA v4.00.4%2026-10-07Fix
CVE-2026-107183llama.cpp before b11393 use-after-free via common_chat_peg_mapper chat_parser9.2CNA v4.00.4%2026-10-07Fix
CVE-2026-107181Telegram Desktop IPC Record injection File Exfiltration via interpret: Scheme8.6CNA v4.00.3%2026-10-07Exploit codeFix
CVE-2026-107180MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances7.1CNA v4.00.3%2026-10-07Fix
CVE-2026-107177express-gateway Express Gateway Hard-coded Default cipherKey exposes OAuth Tokens7.4CNA v4.00.3%2026-10-07
CVE-2026-107176Red Hat OpenShift Container Platform 4 execution with unnecessary privileges6.8CNA v3.10.2%2026-10-07
CVE-2026-107175MISP Correlation Engine fails to Refresh when Event Distribution or Sharing Group Changes5.3CNA v4.00.2%2026-10-07Fix
CVE-2026-107174Source-to-image: Source-to-image: Security boundary bypass via absolute symbolic link extraction6.4CNA v3.10.3%2026-10-07
CVE-2026-107170Red Hat Enterprise Linux 10 m17n-lib: Null dereference in minput_open_im after failed m17n_init2.9CNA v3.10.1%2026-10-07
CVE-2026-107169Red Hat Enterprise Linux 10 m17n-lib: Null-pointer write in read_mtext_element on malformed utf-86.2CNA v3.10.1%2026-10-07
CVE-2026-107168Red Hat Enterprise Linux 10 m17n-lib: Parser infinite loop on malformed utf-8 in count_utf_8_chars6.2CNA v3.10.1%2026-10-07Fix
CVE-2026-107167Red Hat Enterprise Linux 10 m17n-lib: Heap use-after-free write in re_init_ic6.2CNA v3.10.1%2026-10-07
CVE-2026-107166Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources6.9CNA v4.00.6%2026-10-07
CVE-2026-107162express-gateway Express Gateway OAuth 2.0 Refresh Token Validation Bypass7.6CNA v4.00.3%2026-10-07
CVE-2026-107161Red Hat Enterprise Linux 10 Cyrus SASL heap-based buffer overflow7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-107159MiniUPnPd divide-by-zero DoS via SSDP M-SEARCH MX header7.1CNA v4.00.2%2026-10-07Exploit code
CVE-2026-107151Red Hat Satellite 6 missing authentication5.9CNA v3.10.4%2026-10-07
CVE-2026-107125XnView Classic FLI file heap-based overflow5.3CNA v4.00.3%2026-10-07Fix
CVE-2026-107121Red Hat Keycloak cleartext transmission of sensitive information6.5CNA v3.10.1%2026-10-07
CVE-2026-107104Unsafe deserialization vulnerability in Manacle Technologies ERP System9.3CNA v4.00.4%2026-10-07Fix
CVE-2026-107103SQL injection vulnerability in Manacle Technologies ERP System9.3CNA v4.00.3%2026-10-07Fix
CVE-2026-107102Account takeover vulnerability in Manacle Technologies ERP System9.3CNA v4.00.3%2026-10-07Fix
CVE-2026-106580ImageMagick: Policy Bypass in CUT encoder4.0CNA v3.10.1%2026-10-07Fix
CVE-2026-106579ImageMagick: Policy Bypass when using coder as the domain6.2CNA v3.10.1%2026-10-07Fix
CVE-2026-106578ImageMagick: Invalid Memory Free in MVG decoder5.9CNA v3.10.4%2026-10-07Fix
CVE-2026-106577ImageMagick: Code injection in the postscript coders5.3CNA v3.10.3%2026-10-07Fix
CVE-2026-106576ImageMagick: Denial of service possible when parsing an XMP profile5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106575ImageMagick: Unclosed file pointer in magick script5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106574ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash5.3CNA v3.10.2%2026-10-07Fix
CVE-2026-106573ImageMagick: Denial of service in MVG decoder5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106572ImageMagick: Stack Overflown CALS decoder due to missing depth check5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106571ImageMagick: Heap Buffer Over-Write in GetVirtualPixels API will result in a crash5.1CNA v3.10.1%2026-10-07Fix
CVE-2026-106570ImageMagick: Denial of service in distributed pixel cache server4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-106569ImageMagick: Denial of service in ASE decoder because of missing security checks5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106568ImageMagick: Infinite loop when reading a crafted XMP profile5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106567ImageMagick: Infinite loop in PSD decoder on 32-bit builds5.9CNA v3.10.4%2026-10-07Fix
CVE-2026-106566ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check4.0CNA v3.10.1%2026-10-07Fix
CVE-2026-106565ImageMagick: Infinite loop in bzip2 compressed images5.9CNA v3.10.4%2026-10-07Fix
CVE-2026-106564ImageMagick: Heap Buffer Over-Write in EXR decoder5.3CNA v3.10.4%2026-10-07Fix
CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpoint5.3CNA v3.10.2%2026-10-07Fix
CVE-2026-106562Backstage: Incorrect authorization in search engine permission filtering4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queries5.0CNA v3.10.2%2026-10-07Fix
CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend module7.1CNA v3.10.3%2026-10-07Fix
CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder module6.3CNA v3.10.3%2026-10-07Fix
CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configuration8.8CNA v3.10.5%2026-10-07Fix
CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configuration7.7CNA v3.10.3%2026-10-07Fix
CVE-2026-106556Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization7.7CNA v3.10.3%2026-10-07Fix
CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml7.7CNA v3.10.5%2026-10-07Fix
CVE-2026-106471Red Hat Candlepin verifyauthorizationfilter incorrect authorization8.1CNA v3.10.3%2026-10-07
CVE-2026-106164Infinite loop in Telerik Document Processing XLS Import7.3CNA v3.10.2%2026-10-07Fix
CVE-2026-106067Red Hat Enterprise Linux 10 gimp: Gimp: Heap buffer overflow in hot color filter on oversized image6.3CNA v3.10.1%2026-10-07
CVE-2026-106066Red Hat Enterprise Linux 10 GIMP’s raw data export plug-in heap-based buffer overflow6.3CNA v3.10.1%2026-10-07
CVE-2026-106065Red Hat Enterprise Linux 10 GIMP’s PCX export plug-in heap-based buffer overflow6.3CNA v3.10.1%2026-10-07
CVE-2026-106064Red Hat Enterprise Linux 10 GIMP’s GIF export plug-in heap-based buffer overflow6.3CNA v3.10.1%2026-10-07
CVE-2026-106061GIMP X cursor thumbnail loader out-of-bounds read5.5CNA v3.10.1%2026-10-07Fix
CVE-2026-106059GitAhead on macOS command injection via Show in Finder AppleScript8.7CNA v4.01.3%2026-10-07
CVE-2026-106058GitAhead OS command injection via Git Filter Filenames7.7CNA v4.01.2%2026-10-07
CVE-2026-106057patool OS command injection on Windows via shell_quote_nt8.5CNA v4.00.8%2026-10-07Fix
CVE-2026-106056Rundeck OS command injection via Windows Job Option Quoting7.7CNA v4.01.2%2026-10-07Fix
CVE-2026-105884Rocket Lazy Load WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-07Fix
CVE-2026-105876Modula Image Gallery WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-07Fix
CVE-2026-105875Prime Slider Addons For Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-105873Element Pack Elementor Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-105871Element Pack Elementor Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-105820Vault ACL Policy Cache vulnerable to Cross-Namespace Policy Resolution5.4CNA v3.10.2%2026-10-07Fix
CVE-2026-105818Vault PKI ACME issues Certificate with Unvalidated SANs5.9CNA v3.10.1%2026-10-07Fix
CVE-2026-105816Vault vulnerable to arbitrary code execution via Plugin Catalog Entries Restored from Raft Snapshots8.0CNA v3.10.3%2026-10-07Fix
CVE-2026-105324An HTTP header injection vulnerability was found in the ADM9.2CNA v4.00.7%2026-10-07Fix
CVE-2026-105322Magee Shortcodes WordPress plugin unauthenticated Mail Relay via Contact form5.3CNA v3.10.2%2026-10-07
CVE-2026-105316Magee Shortcodes WordPress plugin reflected XSS via live_preview and magee_create_shortcode actions7.1CISA ADP v3.10.2%2026-10-07
CVE-2026-105192LMCache unauthenticated RCE in multiprocess mode via pickle deserialization9.8CNA v3.10.5%2026-10-07Exploit codeFix
CVE-2026-105140Obot and race condition Restores Revoked Group Membership2.3CNA v4.00.2%2026-10-07Fix
CVE-2026-105139Obot authorization bypass via vMCP Profile Prompts and Resources5.3CNA v4.00.2%2026-10-07Fix
CVE-2026-105138Obot credential exposure via MCP Catalog Entry API7.1CNA v4.00.3%2026-10-07Fix
CVE-2026-104953MPG WordPress plugin Editor+ SQLi via Project import6.8CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104678CP Media Player WordPress plugin Contributor+ Media Player settings update2.7CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104677WP Coder - Editor+ RCE via Global PHP7.2CISA ADP v3.10.4%2026-10-07Fix
CVE-2026-104667Animated Number Counters WordPress plugin Editor+ Second-order SQLi via Counter order6.8CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104653Envira Gallery WordPress plugin Author+ stored XSS via Gallery Crop Dimensions6.8CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104652Envira Gallery WordPress plugin Author+ stored XSS via Gallery Image ID6.8CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104651Yaad Sarig Payment Gateway For WC WordPress plugin arbitrary order Payment manipulation via IDOR4.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104393Happy Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-07Fix
CVE-2026-104391Quiz And Survey Master WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-07Fix
CVE-2026-104390Booktics WordPress plugin broken access control4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-104074Coturn uninitialized stack Memory Disclosure via error-code6.9CNA v4.00.3%2026-10-07Fix
CVE-2026-104050Academy LMS WordPress plugin Subscriber+ Cross-Course Quiz Answer disclosure via render_quiz_answers4.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-104049Academy LMS WordPress plugin Subscriber+ arbitrary Lesson content disclosure via Topic REST endpoint4.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-103870Red Hat Satellite 6 pulp-rpm: Distribution tree publish creates directories from .treeinfo ids5.0CNA v3.10.2%2026-10-07
CVE-2026-103869Red Hat pulp-ansible bearer-token refresh session data exposure6.5CNA v3.10.2%2026-10-07
CVE-2026-103868Red Hat pulp-container session data exposure6.5CNA v3.10.2%2026-10-07
CVE-2026-103681Frontend Dashboard WordPress plugin Profile and post field deletion via fed_user_profile_delete4.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-103668Six Apart Movable Type Site Search function SQL injection8.8CNA v4.00.4%2026-10-07
CVE-2026-103435@anthropic-ai/claude-code arbitrary file write7.7CNA v4.00.3%2026-10-07Fix
CVE-2026-103416Eclipse ThreadX out-of-bounds write9.3CNA v4.00.2%2026-10-07
CVE-2026-103378Geliver Akıllı Kargo Pazaryeri - unauthenticated API key disclosure via Public Log file6.5CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-103371Apache Geode: Management REST API: Insertion of sensitive information into log file7.5CISA ADP v3.10.3%2026-10-07Fix
CVE-2026-103323Integration for Epos Now and WooCommerce - Unauthenticated Action Scheduler Queue Disclosure5.9CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-103075Hustle WordPress plugin broken access control4.3CNA v3.10.3%2026-10-07Fix
CVE-2026-102782Joomla extension ordasoft.com unauthenticated SQL injection in OrdaSoft Simple Membership9.3CNA v4.00.3%2026-10-07Exploit code
CVE-2026-102781Joomla extension ordasoft.com Unauthenticated Destructive CRUD in OrdaSoft Touch Slider6.9CNA v4.00.2%2026-10-07
CVE-2026-102478Octopus Deploy Octopus Server improper equivalence validation8.7CNA v4.00.3%2026-10-07Fix
CVE-2026-102258SonicWall SMA1000 cross-site scripting6.1CISA ADP v3.10.4%2026-10-07Fix
CVE-2026-102257SonicWall SMA1000 path traversal7.2CISA ADP v3.10.7%2026-10-07Fix
CVE-2026-102256SonicWall SMA1000 OS command injection7.8CISA ADP v3.10.5%2026-10-07Fix
CVE-2026-102255SonicWall SMA1000 Pre-authentication server-side request forgery10.0CISA ADP v3.10.5%2026-10-07Reported exploitedFix
CVE-2026-102173Kirki WordPress plugin stored cross-site scripting7.2CNA v3.10.4%2026-10-07Fix
CVE-2026-101886Cisco Jabber for Android path traversal via Shared Content URI5.1CNA v4.00.1%2026-10-07Fix
CVE-2026-98374Linux kernel tcp use-after-free–0.2%2026-10-07Fix
CVE-2026-98373In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables move_hugetlb_page_tables() optimizes mremap() by advancing to the last entry in the page table when the source page table does not exist, either initially or afte–0.2%2026-10-07Fix
CVE-2026-97720Apache Impala: Impala Executor Webserver Auth Bypass9.1CISA ADP v3.10.3%2026-10-07Fix
CVE-2026-97717Denial of service in Absolute Secure Access6.0CNA v4.00.2%2026-10-07Fix
CVE-2026-97716Denial of service in Absolute Secure Access8.7CNA v4.00.3%2026-10-07Fix
CVE-2026-97715Denial of service in Absolute Secure Access7.1CNA v4.00.2%2026-10-07Fix
CVE-2026-97714Denial of service vulnerability in Secure Access8.2CNA v4.00.3%2026-10-07Fix
CVE-2026-97673IBM Langflow OSS improper input validation8.8CNA v3.10.4%2026-10-07Fix
CVE-2026-97671IBM Langflow OSS path traversal6.5CNA v3.10.5%2026-10-07Fix
CVE-2026-97354PowerPress - Contributor+ SSRF via Media URL Redirects4.1CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-97331User Private Files WordPress plugin user email Address disclosure via dpk_upvf_rmv_access4.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-97294Media LIbrary Assistant WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-07Fix
CVE-2026-97188String Locator WordPress plugin unauthenticated PHP object injection via Database Editor8.8CISA ADP v3.10.4%2026-10-07Fix
CVE-2026-97146Apache YuniKorn: Admission control bypass via system label forgery4.8CNA v4.00.3%2026-10-07Fix
CVE-2026-96530Optimole - Subscriber+ sensitive data disclosure via Dashboard widget6.5CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-96408Six Apart Movable Type upgrade script code injection9.3CNA v4.00.6%2026-10-07
CVE-2026-96335Forminator WordPress plugin broken access control7.5CNA v3.10.2%2026-10-07Fix
CVE-2026-95606The Events Calendar WordPress plugin PHP object injection9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-95605WP Data Access WordPress plugin SQL injection9.3CNA v3.10.3%2026-10-07Fix
CVE-2026-95595Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly:7.1CNA v3.10.1%2026-10-07Fix
CVE-2026-95534Unlimited Elements For Elementor WordPress plugin PHP object injection8.8CNA v3.10.3%2026-10-07Fix
CVE-2026-94670Everest Forms WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-07Fix
CVE-2026-94662Unlimited Elements For Elementor WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-07Fix
CVE-2026-94154Aurora Heatmap WordPress plugin unauthenticated stored cross-site scripting via URL parameter6.1CNA v3.10.2%2026-10-07Fix
CVE-2026-93684Apache Impala: Stored XSS in Impala query plans5.4CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-93679IBM Langflow OSS ZIP file extraction denial of service4.3CNA v3.10.5%2026-10-07Fix
CVE-2026-93678IBM Langflow OSS improper authorization7.6CNA v3.10.4%2026-10-07Fix
CVE-2026-93677IBM Langflow OSS information disclosure7.7CNA v3.10.5%2026-10-07Fix
CVE-2026-93675IBM Langflow OSS expected behavior violation8.8CNA v3.10.8%2026-10-07Fix
CVE-2026-93674IBM Langflow OSS code injection9.8CNA v3.16.2%2026-10-07NucleiMetasploitExploit codeFix
CVE-2026-93449IBM Langflow OSS code injection8.5CNA v3.10.7%2026-10-07Fix
CVE-2026-93448IBM Langflow OSS path traversal6.5CNA v3.10.7%2026-10-07Fix
CVE-2026-93447IBM Langflow OSS deserialization of untrusted data7.5CNA v3.10.4%2026-10-07Fix
CVE-2026-93445IBM Langflow OSS code injection8.1CNA v3.10.7%2026-10-07Fix
CVE-2026-93443IBM Langflow OSS code injection7.5CNA v3.10.7%2026-10-07Fix
CVE-2026-93026Veeam Backup and Replication missing authorization6.1CNA v4.00.3%2026-10-07Fix
CVE-2026-92543Docker Engine insecure-registry fallback via malicious DNS responses7.6CNA v4.00.1%2026-10-07Fix
CVE-2026-92542Blind VXLAN injection into encrypted overlay networks from cluster peer6.9CNA v4.00.1%2026-10-07Fix
CVE-2026-92533Path traversal in BugTracker.NET7.1CNA v4.00.4%2026-10-07
CVE-2026-92532Unrestricted upload of file with dangerous type in BugTracker.NET7.5CNA v4.00.3%2026-10-07
CVE-2026-92531Improper neutralization of special elements used in an OS command in BugTracker.NET7.5CNA v4.00.9%2026-10-07
CVE-2026-92415Apache Jackrabbit: DavEx client runs Class.forName +-constructor on server-controlled error bodies6.9CNA v4.00.5%2026-10-07Fix
CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens9.3CNA v4.00.7%2026-10-07Fix
CVE-2026-92393Apache YuniKorn: Admission control bypass via workload UPDATE operation2.0CNA v4.00.3%2026-10-07Fix
CVE-2026-90466Apache Impala: Path traversal executes JARs outside trusted paths6.5CISA ADP v3.10.5%2026-10-07Fix
CVE-2026-89417OMGF WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-07Fix
CVE-2026-89322Vault ACL Policy Evaluation may allow Bypass of Deny Restrictions7.2CNA v3.10.3%2026-10-07Fix
CVE-2026-88962IBM Langflow OSS code injection8.8CNA v3.10.8%2026-10-07Fix
CVE-2026-88514iTerm2 macOS information disclosure5.5CISA ADP v3.10.1%2026-10-07
CVE-2026-87971If-So Dynamic Content - reflected XSS via message parameter7.1CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-87782Koinonia Link - Subscriber+ privilege escalation to Administrator8.8CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-86833MetForm WordPress plugin unauthenticated HTML injection in Notification Emails via field shortcodes5.4CNA v3.10.2%2026-10-07Fix
CVE-2026-86816WPCafe WordPress plugin unauthenticated Product data disclosure via REST API5.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-84897wolfSSL wolfSSH internal.c denial of service6.9CNA v4.00.3%2026-10-07Fix
CVE-2026-83742wolfSSL wolfSSH wstrncat in src/port.c integer underflow5.3CNA v4.00.4%2026-10-07Fix
CVE-2026-83540wolfSSL wolfSSH wolfSSHd on Windows race condition leading to logon token reused across connections7.7CNA v4.00.4%2026-10-07Fix
CVE-2026-82212Nexi XPay Build WordPress plugin unauthenticated Payment bypass via NPG Notification Handler7.5CNA v3.10.1%2026-10-07
CVE-2026-82211Nexi XPay Build WordPress plugin unauthenticated Payment Completion and order key disclosure8.2CNA v3.10.2%2026-10-07
CVE-2026-81535wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check6.3CNA v4.00.3%2026-10-07Fix
CVE-2026-78243Apache YuniKorn: LDAP Group provider panics on lowercase attribute name2.1CNA v4.00.3%2026-10-07Fix
CVE-2026-77214libexpat heap buffer over-read in xmlparse.c via XML_ParseBuffer8.3CNA v4.00.5%2026-10-07Fix
CVE-2026-76501Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) remote code execution9.8CNA v3.10.5%2026-10-07Fix
CVE-2026-76500Cisco Application Policy Infrastructure Controller improper resource control9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76499Cisco Application Policy Infrastructure Controller improper neutralization9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76498Cisco Application Policy Infrastructure Controller improper access control9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76488Cisco Application Policy Infrastructure Controller Authenticated information disclosure6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-76486Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) remote code execution9.8CNA v3.10.5%2026-10-07Fix
CVE-2026-76485Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) remote code execution9.8CNA v3.10.5%2026-10-07Fix
CVE-2026-76484Cisco License On-Prem Security Hardening Release8.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76483Cisco License On-Prem Security Hardening Release9.1CNA v3.10.2%2026-10-07Fix
CVE-2026-76482Cisco License On-Prem Security Hardening Release10.0CNA v3.10.2%2026-10-07Fix
CVE-2026-76480Cisco License On-Prem Security Hardening Release9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76472Cisco Meraki Security Hardening Release October 2026 improper neutralization of Special Elements8.8CNA v3.10.1%2026-10-07Fix
CVE-2026-76471Cisco NX-OS Software NX-API remote code execution9.8CNA v3.10.5%2026-10-07Fix
CVE-2026-76470Cisco Meraki Hardening Release incorrect calculation8.8CNA v3.10.2%2026-10-07Fix
CVE-2026-76469Cisco Meraki Security Hardening Release: October 2026 insufficient control flow management7.4CNA v3.10.1%2026-10-07Fix
CVE-2026-76468Cisco Meraki Hardening Release Input Validation vulnerabilities8.2CNA v3.10.2%2026-10-07Fix
CVE-2026-76467Cisco Meraki Software Hardening Release Resource Lifetime Management vulnerabilities7.5CNA v3.10.3%2026-10-07Fix
CVE-2026-76465Cisco Nexus 3000 and 9000 Series Switches MPLS OAM remote code execution9.8CNA v3.10.4%2026-10-07Fix
CVE-2026-76464Cisco Meraki Hardening Release October 2026 Buffer Management vulnerabilities9.6CNA v3.10.2%2026-10-07Fix
CVE-2026-76463Cisco Meraki Security Hardening Release: October 2026 improper access control8.8CNA v3.10.1%2026-10-07Fix
CVE-2026-76459Cisco NX-OS Software Security Hardening Release: October 2026 out-of-bounds write9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76458Cisco NX-OS Software improper exception handling8.6CNA v3.10.3%2026-10-07Fix
CVE-2026-76457Cisco NX-OS Software Security Hardening Release: October 2026 out-of-bounds read8.6CNA v3.10.3%2026-10-07Fix
CVE-2026-76456Cisco NX-OS Software Security Hardening Release: October 2026 improper input validation8.6CNA v3.10.3%2026-10-07Fix
CVE-2026-76455Cisco NX-OS Software Security Hardening Release: October 2026 improper access control9.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76454Cisco Smart Software Manager On-Prem Unauthenticated API vulnerability9.1CNA v3.10.6%2026-10-07Fix
CVE-2026-76453Cisco NX-OS Software Security Hardening Release: October 2026 improper neutralization8.8CNA v3.10.3%2026-10-07Fix
CVE-2026-76452Cisco Smart Software Manager On-Prem SQL injection4.9CNA v3.10.4%2026-10-07Fix
CVE-2026-76437Cisco Smart Software Manager On-Prem command injection4.9CNA v3.10.5%2026-10-07Fix
CVE-2026-76286Server-side request forgery (SSRF) through Custom API tools in Splunk MCP Server5.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76285Improper Adherence to Coding Standards in Splunk Enterprise9.8NVD v3.10.3%2026-10-07Fix
CVE-2026-76284Improper neutralization in Splunk Enterprise9.8CISA ADP v3.10.3%2026-10-07Fix
CVE-2026-76283Protection mechanism failure in Splunk Enterprise7.6CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-76282Improper control of a resource through its lifetime in Splunk Enterprise8.8CISA ADP v3.10.3%2026-10-07Fix
CVE-2026-76281Improper access control in Splunk Enterprise5.3CISA ADP v3.10.2%2026-10-07Fix
CVE-2026-76280Incorrect permission assignment for App Key Value Store Collections in Splunk Secure Gateway6.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76279Improper input validation of Index Names through the collect command in Splunk Enterprise4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76278Authorization bypass in SPL2 Module Permissions in Splunk Enterprise4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76277Improper input validation of Native Splunk Usernames through the REST API in Splunk Enterprise4.1CNA v3.10.2%2026-10-07Fix
CVE-2026-76276Information disclosure in the Discover Splunk Observability Cloud app4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76275Improper authorization in Search Job Listings through the REST API in Splunk Enterprise4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76274Server-side request forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-76273Improper input validation through the collect command in Splunk Enterprise4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76272Missing access control through the REST API in Splunk Secure Gateway4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76271Denial of service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-76270Structured Query Language (SQL) injection in the SPL2 Module Catalog in Splunk Enterprise6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-76269Improper access control in Search Job Retrieval through the REST API in Splunk Enterprise6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-76268Missing authentication for critical function in the Patroni REST API in Splunk Enterprise9.8CNA v3.11.6%2026-10-07NucleiExploit codeFix
CVE-2026-76267Log injection through the REST API in Splunk App for Splunk O11y Cloud4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-76266Local privilege escalation through Linux Package Upgrades in Splunk Enterprise7.7CNA v3.10.1%2026-10-07Fix
CVE-2026-76265Improper access control through REST API endpoints in Splunk Secure Gateway6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-76264Improper authorization through the REST API in Splunk Enterprise4.3CNA v3.10.2%2026-10-07Fix
CVE-2026-62253Homer: Complete authentication bypass when coordinator.jwt.secret is Empty (Default)9.8CNA v3.10.4%2026-10-07Fix
CVE-2026-62252Homer: Hard-coded Default Admin Password sipcapture with no Forced Change on First Login9.8CNA v3.10.7%2026-10-07Fix
CVE-2026-62251Homer: Authenticated SQL injection via Unvalidated rawquery field in /API/v4/statistics/query8.1CNA v3.10.3%2026-10-07Fix
CVE-2026-62179MervinPraison praisonai-platform issue dependency deletion incorrect authorization6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-62176PraisonAI: Code injection via f-string Interpolation in Deploy API Server Generation9.1CNA v3.10.5%2026-10-07Fix
CVE-2026-59347VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability8.1CNA v3.10.2%2026-10-07Fix
CVE-2026-59346VMware Workstation and Fusion VMXNET3 virtual network adapter integer overflow9.3CNA v3.10.3%2026-10-07Exploit codeFix
CVE-2026-58069Veeam Backup and Replication path traversal8.3CNA v4.00.4%2026-10-07
CVE-2026-58068Veeam Agent missing authorization6.8CNA v4.00.1%2026-10-07Fix
CVE-2026-56851Panic parsing crafted input in x/text/secure/precis in golang.org/x/text7.5CISA ADP v3.10.3%2026-10-07Fix
CVE-2026-46572Tuxera NTFS-3G heap-based buffer overflow7.4CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-46571Tuxera NTFS-3G out-of-bounds read5.5CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-46570Tuxera NTFS-3G heap-based buffer overflow8.1CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-46569Tuxera NTFS-3G heap-based buffer overflow7.7NVD v3.10.2%2026-10-07Fix
CVE-2026-46438wger WorkoutLog.slot_entry insecure direct object reference6.5CNA v3.10.2%2026-10-07Fix
CVE-2026-46437wger API authentication insufficient session expiration4.8CNA v3.10.2%2026-10-07Fix
CVE-2026-46434wger UserDeactivateView privilege escalation7.1CNA v3.10.2%2026-10-07Fix
CVE-2026-45161wger trainer_login view cross-site request forgery5.4CNA v3.10.1%2026-10-07Fix
CVE-2026-43976wger gym management views incorrect authorization7.1CNA v3.10.2%2026-10-07Fix
CVE-2026-42721affiliate-toolkit WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07Fix
CVE-2026-42720Dynamic User Directory WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07
CVE-2026-42714Pix por Piggly (para Woocommerce) WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07
CVE-2026-42713Post title marquee scroll WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07
CVE-2026-42710Slider by 10Web WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07
CVE-2026-42708WP Post Author WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-07Fix
CVE-2026-42618Tuxera NTFS-3G heap-based buffer overflow7.1CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-42617Tuxera NTFS-3G heap-based buffer overflow7.1CISA ADP v3.10.1%2026-10-07Fix
CVE-2026-42616Tuxera NTFS-3G out-of-bounds write7.8NVD v3.10.2%2026-10-07Fix
CVE-2026-42532visidata EmailSheet extract_parts functionality path traversal5.5CNA v3.10.1%2026-10-07
CVE-2026-41958visidata path traversal6.5CNA v3.10.3%2026-10-07
CVE-2026-34499Johnson Controls ADVMS hard-coded cryptographic key8.5CNA v4.00.1%2026-10-07Fix
CVE-2026-33586OVHcloud Authenticated SMTP Sender Address Forgery6.3CNA v4.00.1%2026-10-07Fix
CVE-2026-27434WP Rentals WordPress theme broken access control5.3CNA v3.10.2%2026-10-07
CVE-2026-20362Cisco Finesse server-side request forgery7.2CNA v3.10.5%2026-10-07
CVE-2026-20328Cisco Smart Software Manager On-Prem arbitrary Account Password Reset vulnerability9.1CNA v3.10.5%2026-10-07Fix
CVE-2026-20321Cisco Application Policy Infrastructure Controller API command injection6.5CNA v3.10.4%2026-10-07Fix
CVE-2026-20173Cisco NX-OS Software denial of service5.8CNA v3.10.4%2026-10-07Fix
CVE-2026-20038Cisco Nexus 9000 Series Fabric Switches improper access control5.8CNA v3.10.3%2026-10-07Fix
CVE-2026-20032Cisco NX-OS Software Python sandbox escape4.4CNA v3.10.1%2026-10-07Fix
CVE-2026-19572FlexNet Publisher lmadmin SOAP authentication bypass9.3CNA v4.00.4%2026-10-07
CVE-2026-19396ASUS Router IFTTT pairing token generation vulnerability7.7CNA v4.00.1%2026-10-07
CVE-2026-19386ASUS Router stack-based buffer overflow9.3CNA v4.00.2%2026-10-07
CVE-2026-19186zephyrproject zephyr IEEE 802.15.4 frame decryption integer underflow8.1CNA v3.10.2%2026-10-07Fix
CVE-2026-17538LatePoint WordPress plugin insecure direct object reference5.4CNA v3.10.2%2026-10-07Fix
CVE-2026-16528ASUS Router certain ASUS sensitive information in log files8.4CNA v4.00.2%2026-10-07
CVE-2026-16516wolfSSH ECDSA host key curve not validated against negotiated algorithm9.0CNA v4.00.1%2026-10-07Fix
CVE-2026-15894zephyrproject zephyr bluetooth Mesh solicitation PDU stack buffer overflow8.8CNA v3.10.3%2026-10-07Fix
CVE-2026-14911ASUS Router cross-site scripting9.3CNA v4.00.3%2026-10-07
CVE-2026-5703Path traversal in Satel Iberia SenNet Datalogger Serie 2007.1CNA v4.00.3%2026-10-07
CVE-2026-1403Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.3%2026-10-07Fix
CVE-2026-106589OpenBSD OpenSSH least privilege violation2.9CNA v3.10.1%2026-10-06Fix
CVE-2026-106588OpenBSD OpenSSH improper isolation3.1CNA v3.10.1%2026-10-06
CVE-2026-106587OpenBSD OpenSSH type confusion3.3NVD v3.10.1%2026-10-06Fix
CVE-2026-106586OpenBSD OpenSSH incorrect control flow4.3NVD v3.10.1%2026-10-06Fix
CVE-2026-106585OpenBSD OpenSSH decompression bomb6.5CNA v3.10.2%2026-10-06Fix
CVE-2026-106584OpenBSD OpenSSH off-by-one error3.3NVD v3.10.1%2026-10-06Fix
CVE-2026-106583OpenBSD OpenSSH resource injection7.8NVD v3.10.2%2026-10-06Fix
CVE-2026-106582OpenBSD OpenSSH LZ77 dictionary coder vulnerability3.7CNA v3.10.2%2026-10-06Fix
CVE-2026-106555OpenBSD OpenSSH incorrect resource transfer7.5NVD v3.10.1%2026-10-06Fix
CVE-2026-106553OpenBSD OpenSSH incorrect resource transfer7.5NVD v3.10.1%2026-10-06Fix
CVE-2026-106552OpenBSD OpenSSH relative path traversal6.5NVD v3.10.4%2026-10-06Fix
CVE-2026-106550Mozilla Node-convict config.set denial of service7.5CISA ADP v3.10.3%2026-10-06
CVE-2026-106547HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata8.5CNA v4.00.2%2026-10-06Fix
CVE-2026-106513MISP Redis configuration improper access control6.9CNA v4.00.6%2026-10-06
CVE-2026-106512MISP sachertortephp CakeResponse::download HTTP response splitting8.4CNA v4.00.3%2026-10-06
CVE-2026-106511MultiversX Labs multisig-improved on-chain multisig smart contract system vulnerability9.8CISA ADP v3.10.4%2026-10-06
CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocs7.7CNA v3.10.4%2026-10-06Fix
CVE-2026-106508Backstage: Potential file exposure through local TechDocs publisher5.3CNA v3.10.3%2026-10-06Fix
CVE-2026-106507Backstage: TechDocs arbitrary file read via mkdocs snippets5.3CNA v3.10.3%2026-10-06Fix
CVE-2026-106506Backstage: Improper input validation in scaffolder task list ordering5.3CNA v3.10.2%2026-10-06Fix
CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend7.7CNA v3.10.3%2026-10-06Fix
CVE-2026-106504Backstage: Sensitive information exposure in scaffolder task logs6.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106503Backstage: Scaffolder action input authorization bypass8.1CNA v3.10.4%2026-10-06Fix
CVE-2026-106502Backstage: Sensitive information may be exposed in Scaffolder task failure events5.3CNA v3.10.3%2026-10-06Fix
CVE-2026-106501Backstage: Sensitive information exposure in Scaffolder9.6CNA v3.10.5%2026-10-06Fix
CVE-2026-106500Backstage: Improper task state validation in Scaffolder backend8.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106499Backstage: Secret-derived values may be exposed in scaffolder task logs4.9CNA v3.10.3%2026-10-06Fix
CVE-2026-106498backstage plugin-catalog-backend server-side request forgery7.7CNA v3.10.3%2026-10-06Fix
CVE-2026-106497Backstage: Inconsistent catalog property permission evaluation4.3CNA v3.10.2%2026-10-06Fix
CVE-2026-106496Backstage: Inconsistent enforcement of allowed location types during catalog processing3.1CNA v3.10.2%2026-10-06Fix
CVE-2026-106494Backstage: Improper input validation in cloud storage URL readers4.4CNA v3.10.3%2026-10-06Fix
CVE-2026-106493Backstage: Cloud storage catalog locations may cross configured storage boundaries3.0CNA v3.10.3%2026-10-06Fix
CVE-2026-106492Backstage: Improper preservation of access restrictions during service credential delegation7.6CNA v3.10.2%2026-10-06Fix
CVE-2026-106491Backstage: Improper input validation in proxy-backend6.4CNA v3.10.3%2026-10-06Fix
CVE-2026-106490Backstage: Improper input validation in TechDocs static content requests6.5CNA v3.10.4%2026-10-06Fix
CVE-2026-106489Backstage: Improper authorization enforcement for TechDocs static content6.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106488Backstage: Improper authentication in the OIDC provider8.1CNA v3.10.3%2026-10-06Fix
CVE-2026-106487Backstage: Unsupported catalog cluster authentication mode in kubernetes backend3.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106486Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions8.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106463Backstage: Improper authorization in GitLab organizational user ingestion5.4CNA v3.10.2%2026-10-06Fix
CVE-2026-106462Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback6.4CNA v3.10.2%2026-10-06Fix
CVE-2026-106461Backstage: Incorrect authorization in scaffolder task listing4.3CNA v3.10.2%2026-10-06Fix
CVE-2026-106460backstage plugin-auth-node improper authentication6.8CNA v3.10.3%2026-10-06Fix
CVE-2026-106459Backstage: Improper input validation in Sentry scaffolder actions8.5CNA v3.10.2%2026-10-06Fix
CVE-2026-106458Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates6.5CNA v3.10.3%2026-10-06Fix
CVE-2026-106457Backstage: Insufficient audience validation in the Cloudflare Access auth provider6.8CNA v3.10.3%2026-10-06Fix
CVE-2026-106456Backstage: Inconsistent credential enforcement for overlapping proxy routes4.8CNA v3.10.2%2026-10-06Fix
CVE-2026-106455Backstage: Improper validation of MkDocs plugin configuration in TechDocs7.7CNA v3.10.3%2026-10-06Fix
CVE-2026-106454Twisted: IMAP wildcardToRegexp ReDoS4.3CNA v3.10.3%2026-10-06Fix
CVE-2026-106453yawkat lz4-java LZ4DecompressorWithLength excessive memory allocation5.3CNA v3.10.4%2026-10-06Fix
CVE-2026-106452yawkat lz4-java LZ4BlockInputStream excessive memory allocation5.3CNA v3.10.4%2026-10-06Fix
CVE-2026-106451yawkat lz4-java net.jpountz.util.Native.load race condition7.3CNA v4.00.1%2026-10-06Fix
CVE-2026-106450yawkat lz4-java LZ4FrameInputStream resource exhaustion5.3CNA v3.10.4%2026-10-06Fix
CVE-2026-106449yawkat lz4-java LZ4BlockInputStream uncontrolled recursion3.7CNA v3.10.3%2026-10-06Fix
CVE-2026-106448StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding8.9CNA v4.00.4%2026-10-06Fix
CVE-2026-106447StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags8.7CNA v4.00.4%2026-10-06Fix
CVE-2026-106446handlebars-lang handlebars.js handlebars: JavaScript injection9.8CNA v3.10.6%2026-10-06Fix
CVE-2026-106445handlebars-lang handlebars.js Handlebars: JavaScript injection via Own Property Check Bypass9.2CNA v4.00.4%2026-10-06Exploit codeFix
CVE-2026-106444handlebars-lang handlebars.js Handlebars: JavaScript injection4.7CNA v3.10.3%2026-10-06Fix
CVE-2026-106443WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE8.8CNA v3.10.7%2026-10-06Fix