[["CVE-2026-116045","1999AZZAR","designer-mcp","1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal","MEDIUM",5.3,"2026-10-25",0],["CVE-2026-115214","","Datawiza Proxy Auth Plugin","Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol","","","2026-10-25",0],["CVE-2026-115251","","Duplicator","Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click","","","2026-10-25",0],["CVE-2026-114740","","WPVR","WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar","","","2026-10-25",0],["CVE-2026-114741","","WPVR","WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR","","","2026-10-25",0],["CVE-2026-114742","","WPVR","WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR","","","2026-10-25",0],["CVE-2026-114743","","InstaWP Connect","InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin","","","2026-10-25",0],["CVE-2026-115183","","Qi Addons For Elementor","Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget","","","2026-10-25",0],["CVE-2026-111976","","GiveWP","GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou","","","2026-10-25",0],["CVE-2026-111978","","GiveWP","GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import","","","2026-10-25",0],["CVE-2026-111979","","GiveWP","GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color","","","2026-10-25",0],["CVE-2026-111980","","GiveWP","GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability ","","","2026-10-25",0],["CVE-2026-111981","","GiveWP","GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad","","","2026-10-25",0],["CVE-2025-15705","","Contact Form by Supsystic","Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS","","","2026-10-25",0],["CVE-2026-110285","","WP Stripe Checkout","WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web","","","2026-10-25",0],["CVE-2026-94295","","Chikkili- Google Pay India for Woocommerce","Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger","","","2026-10-25",0],["CVE-2026-116044","prasathmani","TinyFileManager","prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload","MEDIUM",5.3,"2026-10-25",0],["CVE-2026-116007","YunaiV","ruoyi-vue-pro","YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeSe","MEDIUM",6.3,"2026-10-25",0],["CVE-2026-116006","YunaiV","ruoyi-vue-pro","YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper auth","MEDIUM",6.9,"2026-10-25",0],["CVE-2026-116004","onyx-dot-app","Onyx","onyx-dot-app Onyx PreviewTab.tsx cross site scripting","MEDIUM",5.1,"2026-10-25",0],["CVE-2026-116000","Zylon","PrivateGPT","Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request ","MEDIUM",6.9,"2026-10-25",0],["CVE-2026-115999","mansi-k","Restaurant_IMS","mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection","MEDIUM",6.9,"2026-10-25",0],["CVE-2026-115997","pig-mesh","pig","pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection","MEDIUM",5.3,"2026-10-25",0],["CVE-2026-115996","Unitree Robotics","Unitree Go2","Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate vali","MEDIUM",6.3,"2026-10-25",0],["CVE-2026-115995","Unitree Robotics","Unitree Go2","Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection","CRITICAL",9.4,"2026-10-25",0],["CVE-2026-115982","","phpIPAM","phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting","MEDIUM",5.3,"2026-10-25",0],["CVE-2026-115981","","phpIPAM","phpIPAM index.php cross site scripting","MEDIUM",4.8,"2026-10-25",0],["CVE-2026-114820","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","CRITICAL",9.1,"2026-10-24",0],["CVE-2026-115973","FaveoSuite","Faveo Helpdesk","FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery","MEDIUM",6.9,"2026-10-24",0],["CVE-2026-115972","FaveoSuite","Faveo Helpdesk","FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization","MEDIUM",6.9,"2026-10-24",0],["CVE-2026-115971","Travisun","Opptrix","Travisun Opptrix preParsing handler webhook Buffer.concat denial of service","MEDIUM",6.9,"2026-10-24",0],["CVE-2026-115970","Travisun","Opptrix","Travisun Opptrix Import Endpoint import code injection","MEDIUM",6.9,"2026-10-24",0],["CVE-2026-115969","Travisun","Opptrix","Travisun Opptrix Schedule API setup command injection","MEDIUM",6.9,"2026-10-24",0],["CVE-2026-115933","GitroomHQ","postiz-app","Forged signed tokens let any registered user take over other users and organizations","CRITICAL",9.9,"2026-10-24",0],["CVE-2026-115557","Python Software Foundation","CPython","Distrust compromised intermediate certificates in ssl module","CRITICAL",9.4,"2026-10-24",0],["CVE-2026-114191","Knit Pay","UPI QR Code Payment Gateway for WooCommerce","WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Cont","HIGH",7.5,"2026-10-24",0],["CVE-2026-114192","Magepeople inc.","WpEvently","WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-114704","Christoph Vielgrader","Relevanssi","WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-24",0],["CVE-2026-114629","","Web-Simple","Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length h","","","2026-10-24",0],["CVE-2026-115932","GitroomHQ","postiz-app","Path traversal in post media lets any registered user read server files","CRITICAL",9.6,"2026-10-24",0],["CVE-2026-116020","BookStackApp","BookStack","BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116019","getgrav","grav","Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives","HIGH",8.7,"2026-10-24",0],["CVE-2026-116017","xinnan-tech","xiaozhi-esp32-server","Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116018","ONEARMY","community-platform","ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116016","YunaiV","yudao-cloud","yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header","HIGH",7.1,"2026-10-24",0],["CVE-2026-116014","open62541","open62541","open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType","CRITICAL",9.2,"2026-10-24",0],["CVE-2026-116015","YunaiV","yudao-cloud","yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116013","openresty","lua-resty-dns","OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing","MEDIUM",6.3,"2026-10-24",0],["CVE-2026-116011","CrowCpp","Crow","Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()","HIGH",8.7,"2026-10-24",0],["CVE-2026-116012","NationalSecurityAgency","ghidra","Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","LOW",2,"2026-10-24",0],["CVE-2026-116010","francoisjacquet","RosarioSIS","RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116008","Bottelet","DaybydayCRM","DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-116009","owen2345","camaleon-cms","Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action","HIGH",8.7,"2026-10-24",0],["CVE-2026-110018","kodezen","aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block ","HIGH",8.8,"2026-10-24",0],["CVE-2026-114705","quadlayers","WP Social Feed Gallery","WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-115998","CervantesSec","cervantes","IDOR: User reads and modifies findings from other people's projects","MEDIUM",4.3,"2026-10-24",0],["CVE-2026-114194","Igor Funa","Ad Inserter","WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-115994","CervantesSec","cervantes","BOLA Allows Cross-Project Target Tampering","MEDIUM",5.4,"2026-10-24",0],["CVE-2026-115993","CervantesSec","cervantes","Stored XSS in the “Notes” field of project checklists","MEDIUM",6.8,"2026-10-24",0],["CVE-2026-114196","paytiumsupport","Paytium","WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-24",0],["CVE-2026-114694","Pixelite","Events Manager","WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-114695","Infomaniak Network","VOD Infomaniak","WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-110892","Brainstorm Force","SureDash","WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-114693","Plugins360 Labs","All-in-One Video Gallery","WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerabil","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-114697","QuarkA","QA Analytics","WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-112866","WPFactory","Product Filter by WBW","WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-24",0],["CVE-2026-114178","Bold Grid","W3 Total Cache","WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-114190","Hai Zheng / Lite Speed Cache","LiteSpeed Cache","WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","MEDIUM",5.9,"2026-10-24",0],["CVE-2026-94075","Tribulant Software","Newsletters","WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-24",0],["CVE-2026-111402","Tribulant Software","Newsletters","WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-24",0],["CVE-2026-112844","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-112869","Noah Hearle","We’re Open!","WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-114179","wordplus","BP Better Messages","WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-24",0],["CVE-2026-115975","CervantesSec","cervantes","Broken access control in JiraController","HIGH",7.1,"2026-10-24",0],["CVE-2026-115803","","Scada-LTS","Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authoriz","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-115802","InternScience","InternAgent","InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-108013","HCL Software","BigFix Platform","HCL BigFix Platform is affected by security vulnerability around intermediate CA certifica","MEDIUM",6.8,"2026-10-24",0],["CVE-2026-113674","","GeoDirectory","GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","LOW",3.7,"2026-10-24",0],["CVE-2026-114429","","WPVR","WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content","MEDIUM",6.8,"2026-10-24",0],["CVE-2026-113490","","GeoDirectory","GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup RE","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-113491","","GeoDirectory","GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal","MEDIUM",6.4,"2026-10-24",0],["CVE-2026-113492","","GeoDirectory","GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed","MEDIUM",5.3,"2026-10-24",0],["CVE-2026-113493","","GeoDirectory","GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute","MEDIUM",6.8,"2026-10-24",0],["CVE-2026-113673","","GeoDirectory","GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export","HIGH",7.2,"2026-10-24",0],["CVE-2026-105199","","Pixel Tag Manager for WooCommerce","Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager","MEDIUM",6.8,"2026-10-24",0],["CVE-2026-110956","","asVereinbase","asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation","CRITICAL",9.8,"2026-10-24",0],["CVE-2026-112207","","Download Monitor","Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link","HIGH",7.1,"2026-10-24",0],["CVE-2026-113489","","GeoDirectory","GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR","MEDIUM",4.3,"2026-10-24",0],["CVE-2026-97352","","News Kit Addons For Elementor","News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via","MEDIUM",4.3,"2026-10-24",0],["CVE-2026-97353","","News Kit Addons For Elementor","News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_","MEDIUM",5.4,"2026-10-24",0],["CVE-2026-107887","","Advanced Twenty Seventeen","Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_th","MEDIUM",5.4,"2026-10-24",0],["CVE-2026-107907","","MAS Videos","MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-87835","","Front End Users","Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assig","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-115806","codexonics","Prime Mover – Backup and Migration","Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment dur","CRITICAL",9.8,"2026-10-24",0],["CVE-2026-115807","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","HIGH",7.1,"2026-10-24",0],["CVE-2026-115929","MongoDB, Inc.","Compass","MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs","HIGH",7.6,"2026-10-24",0],["CVE-2026-115931","GitroomHQ","postiz-app","Arbitrary file read and backend crash through unrestricted provider method calls","CRITICAL",9.9,"2026-10-24",0],["CVE-2026-115938","craftcms","cms","Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RC","HIGH",8.7,"2026-10-24",0],["CVE-2026-115937","craftcms","commerce-mollie","Unauthenticated payment reuse allows unpaid orders to be marked as paid","HIGH",8.7,"2026-10-24",0],["CVE-2026-115801","Kakao","khaiii","Kakao khaiii JSON Config File Linear.cpp open out-of-bounds","MEDIUM",4.8,"2026-10-24",0],["CVE-2026-115935","craftcms","cms","Control panel only API response emulation replaces \"securityKey\" and reaches server RCE","HIGH",8.7,"2026-10-24",0],["CVE-2026-115897","yahoo","serialize-javascript","Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a se","LOW",2.1,"2026-10-24",0],["CVE-2026-115895","capricorn86","happy-dom","Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code ","HIGH",8.8,"2026-10-24",0],["CVE-2026-115893","bytecodealliance","wasmtime","Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_tabl","CRITICAL",9.9,"2026-10-24",0],["CVE-2026-115892","bytecodealliance","wasmtime","Wasmtime: Panic lowering a host-created component model stream into a guest that expects a","MEDIUM",5.7,"2026-10-24",0],["CVE-2026-115889","bytecodealliance","wasmtime","Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","CRITICAL",9.9,"2026-10-24",0],["CVE-2026-115887","graphql-hive","graphql-scalars","graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service","HIGH",7.5,"2026-10-24",0],["CVE-2026-115886","mlflow","mlflow","MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer","MEDIUM",6.5,"2026-10-24",0],["CVE-2026-115885","langchain-ai","langgraph","LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output","MEDIUM",4.1,"2026-10-24",0],["CVE-2026-115883","langchain-ai","langgraph","LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite s","MEDIUM",6,"2026-10-24",0],["CVE-2026-113951","Apple","Container","If an attacker can write to the filesystem of a container k8s cluster container, they can ","","","2026-10-23",0],["CVE-2026-75525","open-reception","appointment-booking-software","OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient direct","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-115800","UbiquitousLearning","mllm","UbiquitousLearning mllm Convertor __init__.py load_model path traversal","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-75524","open-reception","appointment-booking-software","OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-65825","open-reception","appointment-booking-software","OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the sam","HIGH",7.5,"2026-10-23",0],["CVE-2026-65824","open-reception","appointment-booking-software","OpenReception: invite confirmation token is replayable within its validity window and re-i","HIGH",7.4,"2026-10-23",0],["CVE-2026-58202","open-reception","appointment-booking-software","OpenReception: Confirmation-email links built from the request Host enable pending-account","HIGH",8.3,"2026-10-23",0],["CVE-2026-115877","twisted","twisted","Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-83813","twisted","twisted","Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation","LOW",3.1,"2026-10-23",0],["CVE-2026-115778","twisted","twisted","Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport vi","HIGH",7.5,"2026-10-23",0],["CVE-2026-115776","twisted","twisted","Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbound","HIGH",7.5,"2026-10-23",0],["CVE-2026-115775","twisted","twisted","Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element ","HIGH",8.7,"2026-10-23",0],["CVE-2026-115774","twisted","twisted","Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEAR","MEDIUM",4.9,"2026-10-23",0],["CVE-2026-113877","","HTTP-Headers-ActionPack","HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-La","","","2026-10-23",0],["CVE-2026-115797","Tenda","F6","Tenda F6 Web Management cleartext transmission","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-79982","zephyrproject","zephyr","Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI","HIGH",8.8,"2026-10-23",0],["CVE-2026-79981","zephyrproject","zephyr","DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoof","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-79980","zephyrproject","zephyr","Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconf","MEDIUM",5.6,"2026-10-23",0],["CVE-2026-79979","zephyrproject","zephyr","Stale TLB entries after demand-paging page-out let arm64 user threads access reused physic","HIGH",7.8,"2026-10-23",0],["CVE-2026-79978","zephyrproject","zephyr","Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path","LOW",3.6,"2026-10-23",0],["CVE-2026-79977","zephyrproject","zephyr","WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-pa","HIGH",8.2,"2026-10-23",0],["CVE-2026-19741","zephyrproject","zephyr","OpenThread joiner autostart uses a publicly documented default Joining Device Credential (","HIGH",7.5,"2026-10-23",0],["CVE-2026-115796","Tenda","F6","Tenda F6 Web Management cross-site request forgery","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-115586","pypa","virtualenv","virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is o","HIGH",7.1,"2026-10-23",0],["CVE-2026-115585","py-pdf","pypdf","pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)","HIGH",7.1,"2026-10-23",0],["CVE-2026-115580","py-pdf","pypdf","pypdf: Possible long runtimes for large xref table header limits","HIGH",7.1,"2026-10-23",0],["CVE-2026-115572","py-pdf","pypdf","pypdf: Possible long runtimes for repeated references to the same missing object","HIGH",7.1,"2026-10-23",0],["CVE-2026-115845","AWS","AWS MCP Server","Incomplete validation in the run_script Python sandbox in AWS MCP Server","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-91093","HP Inc.","HP One Agent Software","HP One Agent Software – Security Update","HIGH",8.5,"2026-10-23",0],["CVE-2026-112342","Tandoor Recipes","Tandoor Recipes","Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning","HIGH",7.1,"2026-10-23",0],["CVE-2026-115570","electron","electron","Electron: Mitigation for compromised eMudhra intermediate certificates","HIGH",7.4,"2026-10-23",0],["CVE-2026-115569","fallow-rs","fallow","Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read fil","LOW",3.3,"2026-10-23",0],["CVE-2026-115863","ConnMan","ConnMan","ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occ","HIGH",7.6,"2026-10-23",0],["CVE-2026-115813","AWS","multi-model-server","Server-side request forgery in the model download path in Amazon Web Services Multi Model ","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-115812","AWS","multi-model-server","Relative path traversal during model archive extraction in Amazon Web Services Multi Model","CRITICAL",9.3,"2026-10-23",0],["CVE-2026-115567","tokio-rs","tokio","Tokio: Race condition in `tokio::time::Interval`","MEDIUM",5.8,"2026-10-23",0],["CVE-2026-110975","","kruize-autotune","Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure","HIGH",7.4,"2026-10-23",0],["CVE-2026-105481","nodejs","node","A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a resp","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-105482","nodejs","node","A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently tru","HIGH",7.4,"2026-10-23",0],["CVE-2026-105483","nodejs","node","A flaw in Node.js TLS hostname verification allows a certificate without a matching IP add","HIGH",7.4,"2026-10-23",0],["CVE-2026-106069","nodejs","node","A flaw in Node.js TLS hostname verification can cause a server certificate to be validated","HIGH",7.4,"2026-10-23",0],["CVE-2026-106070","nodejs","node","A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong t","LOW",3.7,"2026-10-23",0],["CVE-2026-106071","nodejs","node","A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that d","LOW",3.6,"2026-10-23",0],["CVE-2026-106072","nodejs","node","A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to au","MEDIUM",6.7,"2026-10-23",0],["CVE-2026-106073","nodejs","node","A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` witho","LOW",3.3,"2026-10-23",0],["CVE-2026-106074","nodejs","node","A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-87901","phpBB","phpBB","Improper sanitization in the registration module allows reflected Cross-Site Scripting.","HIGH",8.3,"2026-10-23",0],["CVE-2026-115810","TandoorRecipes","recipes","Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-57845","huggingface","datasets","Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder","HIGH",8.7,"2026-10-23",0],["CVE-2026-54668","kitodo","kitodo-production","Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEAD","HIGH",8.7,"2026-10-23",0],["CVE-2026-58497","olo-dot-io","Uni-CLI","Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests","HIGH",8.6,"2026-10-23",0],["CVE-2026-49442","Cacti","cacti","Cacti: User Enumeration via Error Messages","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-39902","Cacti","cacti","Cacti: Authenticated RCE on Data Input","HIGH",7.2,"2026-10-23",0],["CVE-2026-46531","Cacti","cacti","Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (i","MEDIUM",5.5,"2026-10-23",0],["CVE-2026-102786","phoca.cz","Phoca Gallery extension for Joomla","Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attri","HIGH",8.6,"2026-10-23",0],["CVE-2026-55222","ilbers","isar","Isar: Unprivileged user ownership of trusted repository GPG public keys storage after boot","MEDIUM",5.1,"2026-10-23",0],["CVE-2026-53942","conda","infrastructure","Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled tem","CRITICAL",9.9,"2026-10-23",0],["CVE-2026-55486","intranda","goobi-viewer-core","Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected ","CRITICAL",9.3,"2026-10-23",0],["CVE-2026-55465","intranda","goobi-viewer-core","Goobi viewer: Solr injection via unvalidated region parameter in spatial search","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-55463","intranda","goobi-viewer-core","Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-112333","GFI Software","GFI Archiver","GFI Archiver < 15.14 Stored XSS via MailInsights.aspx","MEDIUM",5.1,"2026-10-23",0],["CVE-2026-55459","intranda","goobi-viewer-core","Goobi viewer: OpenID JWT audience not enforced by the verifier","HIGH",7.4,"2026-10-23",0],["CVE-2026-55457","intranda","goobi-viewer-core","Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorizati","HIGH",7.4,"2026-10-23",0],["CVE-2026-55444","intranda","goobi-viewer-core","Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-46652","intranda","goobi-viewer-core","Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables re","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-46651","intranda","goobi-viewer-core","Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi ","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-46347","intranda","goobi-viewer-core","Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Rese","MEDIUM",6.8,"2026-10-23",0],["CVE-2026-46346","intranda","goobi-viewer-core","Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-55442","intranda","goobi-viewer-core","Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-115478","The-40-Thieves","obsidian-tc","obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle ","HIGH",7.1,"2026-10-23",0],["CVE-2026-115477","The-40-Thieves","obsidian-tc","obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HT","HIGH",7.1,"2026-10-23",0],["CVE-2026-115457","baserproject","basercms","baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments","HIGH",7.1,"2026-10-23",0],["CVE-2026-115786","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaus","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-115785","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email A","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-114624","baserproject","basercms","baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity","HIGH",7.2,"2026-10-23",0],["CVE-2026-114623","baserproject","basercms","baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-114622","baserproject","basercms","baserCMS: Encoded path traversal bypass in the theme file API","HIGH",7.2,"2026-10-23",0],["CVE-2026-57207","netboxlabs","netbox-mcp-server","NetBox MCP Server: HTTP transport exposes all NetBox data without authentication","MEDIUM",5.9,"2026-10-23",0],["CVE-2026-114621","baserproject","basercms","baserCMS: SQL injection in the admin panel and admin API","HIGH",8.8,"2026-10-23",0],["CVE-2026-114357","DJI","CrystalSky ZS600C","DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)","HIGH",7,"2026-10-23",0],["CVE-2026-57208","entireio","cli","Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write duri","MEDIUM",6.2,"2026-10-23",0],["CVE-2026-114356","DJI","CrystalSky ZS600C","DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without author","HIGH",7,"2026-10-23",0],["CVE-2026-115480","baserproject","basercms","baserCMS: Public Web API mail-form submission bypasses image CAPTCHA","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-115479","baserproject","basercms","baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-114355","DJI","CrystalSky ZS600C","DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root","HIGH",8.6,"2026-10-23",0],["CVE-2026-93640","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Conf","HIGH",7.8,"2026-10-23",0],["CVE-2026-115481","baserproject","basercms","baserCMS: BcCustomContent file fields can be configured to allow executable file extension","HIGH",8.5,"2026-10-23",0],["CVE-2026-114354","DJI","CrystalSky ZS600C","DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root","HIGH",8.6,"2026-10-23",0],["CVE-2026-50057","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permis","HIGH",7.8,"2026-10-23",0],["CVE-2026-114353","DJI","CrystalSky ZS600C","DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution","HIGH",7,"2026-10-23",0],["CVE-2026-50056","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injec","HIGH",7.8,"2026-10-23",0],["CVE-2026-93639","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Admi","HIGH",8.7,"2026-10-23",0],["CVE-2026-93638","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Pag","MEDIUM",6.1,"2026-10-23",0],["CVE-2026-55826","stape-io","gtm-server-side-wordpress-plugin","Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulati","HIGH",8.7,"2026-10-23",0],["CVE-2026-93636","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-93634","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Recor","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-93633","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Char","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-93631","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Link","HIGH",7.1,"2026-10-23",0],["CVE-2026-93630","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-55606","openwrt","odhcpd","odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-53918","openwrt","odhcpd","odhcpd DHCPv6 IA dangling first pointer use-after-free","HIGH",8.8,"2026-10-23",0],["CVE-2026-53920","openwrt","odhcpd","odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure","HIGH",8.7,"2026-10-23",0],["CVE-2026-115754","yahoo","serialize-javascript","serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body","LOW",2.3,"2026-10-23",0],["CVE-2026-53921","openwrt","odhcpd","odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-93629","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar ","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-93628","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar ","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-93627","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar ","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-50053","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL P","HIGH",8.7,"2026-10-23",0],["CVE-2026-10632","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document ","HIGH",8.7,"2026-10-23",0],["CVE-2026-115752","SignalK","signalk-server","Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon","LOW",2.3,"2026-10-23",0],["CVE-2026-115751","agentfront","mcp-from-openapi","mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-115749","hydra-ecosystem","hydra-ray-launcher","hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-115750","agentfront","mcp-from-openapi","mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-112848","AivahThemes","Hostme v2","WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112847","ThemeREX","ZenSoul","WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112849","AivahThemes","Hostme v2","WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-23",0],["CVE-2026-112850","AncoraThemes","Your Dress","WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-23",0],["CVE-2026-112854","axiomthemes","Holistic Center","WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112846","ThemeREX Group","Save Life","WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112851","ThemeREX Group","HotLock","WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112852","ThemeREX Group","Helion","WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability","HIGH",8.1,"2026-10-23",0],["CVE-2026-112853","axiomthemes","Hallelujah","WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112856","ThemeREX Group","Vagabonds","WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112857","axiomthemes","Reprizo","WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112858","axiomthemes","Rhodos","WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112859","ThemeREX Group","Little Birdies","WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112855","axiomthemes","Redy","WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112863","Hogash","KALLYAS","WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-23",0],["CVE-2026-115729","pdfme","common","@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass","HIGH",8.9,"2026-10-23",0],["CVE-2026-115730","i18next","i18next-http-backend","i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl","LOW",2.3,"2026-10-23",0],["CVE-2026-115728","hapijs","@hapi/content","@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing","HIGH",8.7,"2026-10-23",0],["CVE-2026-99087","Linux","Linux","dm-integrity: fix NULL pointer dereference when the 'R' flag is used","","","2026-10-23",0],["CVE-2026-99086","Linux","Linux","dm-integrity: validate the superblock on resume","","","2026-10-23",0],["CVE-2026-99085","Linux","Linux","sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler","","","2026-10-23",0],["CVE-2026-99084","Linux","Linux","readdir: take no inode lock on an immutable directory","","","2026-10-23",0],["CVE-2026-99083","Linux","Linux","ksmbd: fix heap out-of-bounds write in krb5_authenticate()","HIGH",8.8,"2026-10-23",0],["CVE-2026-99082","Linux","Linux","KVM: x86: Use active memslots for the per-vCPU MMIO cache","HIGH",8.8,"2026-10-23",0],["CVE-2026-55888","flatpak","xdg-desktop-portal","XDG Desktop Portal: Arbitrary file access via SaveFiles \"files\" option path traversal","HIGH",8.8,"2026-10-23",0],["CVE-2026-55889","flatpak","xdg-desktop-portal","XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key","HIGH",8.3,"2026-10-23",0],["CVE-2026-57210","dadrus","heimdall","Heimdall: IP Spoofing via Unvalidated Forwarding Headers","HIGH",7,"2026-10-23",0],["CVE-2026-57209","dadrus","heimdall","Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode","HIGH",7,"2026-10-23",0],["CVE-2026-55190","eventschedule","eventschedule","Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (par","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-99081","Linux","Linux","bnxt_en: fix DMA mapping length for padded small packets","HIGH",7.5,"2026-10-23",0],["CVE-2026-99080","Linux","Linux","fs: Free any excess xarray nodes in clear_inode()","","","2026-10-23",0],["CVE-2026-99079","Linux","Linux","net/mlx5e: Prevent stale XSK buffer release on refill retry","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-99078","Linux","Linux","net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-99077","Linux","Linux","ipv4: udp: Create exceptions before socket matching","HIGH",7.4,"2026-10-23",0],["CVE-2026-99076","Linux","Linux","ipv6: udp: Create exceptions before socket matching","","","2026-10-23",0],["CVE-2026-99075","Linux","Linux","rust_binder: reschedule node refcount update on thread exit","","","2026-10-23",0],["CVE-2026-99074","Linux","Linux","ipv4: stop PMTU walk when nexthop group shrinks","","","2026-10-23",0],["CVE-2026-99073","Linux","Linux","ipv4: stop exception dump when nexthop group shrinks","","","2026-10-23",0],["CVE-2026-99072","Linux","Linux","ipv4: stop route notification sizing when nexthop group shrinks","","","2026-10-23",0],["CVE-2026-99071","Linux","Linux","ipv4: do not warn on route notification size race","","","2026-10-23",0],["CVE-2026-99070","Linux","Linux","ipv6: do not warn on route notification size race","","","2026-10-23",0],["CVE-2026-99069","Linux","Linux","Input: ati_remote2 - fix type confusion in device attribute handlers","","","2026-10-23",0],["CVE-2026-99068","Linux","Linux","ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers","","","2026-10-23",0],["CVE-2026-99067","Linux","Linux","btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()","","","2026-10-23",0],["CVE-2026-99066","Linux","Linux","can: dev: init_can_skb(): restore skb header initialization","","","2026-10-23",0],["CVE-2026-99065","Linux","Linux","cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()","","","2026-10-23",0],["CVE-2026-99064","Linux","Linux","cipso: adjust cached option offsets when removing CIPSO","HIGH",8.1,"2026-10-23",0],["CVE-2026-99063","Linux","Linux","dm ioctl: don't let data_start run past the buffer","","","2026-10-23",0],["CVE-2026-99062","Linux","Linux","vsock/virtio: account only unread bytes in read_skb()","","","2026-10-23",0],["CVE-2026-99061","Linux","Linux","wifi: brcmfmac: fix P2P device removal race in brcmf_detach()","","","2026-10-23",0],["CVE-2026-99060","Linux","Linux","wifi: mt76: mt7603: initialize global station WCID","","","2026-10-23",0],["CVE-2026-99059","Linux","Linux","wireguard: noise: reject response consumption after intermediate initiation","HIGH",7.7,"2026-10-23",0],["CVE-2026-99058","Linux","Linux","workqueue: Fix NULL current_pwq deref in chained work check","","","2026-10-23",0],["CVE-2026-99057","Linux","Linux","xen/netfront: don't leak the skb when xennet_fill_frags() fails","","","2026-10-23",0],["CVE-2026-99056","Linux","Linux","strparser: make sure __strp_recv isn't running before tearing down the parser","HIGH",7.8,"2026-10-23",0],["CVE-2026-99055","Linux","Linux","tcp: reject net_iov in zerocopy receive mapping hints","","","2026-10-23",0],["CVE-2026-99054","Linux","Linux","tipc: destroy topsrv workqueues before closing connections","HIGH",7.8,"2026-10-23",0],["CVE-2026-99053","Linux","Linux","tipc: hold a reference to nodes found by link name","HIGH",7.8,"2026-10-23",0],["CVE-2026-99052","Linux","Linux","selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts","","","2026-10-23",0],["CVE-2026-99051","Linux","Linux","fsverity: RCU-delay the freeing of struct fsverity_info","HIGH",7.8,"2026-10-23",0],["CVE-2026-99050","Linux","Linux","gpio: mpsse: fix race when arming the IRQ poll worker","HIGH",7.8,"2026-10-23",0],["CVE-2026-99049","Linux","Linux","gpio: xilinx: fix runtime PM leak on request error path","","","2026-10-23",0],["CVE-2026-99048","Linux","Linux","gve: fix napi_disable deadlock when attempting to disable XSK pools","","","2026-10-23",0],["CVE-2026-99047","Linux","Linux","gve: fix XSK buffer leak when rings are stopped","","","2026-10-23",0],["CVE-2026-99046","Linux","Linux","gve: fix XSK buffer leak on error descriptor","HIGH",7.5,"2026-10-23",0],["CVE-2026-99045","Linux","Linux","ibmveth: h_free logical LAN on open-fail after register","","","2026-10-23",0],["CVE-2026-99044","Linux","Linux","ice: fix use-after-free in dynamic port cleanup","","","2026-10-23",0],["CVE-2026-99043","Linux","Linux","ice: fix metadata_dst refcount handling on representor teardown","","","2026-10-23",0],["CVE-2026-99042","Linux","Linux","io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","HIGH",8.4,"2026-10-23",0],["CVE-2026-99041","Linux","Linux","ip6_gre: remove obsolete ERSPAN PMTU update","","","2026-10-23",0],["CVE-2026-99040","Linux","Linux","KEYS: Fix add_key() race with keyring restriction","","","2026-10-23",0],["CVE-2026-99039","Linux","Linux","memstick: core: wait for request completion before freeing card","","","2026-10-23",0],["CVE-2026-99038","Linux","Linux","memstick: rtsx_usb_ms: complete requests after eject instead of dropping them","","","2026-10-23",0],["CVE-2026-99037","Linux","Linux","dm-crypt: reject the lmk IV mode with AEAD ciphers","","","2026-10-23",0],["CVE-2026-99036","Linux","Linux","dm: fix reading free memory in do_resume","","","2026-10-23",0],["CVE-2026-99035","Linux","Linux","mmc: mtk-sd: Cancel request timeout work on remove","","","2026-10-23",0],["CVE-2026-99034","Linux","Linux","mmc: sdhci-sprd: disable runtime PM on remove","","","2026-10-23",0],["CVE-2026-99033","Linux","Linux","net/packet: guard the ll header push in packet_rcv_spkt()","","","2026-10-23",0],["CVE-2026-99032","Linux","Linux","net/smc: protect clcsock lifetime in smc_getname","HIGH",7.8,"2026-10-23",0],["CVE-2026-99031","Linux","Linux","net: bridge: avoid recursive multicast port cleanup","","","2026-10-23",0],["CVE-2026-99030","Linux","Linux","net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","HIGH",7.5,"2026-10-23",0],["CVE-2026-99029","Linux","Linux","net: sparx5: free the matchall entry on destroy","","","2026-10-23",0],["CVE-2026-99028","Linux","Linux","net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop","","","2026-10-23",0],["CVE-2026-99027","Linux","Linux","net: team: stop reusing skb after queue override","","","2026-10-23",0],["CVE-2026-99026","Linux","Linux","net: team: free skb when broadcast has no txable port","","","2026-10-23",0],["CVE-2026-55422","conda-forge","conda-forge.github.io","conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dash","MEDIUM",4.6,"2026-10-23",0],["CVE-2026-99025","Linux","Linux","openvswitch: fix soft lockup in the netlink flow dump","","","2026-10-23",0],["CVE-2026-99024","Linux","Linux","optee: register TEE devices only once fully initialized","","","2026-10-23",0],["CVE-2026-99023","Linux","Linux","power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()","","","2026-10-23",0],["CVE-2026-99022","Linux","Linux","regulator: ltc3676: don't read the write-only HRST and CLIRQ registers","","","2026-10-23",0],["CVE-2026-99021","Linux","Linux","regulator: of: fill in supply names in of_regulator_bulk_get_all()","","","2026-10-23",0],["CVE-2026-99020","Linux","Linux","regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4","","","2026-10-23",0],["CVE-2026-99019","Linux","Linux","scsi: ch: Do not keep references to data transfer element devices","","","2026-10-23",0],["CVE-2026-99018","Linux","Linux","riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp","HIGH",7.8,"2026-10-23",0],["CVE-2026-99017","Linux","Linux","riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE","HIGH",7,"2026-10-23",0],["CVE-2026-99016","Linux","Linux","riscv: futex: untag the user pointer before the atomic access","HIGH",7.8,"2026-10-23",0],["CVE-2026-99015","Linux","Linux","Bluetooth: hci_sock: Serialize dead-device detachment","","","2026-10-23",0],["CVE-2026-99014","Linux","Linux","Bluetooth: hci_sync: Fix command skb lifetime during scan setup","HIGH",7.8,"2026-10-23",0],["CVE-2026-99013","Linux","Linux","Bluetooth: ISO: Reject concurrent BIS listener setup","HIGH",7.8,"2026-10-23",0],["CVE-2026-99012","Linux","Linux","Bluetooth: ISO: Serialize concurrent connect calls","HIGH",7.8,"2026-10-23",0],["CVE-2026-99011","Linux","Linux","Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()","HIGH",7.1,"2026-10-23",0],["CVE-2026-99010","Linux","Linux","Bluetooth: RFCOMM: free the skb when the DLC has no owner","","","2026-10-23",0],["CVE-2026-99009","Linux","Linux","Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex","","","2026-10-23",0],["CVE-2026-99008","Linux","Linux","Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown","","","2026-10-23",0],["CVE-2026-99007","Linux","Linux","drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN","","","2026-10-23",0],["CVE-2026-99006","Linux","Linux","drm/i915/gem: Prevent overstepping exec array boundary","HIGH",7.8,"2026-10-23",0],["CVE-2026-99005","Linux","Linux","drm/i915/gt: Unmask interrupts only when ACTIVE is true","","","2026-10-23",0],["CVE-2026-99004","Linux","Linux","drm/imagination: Size page table preallocation by device address","","","2026-10-23",0],["CVE-2026-99003","Linux","Linux","drm/panthor: validate userspace queue count against initialized firmware slot count","","","2026-10-23",0],["CVE-2026-99002","Linux","Linux","drm/vmwgfx: validate pitch coming from userspace","HIGH",7.8,"2026-10-23",0],["CVE-2026-99001","Linux","Linux","drm/xe/i2c: cancel the client work on remove","","","2026-10-23",0],["CVE-2026-99000","Linux","Linux","drm/xe: Fix shrinker accounting double-subtraction on nested external pins","","","2026-10-23",0],["CVE-2026-98999","Linux","Linux","drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","HIGH",7.8,"2026-10-23",0],["CVE-2026-98998","Linux","Linux","drm/bridge: th1520-dw-hdmi: Fix remove() callback","","","2026-10-23",0],["CVE-2026-98997","Linux","Linux","drm/amdgpu/userq: only accept doorbell BOs as queue doorbell","","","2026-10-23",0],["CVE-2026-98996","Linux","Linux","fs: don't silently unmount busy mounts","","","2026-10-23",0],["CVE-2026-98995","Linux","Linux","namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","HIGH",7.8,"2026-10-23",0],["CVE-2026-98994","Linux","Linux","statmount: read the parent of an unmounted mount under mount_lock","","","2026-10-23",0],["CVE-2026-98993","Linux","Linux","namespace: don't inherit MNT_UMOUNT in clone_mnt()","HIGH",7.8,"2026-10-23",0],["CVE-2026-98992","Linux","Linux","namespace: don't copy an unmounted mount tree","","","2026-10-23",0],["CVE-2026-98991","Linux","Linux","namespace: queue a mount only once for mount notifications","HIGH",7.8,"2026-10-23",0],["CVE-2026-98990","Linux","Linux","namespace: check a submount for references right before unmounting it","","","2026-10-23",0],["CVE-2026-98989","Linux","Linux","namespace: check a recursive bind mount for mount namespace loops","","","2026-10-23",0],["CVE-2026-98988","Linux","Linux","namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE","HIGH",8.8,"2026-10-23",0],["CVE-2026-98987","Linux","Linux","namespace: look at the topmost mount for a mount namespace file","","","2026-10-23",0],["CVE-2026-98986","Linux","Linux","namespace: remove the fsnotify marks of a mount namespace in process context","","","2026-10-23",0],["CVE-2026-98985","Linux","Linux","namespace: check the mounts before reading their parents in pivot_root()","","","2026-10-23",0],["CVE-2026-98984","Linux","Linux","dcache: don't put a mountpoint on a dentry that's being removed","","","2026-10-23",0],["CVE-2026-98983","Linux","Linux","unshare: don't drop active namespace references that were never taken","","","2026-10-23",0],["CVE-2026-98982","Linux","Linux","namespace: don't let a pseudo dentry become the root of a mount","HIGH",7.8,"2026-10-23",0],["CVE-2026-98981","Linux","Linux","namespace: unhash a dentry before detaching the mounts on it","HIGH",8.8,"2026-10-23",0],["CVE-2026-98980","Linux","Linux","namei: don't reveal overmounted entries in refwalk","HIGH",8.8,"2026-10-23",0],["CVE-2026-98979","Linux","Linux","namespace: refuse an automount below a mount that is in no namespace","","","2026-10-23",0],["CVE-2026-98978","Linux","Linux","namespace: never expire a locked mount","HIGH",8.4,"2026-10-23",0],["CVE-2026-98977","Linux","Linux","namespace: handle mount locking for automounts correctly","","","2026-10-23",0],["CVE-2026-98976","Linux","Linux","namespace: keep the lock on a mount that a propagated copy is moved beneath","HIGH",7.8,"2026-10-23",0],["CVE-2026-98975","Linux","Linux","xfs: stop exchanging reflink flags when exchanging mappings","HIGH",7.8,"2026-10-23",0],["CVE-2026-98974","Linux","Linux","xfs: fix exchange-range-to-eof file size exchange","HIGH",7.8,"2026-10-23",0],["CVE-2026-98973","Linux","Linux","drm/bridge: Fix unlocked list_del in drm_bridge_add()","","","2026-10-23",0],["CVE-2026-98972","Linux","Linux","cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","","","2026-10-23",0],["CVE-2026-98971","Linux","Linux","gpio: exar: initialize the ID before registering its cleanup","","","2026-10-23",0],["CVE-2026-98970","Linux","Linux","drm/vc4: Free the BO cache size list on teardown","","","2026-10-23",0],["CVE-2026-98969","Linux","Linux","net/sched: em_text: reject unterminated algo before autoload","","","2026-10-23",0],["CVE-2026-98968","Linux","Linux","amt: send the relay's General Query directly from the receive path","HIGH",8.1,"2026-10-23",0],["CVE-2026-98967","Linux","Linux","cxgb4/ch_ktls: disable softirqs around tid_list erases","","","2026-10-23",0],["CVE-2026-98966","Linux","Linux","bonding: fix the program leak when XDP is replaced","","","2026-10-23",0],["CVE-2026-98965","Linux","Linux","ice: Restore Ordered MMIO Writes for Tx Doorbells","HIGH",7.5,"2026-10-23",0],["CVE-2026-98964","Linux","Linux","nvmet: use the local P2P device on metadata allocation failure","HIGH",7.5,"2026-10-23",0],["CVE-2026-98963","Linux","Linux","btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio","","","2026-10-23",0],["CVE-2026-98962","Linux","Linux","btrfs: free iov when btrfs_uring_read_extent() fails","","","2026-10-23",0],["CVE-2026-98961","Linux","Linux","btrfs: unlock inode and extent in caller when io_uring read extent fails","","","2026-10-23",0],["CVE-2026-98960","Linux","Linux","btrfs: don't stash io_uring encoded data across -EAGAIN","","","2026-10-23",0],["CVE-2026-98959","Linux","Linux","btrfs: fix xattr replace when multiple xattrs are packed in the same item","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-98958","Linux","Linux","wifi: mt76: account non-AQL frames per peer rather than per link","","","2026-10-23",0],["CVE-2026-98957","Linux","Linux","wifi: mt76: mt7915: disable rx napi when removing device","","","2026-10-23",0],["CVE-2026-98956","Linux","Linux","ASoC: adau1372: allow sleepy powerdown GPIOs","","","2026-10-23",0],["CVE-2026-98955","Linux","Linux","flow_dissector: avoid u16 truncation of skb->len when computing thoff","","","2026-10-23",0],["CVE-2026-98953","Linux","Linux","devlink: fix devlink_rel reference leak when notify work is pending","","","2026-10-23",0],["CVE-2026-98954","Linux","Linux","net: always dissect GSO packets in __virtio_net_hdr_to_skb()","","","2026-10-23",0],["CVE-2026-98952","Linux","Linux","pfcp: make sure the SEID is linear before reading it","HIGH",7.3,"2026-10-23",0],["CVE-2026-98951","Linux","Linux","riscv: ptrace: Zero-initialize regset buffers before copyin","","","2026-10-23",0],["CVE-2026-98950","Linux","Linux","flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()","","","2026-10-23",0],["CVE-2026-98948","Linux","Linux","mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()","","","2026-10-23",0],["CVE-2026-98949","Linux","Linux","drm/imagination: Fix reference and vm_bo handling in remap()","","","2026-10-23",0],["CVE-2026-98947","Linux","Linux","vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","","","2026-10-23",0],["CVE-2026-98946","Linux","Linux","drm/vc4: Disable the V3D interrupt across runtime suspend","","","2026-10-23",0],["CVE-2026-98945","Linux","Linux","HID: steam: Rearrange teardown sequence","HIGH",7.8,"2026-10-23",0],["CVE-2026-98944","Linux","Linux","HID: steam: Refactor registration","HIGH",7.8,"2026-10-23",0],["CVE-2026-98943","Linux","Linux","HID: steam: Clean up locking","","","2026-10-23",0],["CVE-2026-54711","Aiven-Open","pghoard","PGHoard: Password written to debug log","LOW",2.4,"2026-10-23",0],["CVE-2026-63120","Aiven-Open","pghoard","PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write","HIGH",8.4,"2026-10-23",0],["CVE-2026-98942","Linux","Linux","sched_ext: Build the cid tables privately and publish them with RCU","","","2026-10-23",0],["CVE-2026-98941","Linux","Linux","ext4: don't enable large folios on encrypted inodes","HIGH",7,"2026-10-23",0],["CVE-2026-98940","Linux","Linux","ASoC: qcom: lpass-cpu: use DAI table index for playback constraints","","","2026-10-23",0],["CVE-2026-98939","Linux","Linux","x86/mm: Drop unnecessary PMD page copy when freeing","","","2026-10-23",0],["CVE-2026-98938","Linux","Linux","rust: irq: pass RegistrationInner as cookie to request_irq","","","2026-10-23",0],["CVE-2026-98937","Linux","Linux","perf/core: Check kernel access when kernel callchains are requested","","","2026-10-23",0],["CVE-2026-98936","Linux","Linux","wifi: ath11k: reset ar->num_stations on hardware start","","","2026-10-23",0],["CVE-2026-98935","Linux","Linux","rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak","","","2026-10-23",0],["CVE-2026-98934","Linux","Linux","ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()","","","2026-10-23",0],["CVE-2026-98933","Linux","Linux","usb: hub: use shorter 120ms post resume hold for SS root hubs","","","2026-10-23",0],["CVE-2026-98932","Linux","Linux","EDAC/altera: Fix use-after-free in error paths","HIGH",7.4,"2026-10-23",0],["CVE-2026-98931","Linux","Linux","mtd: spinand: fix NULL pointer dereference with no ECC engine","","","2026-10-23",0],["CVE-2026-57117","MervinPraison","PraisonAI","PraisonAI: Compute-bridged file tools allow shell command injection","HIGH",8.8,"2026-10-23",0],["CVE-2026-98930","Linux","Linux","KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","","","2026-10-23",0],["CVE-2026-57146","MervinPraison","PraisonAI","PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b","HIGH",7.5,"2026-10-23",0],["CVE-2026-98929","Linux","Linux","macsec: initialize SecY before registering the netdevice","","","2026-10-23",0],["CVE-2026-98928","Linux","Linux","KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2","","","2026-10-23",0],["CVE-2026-57144","MervinPraison","PraisonAI","PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is","HIGH",8.8,"2026-10-23",0],["CVE-2026-57142","MervinPraison","PraisonAI","PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous","HIGH",7.8,"2026-10-23",0],["CVE-2026-57121","MervinPraison","PraisonAI","PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co","HIGH",8.1,"2026-10-23",0],["CVE-2026-57116","MervinPraison","PraisonAI","PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-98927","Linux","Linux","KVM: arm64: nv: Fix life cycle of the nested_mmus array","HIGH",7,"2026-10-23",0],["CVE-2026-98926","Linux","Linux","drm/amd/display: Remove sink usage from DPMS","","","2026-10-23",0],["CVE-2026-98925","Linux","Linux","bpf, sockmap: Fix self-redirect copied_seq double-counting","","","2026-10-23",0],["CVE-2026-57114","MervinPraison","PraisonAI","PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding","HIGH",7.2,"2026-10-23",0],["CVE-2026-57113","MervinPraison","PraisonAI","PraisonAI GitHub template cache path traversal allows outside-cache file write and directo","HIGH",8.1,"2026-10-23",0],["CVE-2026-98924","Linux","Linux","fs: avoid repeated scans in evict_inodes()","","","2026-10-23",0],["CVE-2026-98923","Linux","Linux","arm64: io: Reject non-user protection in ioremap_prot()","","","2026-10-23",0],["CVE-2026-98922","Linux","Linux","net: emac: move setting of netops to fix crash","","","2026-10-23",0],["CVE-2026-98921","Linux","Linux","ovl: fix UAF in ovl_do_mkdir() debug print","","","2026-10-23",0],["CVE-2026-98920","Linux","Linux","netfs: Fix missing alloc tagging of direct mempool allocations","","","2026-10-23",0],["CVE-2026-98919","Linux","Linux","drm/xe: harden adjust_idledly() against divide-by-zero and overflow","","","2026-10-23",0],["CVE-2026-98918","Linux","Linux","mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()","","","2026-10-23",0],["CVE-2026-98917","Linux","Linux","parisc: Increase kernel stack size to 32kb","","","2026-10-23",0],["CVE-2026-56840","MervinPraison","PraisonAI","PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa","HIGH",8.8,"2026-10-23",0],["CVE-2026-56838","MervinPraison","PraisonAI","PraisonAI recipe.run_stream skips dangerous-tool policy enforcement","HIGH",7.8,"2026-10-23",0],["CVE-2026-56837","MervinPraison","PraisonAI","PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing","HIGH",8.6,"2026-10-23",0],["CVE-2026-56836","MervinPraison","PraisonAI","PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard","HIGH",8.2,"2026-10-23",0],["CVE-2026-56835","MervinPraison","PraisonAI","PraisonAI Slack app_mention bypasses configured user/channel authorization","HIGH",8.3,"2026-10-23",0],["CVE-2026-56834","MervinPraison","PraisonAI","PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag","HIGH",7.5,"2026-10-23",0],["CVE-2026-56833","MervinPraison","PraisonAI","PraisonAI Dynamic Context history and terminal tools read files outside configured storage","HIGH",7.5,"2026-10-23",0],["CVE-2026-56832","MervinPraison","PraisonAI","PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals","HIGH",8.8,"2026-10-23",0],["CVE-2026-98916","Linux","Linux","wifi: nl80211: check link is beaconing for color change","","","2026-10-23",0],["CVE-2026-98915","Linux","Linux","media: video-i2c: use vb2_video_unregister_device on driver removal","","","2026-10-23",0],["CVE-2026-98914","Linux","Linux","drm/amdgpu: cap ATOM command table nesting depth","","","2026-10-23",0],["CVE-2026-98913","Linux","Linux","net: thunderx: fix PTP device ref leak in nicvf_probe()","","","2026-10-23",0],["CVE-2026-98912","Linux","Linux","ALSA: seq: oss: Reject reads that cannot fit the next event","","","2026-10-23",0],["CVE-2026-98911","Linux","Linux","dpaa2-switch: fix the error path in dpaa2_switch_rx()","HIGH",7.5,"2026-10-23",0],["CVE-2026-98910","Linux","Linux","drm/amdkfd: Unwind debug trap enable on copy_to_user failure","","","2026-10-23",0],["CVE-2026-98909","Linux","Linux","net: cpsw_new: unregister devlink on port registration failure","","","2026-10-23",0],["CVE-2026-98908","Linux","Linux","net: microchip: sparx5: clean up PSFP resources on flower setup failure","","","2026-10-23",0],["CVE-2026-98907","Linux","Linux","btrfs: protect sb_write_pointer() with invalidate lock","","","2026-10-23",0],["CVE-2026-98906","Linux","Linux","net: lan966x: restore RX state on reload failure","","","2026-10-23",0],["CVE-2026-98905","Linux","Linux","drm/amdkfd: Properly acquire queue buffers in CRIU restore","","","2026-10-23",0],["CVE-2026-98904","Linux","Linux","mailbox: imx: Use devm_pm_runtime_enable()","","","2026-10-23",0],["CVE-2026-98903","Linux","Linux","mailbox: imx: Add a channel shutdown field","","","2026-10-23",0],["CVE-2026-98902","Linux","Linux","md/raid5: let stripe batch bm_seq comparison wrap-safe","","","2026-10-23",0],["CVE-2026-98901","Linux","Linux","ksmbd: fix lease break and ack state handling","","","2026-10-23",0],["CVE-2026-98900","Linux","Linux","xen/gntalloc: validate grant count before allocation","","","2026-10-23",0],["CVE-2026-98899","Linux","Linux","netfilter: ipset: mark the rcu locked areas properly","HIGH",7.8,"2026-10-23",0],["CVE-2026-98898","Linux","Linux","drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized","","","2026-10-23",0],["CVE-2026-98897","Linux","Linux","ksmbd: don't hold ci->m_lock while waiting for a lease break ack","","","2026-10-23",0],["CVE-2026-112904","givanz","Vvveb","Vvveb: Path Traversal in nextRestore() and nextBackup()","HIGH",8.7,"2026-10-23",0],["CVE-2026-98896","Linux","Linux","thunderbolt: Keep the domain reference while processing hotplug","","","2026-10-23",0],["CVE-2026-98895","Linux","Linux","net/mlx5: HWS, Handle destroying table that has a miss table","HIGH",7,"2026-10-23",0],["CVE-2026-98894","Linux","Linux","drm/amd/ras: reset CPER ring on corrupt entry size","","","2026-10-23",0],["CVE-2026-98893","Linux","Linux","firmware: arm_scmi: Validate SENSOR_UPDATE payload size","","","2026-10-23",0],["CVE-2026-98892","Linux","Linux","firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size","","","2026-10-23",0],["CVE-2026-98891","Linux","Linux","wifi: mac80211: validate deauth frame length before reason access","","","2026-10-23",0],["CVE-2026-98890","Linux","Linux","wifi: libertas: reject short monitor TX frames","","","2026-10-23",0],["CVE-2026-98889","Linux","Linux","wifi: iwlwifi: mvm: fix sched scan IE sizing","HIGH",7.8,"2026-10-23",0],["CVE-2026-98888","Linux","Linux","arm64: kprobes: Allow reentering kprobes while single-stepping","","","2026-10-23",0],["CVE-2026-98887","Linux","Linux","wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO","","","2026-10-23",0],["CVE-2026-98886","Linux","Linux","drm/gma500: return errors from Oaktrail HDMI I2C reads","","","2026-10-23",0],["CVE-2026-98885","Linux","Linux","ima: return error early if file xattr cannot be changed","","","2026-10-23",0],["CVE-2026-98884","Linux","Linux","mmc: core: Add validation for host-provided max_segs","","","2026-10-23",0],["CVE-2026-98883","Linux","Linux","serial: 8250_port: recognize UPIO_AU","","","2026-10-23",0],["CVE-2026-98882","Linux","Linux","media: chips-media: wave5: Add range checks for dec_output_info","","","2026-10-23",0],["CVE-2026-98881","Linux","Linux","net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()","","","2026-10-23",0],["CVE-2026-98880","Linux","Linux","ntfs3: handle set_blocksize failures","","","2026-10-23",0],["CVE-2026-98879","Linux","Linux","isofs: handle set_blocksize failures","","","2026-10-23",0],["CVE-2026-98878","Linux","Linux","irqchip/gic-v5: Immediately exec priority drop following activate","","","2026-10-23",0],["CVE-2026-98877","Linux","Linux","irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed","","","2026-10-23",0],["CVE-2026-98876","Linux","Linux","host1x: bus: Fix missing ops null check in error teardown","","","2026-10-23",0],["CVE-2026-98875","Linux","Linux","drm/nouveau/gsp: add SEC2 to GA100 chip table","","","2026-10-23",0],["CVE-2026-98874","Linux","Linux","wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect","","","2026-10-23",0],["CVE-2026-98873","Linux","Linux","netfilter: nf_conntrack_expect: zero at allocation time","","","2026-10-23",0],["CVE-2026-98872","Linux","Linux","freevxfs: don't BUG() on unknown typed-extent type","","","2026-10-23",0],["CVE-2026-98871","Linux","Linux","crypto: ccp - Fix possible deadlock in SEV init failure path","","","2026-10-23",0],["CVE-2026-98870","Linux","Linux","ksmbd: remove stale channels from all sessions on teardown","HIGH",8.8,"2026-10-23",0],["CVE-2026-115726","Aider-AI","aider","Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings","HIGH",8.5,"2026-10-23",0],["CVE-2026-115727","Fosowl","AgenticSeek","AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server","CRITICAL",9.2,"2026-10-23",0],["CVE-2026-115725","chatwoot","chatwoot","Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id","LOW",2.3,"2026-10-23",0],["CVE-2026-115723","davenardella","snap7","Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion","HIGH",8.3,"2026-10-23",0],["CVE-2026-115724","VideoLAN","VLC for Android","VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider","LOW",2.1,"2026-10-23",0],["CVE-2026-115722","diegonehab","rply","RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-107685","agentjido","req_llm","WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to o","CRITICAL",9.1,"2026-10-23",0],["CVE-2026-95620","qt","qt","Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt","LOW",2.1,"2026-10-23",0],["CVE-2026-94263","","Advanced Custom Fields: Extended","Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode E","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-111965","","Profile Builder","Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-105963","elixir-plug","plug","Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments","MEDIUM",5.1,"2026-10-23",0],["CVE-2026-16762","qt","qt","Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impact","HIGH",8.7,"2026-10-23",0],["CVE-2026-89320","Eclipse Foundation","Eclipse KeyPont - GOSE","HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K(\"\") for all inputs, v","HIGH",8.8,"2026-10-23",0],["CVE-2026-25784","Hallo Welt! GmbH","BlueSpice","bluespice/wiki container: Insecure default configuration of service token authentication a","CRITICAL",9.3,"2026-10-23",0],["CVE-2026-89319","Eclipse Foundation","Eclipse KeyPont - GOSE","JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-25716","Hallo Welt! GmbH","BlueSpice","BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking ","HIGH",7.1,"2026-10-23",0],["CVE-2026-89318","Eclipse Foundation","Eclipse KeyPont - GOSE","JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.O","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-89317","Eclipse Foundation","Eclipse KeyPont - GOSE","JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-89316","Eclipse Foundation","Eclipse KeyPont - GOSE","LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOp","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-89315","Eclipse Foundation","Eclipse KeyPont - GOSE","JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a vali","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-89314","Eclipse Foundation","Eclipse KeyPont - GOSE","Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-89313","Eclipse Foundation","Eclipse KeyPont - GOSE","JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is a","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-89312","Eclipse Foundation","Eclipse KeyPont - GOSE","AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length che","MEDIUM",6.9,"2026-10-23",0],["CVE-2025-58403","CGM","CGM CLININET","Reflected Cross-Site Scripting (XSS) in CGM CLININET","MEDIUM",5.1,"2026-10-23",0],["CVE-2025-30053","CGM","CGM CLININET","Missing Authentication in CGM CLININET","MEDIUM",6.9,"2026-10-23",0],["CVE-2025-30054","CGM","CGM CLININET","Local Privilege Escalation in CGM CLININET","CRITICAL",9.3,"2026-10-23",0],["CVE-2025-30052","CGM","CGM CLININET","Authentication Bypass via IP Spoofing in CGM CLININET rsyncd","HIGH",8.8,"2026-10-23",0],["CVE-2025-30050","CGM","CGM CLININET","Remote Code Execution in CGM CLININET","CRITICAL",9.4,"2026-10-23",0],["CVE-2025-30051","CGM","CGM CLININET","Insecure File Permissions in CGM CLININET","MEDIUM",6.8,"2026-10-23",0],["CVE-2025-30049","CGM","CGM CLININET","Use of Unsalted MD5 Password Hashes in CGM CLININET","HIGH",8.2,"2026-10-23",0],["CVE-2025-30046","CGM","CGM CLININET","Remote Code Execution in CGM CLININET","CRITICAL",9,"2026-10-23",0],["CVE-2025-30047","CGM","CGM CLININET","Remote Code Execution via Java Deserialization in CGM CLININET","CRITICAL",9.4,"2026-10-23",0],["CVE-2025-30043","CGM","CGM CLININET","Missing Authentication in CGM CLININET","HIGH",7.1,"2026-10-23",0],["CVE-2025-30045","CGM","CGM CLININET","Code Injection in CGM CLININET","HIGH",8.6,"2026-10-23",0],["CVE-2026-115657","KNIME","KNIME Analytics Platform","KNIME Analytics Platform logs credentials of configured proxy when used as an executor","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-112860","xnau webdesign","Participants Database","WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-23",0],["CVE-2026-112862","xnau webdesign","Participants Database","WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-112359","Amauri.IO","WPMobile.App","WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-23",0],["CVE-2026-112821","Knit Pay","Knit Pay","WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-112825","Magepeople inc.","Car Rental Manager","WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-23",0],["CVE-2026-112835","e4jvikwp","VikRentCar","WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-23",0],["CVE-2026-112837","Ruben Garcia","GamiPress","WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability","HIGH",8.5,"2026-10-23",0],["CVE-2026-112838","e4jvikwp","VikRentCar","WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-23",0],["CVE-2026-4952","VertiGIS Ltd.","WebOrderSystem (AuftragsManager)","Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business R","MEDIUM",5.1,"2026-10-23",0],["CVE-2026-4951","VertiGIS Ltd.","WebOrderSystem (KundenManager)","Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS","MEDIUM",5.1,"2026-10-23",0],["CVE-2026-4950","VertiGIS Ltd.","WebOrderSystem (KundenManager)","Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS W","MEDIUM",4.8,"2026-10-23",0],["CVE-2026-63244","WizLearn Technologies Pte. Ltd.","Learning Management System","Authentication Bypass Vulnerability","CRITICAL",9.8,"2026-10-23",0],["CVE-2026-75775","ASUS","Router","Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers ","HIGH",7.7,"2026-10-23",0],["CVE-2026-93489","ASUS","Router","Improper Authentication in ASUS router modules allows an unauthenticated nearby user to se","HIGH",8.7,"2026-10-23",0],["CVE-2026-75779","ASUS","Router","Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”)","HIGH",8.6,"2026-10-23",0],["CVE-2026-63243","Creative Labs","Creative Sound Blaster Katana V2, V2X, SE","Firmware verification vulnerability","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-55981","Creative Labs","Creative Sound Blaster Katana V2, V2X, SE","Firmware verification vulnerability","CRITICAL",9.6,"2026-10-23",0],["CVE-2026-94264","","Advanced Custom Fields: Extended","Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode A","MEDIUM",6.8,"2026-10-23",0],["CVE-2026-94267","","Advanced Custom Fields: Extended","Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update","CRITICAL",9,"2026-10-23",0],["CVE-2026-94268","","Advanced Custom Fields: Extended","Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover ","HIGH",8.1,"2026-10-23",0],["CVE-2026-113499","","LiteSpeed Cache","LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting","HIGH",7.5,"2026-10-23",0],["CVE-2026-113500","","LiteSpeed Cache","LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization","HIGH",7.5,"2026-10-23",0],["CVE-2026-113501","","LiteSpeed Cache","LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal","LOW",3.1,"2026-10-23",0],["CVE-2026-94262","","Advanced Custom Fields: Extended","Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeo","HIGH",8.1,"2026-10-23",0],["CVE-2026-111966","","User Profile Builder","Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute","MEDIUM",6.8,"2026-10-23",0],["CVE-2026-111982","","User Profile Builder","Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vi","HIGH",7.2,"2026-10-23",0],["CVE-2026-112219","","Download Monitor","Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved D","MEDIUM",4.9,"2026-10-23",0],["CVE-2026-112230","","Popup Builder","Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter","LOW",3.7,"2026-10-23",0],["CVE-2026-113472","","Depicter — Popup & Slider Builder","Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-109936","","Otter Blocks","Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter","HIGH",7.5,"2026-10-23",0],["CVE-2026-110510","","Essential Addons for Elementor","Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and P","LOW",3.5,"2026-10-23",0],["CVE-2026-110537","","Essential Addons for Elementor","Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via ","LOW",3.8,"2026-10-23",0],["CVE-2026-111737","","Speed Optimizer","Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists","LOW",3.5,"2026-10-23",0],["CVE-2026-111738","","Speed Optimizer","Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option","MEDIUM",5.5,"2026-10-23",0],["CVE-2026-109933","","Otter Blocks","Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes","MEDIUM",6.8,"2026-10-23",0],["CVE-2026-109934","","Otter Blocks","Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-109935","","Otter Blocks","Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-107858","Google","Agent Development Kit (ADK) for Java","Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) f","HIGH",7.2,"2026-10-23",0],["CVE-2026-109198","cleantalk","CleanTalk Anti-Spam – Complete Spam Protection","Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_e","HIGH",7.2,"2026-10-23",0],["CVE-2026-115497","codepeople","Music Store – WordPress eCommerce","Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter","HIGH",7.5,"2026-10-23",0],["CVE-2026-55835","Lookyloo","lookyloo","Lookyloo: Potential sub-system DoS due to parameter missmatch in notification","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-86055","Part-DB","Part-DB-server","Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authenticati","HIGH",8.7,"2026-10-23",0],["CVE-2026-86020","Part-DB","Part-DB-server","Part-DB: Spreadsheet Formula Injection in XLSX Part Exports","MEDIUM",4.6,"2026-10-23",0],["CVE-2026-86019","Part-DB","Part-DB-server","Part-DB: Attachment Size Limit Bypass via API Base64 Upload","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-86018","Part-DB","Part-DB-server","Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-59188","Part-DB","Part-DB-server","Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-55600","Part-DB","Part-DB-server","Part-DB: Stored HTML injection in BOM validation results via unescaped Part name","MEDIUM",5.7,"2026-10-23",0],["CVE-2026-54631","Part-DB","Part-DB-server","Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-90458","OpenStack","Ironic","OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete ","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-54630","Part-DB","Part-DB-server","Part-DB: Authenticated RCE via .phar attachment upload served from public/media","CRITICAL",9.6,"2026-10-23",0],["CVE-2026-54615","Part-DB","Part-DB-server","Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized Collecti","MEDIUM",6,"2026-10-23",0],["CVE-2026-89419","OpenStack","Ironic","OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting o","MEDIUM",5,"2026-10-23",0],["CVE-2026-115638","OpenStack","Ironic","OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results ","MEDIUM",4.3,"2026-10-23",0],["CVE-2026-115547","Okta","Okta Access Gateway","Command Execution via Admin Console Input in Okta Access Gateway","CRITICAL",9.1,"2026-10-23",0],["CVE-2026-115546","Okta","Okta Access Gateway","Authentication Source Verification Issue in Okta Access Gateway","HIGH",8.1,"2026-10-23",0],["CVE-2026-115537","gedelumbung","HospitalManagement","gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-19678","onPhase","onPhase Forms","Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure","HIGH",8.7,"2026-10-23",0],["CVE-2026-19677","onPhase","onPhase Forms","Authentication Bypass Leading to Server-Side Command Execution","CRITICAL",9.3,"2026-10-23",0],["CVE-2026-115536","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-115486","Red Hat","Red Hat Enterprise Linux 10","Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiu","HIGH",7.1,"2026-10-23",0],["CVE-2026-115485","Red Hat","Red Hat Enterprise Linux 10","Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte wri","MEDIUM",6.3,"2026-10-23",0],["CVE-2026-115484","Red Hat","Red Hat Enterprise Linux 10","Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg","HIGH",7.6,"2026-10-23",0],["CVE-2026-115535","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting","MEDIUM",4.8,"2026-10-23",0],["CVE-2025-45528","","","An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to ","","","2026-10-23",0],["CVE-2026-106763","","","An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arb","HIGH",7.5,"2026-10-23",0],["CVE-2026-106764","","","An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code ","HIGH",7.5,"2026-10-23",0],["CVE-2026-106765","","","An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary co","HIGH",7.5,"2026-10-23",0],["CVE-2026-50787","","","e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption v","","","2026-10-23",0],["CVE-2026-52356","","","An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link","","","2026-10-23",0],["CVE-2026-115534","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting","MEDIUM",5.3,"2026-10-23",0],["CVE-2026-110825","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder Missing Authentication for Critical Function","HIGH",8.7,"2026-10-23",0],["CVE-2026-92450","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder Use of Hard-coded Credentials","HIGH",8.7,"2026-10-23",0],["CVE-2026-110243","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder OS Command Injection","CRITICAL",9.4,"2026-10-23",0],["CVE-2026-107861","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder OS Command Injection","CRITICAL",9.4,"2026-10-23",0],["CVE-2026-110491","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder NULL Pointer Dereference","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-105265","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder Path Traversal","MEDIUM",6,"2026-10-23",0],["CVE-2026-96616","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder Insufficient Session Expiration","HIGH",8.3,"2026-10-23",0],["CVE-2026-111100","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder Missing Authentication for Critical Function","MEDIUM",6.9,"2026-10-23",0],["CVE-2026-109122","Kiloview","E3 Firmware","Kiloview E3 NDI Encoder OS Command Injection","CRITICAL",9.4,"2026-10-23",0],["CVE-2026-110063","Microsoft","VM Inspector for Azure Virtual Machines","VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability","CRITICAL",10,"2026-10-23",0],["CVE-2026-83938","Microsoft","Azure Kubernetes Configuration Service","Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability","CRITICAL",10,"2026-10-23",0],["CVE-2026-96185","Microsoft","Microsoft Exchange Online","Microsoft Exchange Online Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-23",0],["CVE-2026-97785","Microsoft","Microsoft Entra application proxy","AAD App Proxy Elevation of Privilege Vulnerability","CRITICAL",10,"2026-10-23",0],["CVE-2026-105014","Microsoft","Azure Pipelines","Azure Pipelines Remote Code Execution Vulnerability","CRITICAL",9.1,"2026-10-23",0],["CVE-2026-108456","Microsoft","Azure AI Foundry","Azure AI Foundry Elevation of Privilege Vulnerability","HIGH",7.7,"2026-10-23",0],["CVE-2026-111594","InterSystems","IRIS for Health","InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive ","CRITICAL",9.2,"2026-10-23",0],["CVE-2026-114620","authlib","authlib","Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading ","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-114619","authlib","authlib","Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID","MEDIUM",4.6,"2026-10-23",0],["CVE-2026-114618","authlib","authlib","Authlib: Default JWT bearer grant accepts assertions for the wrong audience","MEDIUM",6.8,"2026-10-23",0],["CVE-2026-114617","authlib","authlib","Authlib: ID token can disable its own nonce validation via the nonce_supported claim","MEDIUM",4.2,"2026-10-23",0],["CVE-2026-115449","Red Hat","Red Hat Enterprise Linux 10","Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest","LOW",3.5,"2026-10-23",0],["CVE-2026-114616","authlib","authlib","Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)","HIGH",7.4,"2026-10-23",0],["CVE-2026-115221","Red Hat","Red Hat Enterprise Linux 10","Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership","MEDIUM",5.4,"2026-10-23",0],["CVE-2026-115424","Red Hat","Red Hat OpenShift Container Platform 4","Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write ou","MEDIUM",5.5,"2026-10-23",0],["CVE-2026-114615","authlib","authlib","Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys","HIGH",7.4,"2026-10-23",0],["CVE-2026-114614","authlib","authlib","Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo componen","LOW",2.6,"2026-10-23",0],["CVE-2026-114583","Python Software Foundation","CPython","tar filter allows writing outside destination via empty-named symlink","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114625","Arista Networks","VeloCloud Orchestrator","Security Advisory 0199","CRITICAL",9.4,"2026-10-22",1],["CVE-2026-115417","AWS","aws-c-mqtt","Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws","HIGH",8.2,"2026-10-22",0],["CVE-2026-115419","AWS","strands-agents","Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server","HIGH",8.6,"2026-10-22",0],["CVE-2026-112332","GDATASoftwareAG","motornet","Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization","HIGH",8.7,"2026-10-22",0],["CVE-2026-112331","GDATASoftwareAG","motornet","Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping","HIGH",8.7,"2026-10-22",0],["CVE-2026-112330","GDATASoftwareAG","motornet","Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers","HIGH",8.7,"2026-10-22",0],["CVE-2026-115509","jitsucom","jitsu","Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state","LOW",2.3,"2026-10-22",0],["CVE-2026-115507","go-vikunja","vikunja","Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header","MEDIUM",5.1,"2026-10-22",0],["CVE-2026-115508","unclecode","crawl4ai","Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields","HIGH",7.1,"2026-10-22",0],["CVE-2026-115506","libexpat","libexpat","libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay","HIGH",8.7,"2026-10-22",0],["CVE-2026-115505","sahlberg","libsmb2","libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum","HIGH",7.2,"2026-10-22",0],["CVE-2026-115504","HEASARC","cfitsio","CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c","HIGH",8.5,"2026-10-22",0],["CVE-2026-115398","NationalSecurityAgency","ghidra","Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-115503","NationalSecurityAgency","ghidra","Ghidra before 12.2 Denial of Service via Compressed Extension Archive","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-115397","NationalSecurityAgency","ghidra","Ghidra before 12.2 Denial of Service via Extension Archive Install","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-115396","NationalSecurityAgency","ghidra","Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-114655","MongoDB","libmongocrypt","KMS request injection via unsanitized key vault and provider values in libmongocrypt","MEDIUM",6,"2026-10-22",0],["CVE-2026-115394","NationalSecurityAgency","ghidra","Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-115395","NationalSecurityAgency","ghidra","Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-114654","MongoDB","C# Driver","BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115393","bytecodealliance","wasmtime","Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47","LOW",1,"2026-10-22",0],["CVE-2026-114653","MongoDB","C# Driver","Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde","HIGH",7.1,"2026-10-22",0],["CVE-2026-115392","bytecodealliance","wasmtime","Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47","HIGH",8.8,"2026-10-22",0],["CVE-2026-114652","MongoDB","C# Driver","Update operator injection via single-element list rewriting in the update builder","HIGH",7.1,"2026-10-22",0],["CVE-2026-115391","bytecodealliance","wasmtime","Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114651","MongoDB","C# Driver","Cross-document data leak via malformed BSON array parsing in reused thread buffer","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114650","MongoDB","C# Driver","Plaintext exposure of encrypted fields via ANSI code-page corruption of database name","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115389","bytecodealliance","wasmtime","Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service ","LOW",1,"2026-10-22",0],["CVE-2026-115390","bytecodealliance","wasmtime","Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114649","MongoDB","C# Driver","Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca","HIGH",7.6,"2026-10-22",0],["CVE-2026-115388","bytecodealliance","wasmtime","Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion ","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114648","MongoDB","C# Driver","NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke","HIGH",7.2,"2026-10-22",0],["CVE-2026-115387","bytecodealliance","wasmtime","Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WAS","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115385","bytecodealliance","wasmtime","Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115386","bytecodealliance","wasmtime","Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure ","LOW",2.1,"2026-10-22",0],["CVE-2026-114647","MongoDB","C# Driver","NoSQL operator injection via unvalidated replacement document in findOneAndReplace","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115384","bytecodealliance","wasmtime","Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow","CRITICAL",9.4,"2026-10-22",0],["CVE-2026-114646","MongoDB","C# Driver","NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115383","bytecodealliance","wasmtime","Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-114645","MongoDB","C Driver","Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message ","MEDIUM",5.7,"2026-10-22",0],["CVE-2026-115381","bytecodealliance","wasmtime","Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Mem","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-115382","bytecodealliance","wasmtime","Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-114644","MongoDB","C# Driver","Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri","HIGH",8.2,"2026-10-22",0],["CVE-2026-115380","bytecodealliance","wasmtime","Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass ","MEDIUM",5.1,"2026-10-22",0],["CVE-2026-114643","MongoDB","C# Driver","Duplicate geometry fields via unvalidated GeoJSON extra members","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115378","lxc","incus","Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Re","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115379","bytecodealliance","wasmtime","Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115377","lxc","incus","Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Sy","CRITICAL",9.4,"2026-10-22",0],["CVE-2026-115376","lxc","incus","Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volu","HIGH",8.3,"2026-10-22",0],["CVE-2026-115375","lxc","incus","Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Depende","CRITICAL",9.4,"2026-10-22",0],["CVE-2026-115373","lxc","incus","Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GE","HIGH",7,"2026-10-22",0],["CVE-2026-115374","lxc","incus","Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upl","HIGH",7.1,"2026-10-22",0],["CVE-2026-115372","lxc","incus","Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options","CRITICAL",9,"2026-10-22",0],["CVE-2026-115370","lxc","incus","Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project B","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115371","lxc","incus","LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential","HIGH",7.1,"2026-10-22",0],["CVE-2026-115369","openbao","openbao","OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs","LOW",2.1,"2026-10-22",0],["CVE-2026-115365","openbao","openbao","OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal","HIGH",7.5,"2026-10-22",0],["CVE-2026-115366","openbao","openbao","OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs","LOW",2,"2026-10-22",0],["CVE-2026-115364","openbao","openbao","OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints","LOW",2.1,"2026-10-22",0],["CVE-2026-115363","openbao","openbao","OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitize","LOW",2.1,"2026-10-22",0],["CVE-2026-115361","openbao","openbao","OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial","LOW",2.1,"2026-10-22",0],["CVE-2026-115362","openbao","openbao","OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass","LOW",2.1,"2026-10-22",0],["CVE-2026-115360","openbao","openbao","OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115358","openbao","openbao","OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters","LOW",2,"2026-10-22",0],["CVE-2026-115359","openbao","openbao","OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-115357","openbao","openbao","OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and ","LOW",2.1,"2026-10-22",0],["CVE-2026-115356","openbao","openbao","OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Rev","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114519","Roskus","Prospero Flow CRM","Missing authorization in the Prospero Flow CRM user API allows a basic role user to read a","HIGH",8.6,"2026-10-22",0],["CVE-2026-115354","lepture","mistune","Mistune before 3.3.0 Arbitrary Local File Read via Include Directive","HIGH",7.1,"2026-10-22",0],["CVE-2026-115355","lepture","mistune","Mistune before 3.3.0 Path Traversal and XSS via Include Directive","HIGH",8.7,"2026-10-22",0],["CVE-2026-115353","lepture","mistune","Mistune before 3.3.0 Path Traversal via include Directive","CRITICAL",9.2,"2026-10-22",0],["CVE-2026-115352","lepture","mistune","Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser","HIGH",8.7,"2026-10-22",0],["CVE-2026-115351","lepture","mistune","Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115349","lepture","mistune","Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing","HIGH",8.7,"2026-10-22",0],["CVE-2026-115350","lepture","mistune","Mistune before 3.3.0 Stored XSS via Include Directive HTML Files","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115348","lepture","mistune","Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text","HIGH",8.7,"2026-10-22",0],["CVE-2026-115347","lepture","mistune","Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text","HIGH",8.7,"2026-10-22",0],["CVE-2022-51026","bytebase","bytebase","Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-95721","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interfac","LOW",3.3,"2026-10-22",0],["CVE-2026-95720","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","MEDIUM",4.4,"2026-10-22",0],["CVE-2026-95719","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10","MEDIUM",4.9,"2026-10-22",0],["CVE-2026-95718","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-95717","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management ","MEDIUM",5.5,"2026-10-22",0],["CVE-2026-95716","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Cha","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-95715","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-95714","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-95713","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command ","HIGH",7,"2026-10-22",0],["CVE-2026-95712","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 v","HIGH",7.1,"2026-10-22",0],["CVE-2026-95711","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Inte","HIGH",7.1,"2026-10-22",0],["CVE-2026-95710","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-1","HIGH",7.1,"2026-10-22",0],["CVE-2026-95709","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Command Injection Vulnerabilities in AOS-10","HIGH",7.2,"2026-10-22",0],["CVE-2026-95708","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10","HIGH",7.2,"2026-10-22",0],["CVE-2026-95707","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","HIGH",7.2,"2026-10-22",0],["CVE-2026-95706","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Command Injection Vulnerabilities in AOS-8","HIGH",7.2,"2026-10-22",0],["CVE-2026-95705","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Command Injection Vulnerabilities in AOS-8","HIGH",7.2,"2026-10-22",0],["CVE-2026-95704","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network","HIGH",7.2,"2026-10-22",0],["CVE-2026-79956","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Improper Sanitization leads to Command Injection in AOS-8 Web Interface","HIGH",7.2,"2026-10-22",0],["CVE-2026-79955","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8","HIGH",7.5,"2026-10-22",0],["CVE-2026-79895","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10","HIGH",7.5,"2026-10-22",0],["CVE-2026-79894","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8","HIGH",7.5,"2026-10-22",0],["CVE-2026-79893","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10","HIGH",7.5,"2026-10-22",0],["CVE-2026-79892","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in A","HIGH",7.8,"2026-10-22",0],["CVE-2026-79891","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","HIGH",8.1,"2026-10-22",0],["CVE-2026-79890","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol","HIGH",8.1,"2026-10-22",0],["CVE-2026-79889","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in ","HIGH",8.1,"2026-10-22",0],["CVE-2026-79888","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow allows Remote Code Execution in web interface","HIGH",8.1,"2026-10-22",0],["CVE-2026-79887","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)","HIGH",8.1,"2026-10-22",0],["CVE-2026-79886","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","HIGH",8.2,"2026-10-22",0],["CVE-2026-79885","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8","HIGH",8.2,"2026-10-22",0],["CVE-2026-79884","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass leads to Sensitive Information Disclosure in AOS-8","HIGH",8.2,"2026-10-22",0],["CVE-2026-79883","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensi","HIGH",8.3,"2026-10-22",0],["CVE-2026-79882","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10","HIGH",8.3,"2026-10-22",0],["CVE-2026-79881","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-8","HIGH",8.5,"2026-10-22",0],["CVE-2026-79880","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8","HIGH",8.7,"2026-10-22",0],["CVE-2026-79879","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution i","HIGH",8.8,"2026-10-22",0],["CVE-2026-79878","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interfa","HIGH",8.8,"2026-10-22",0],["CVE-2026-79877","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10","HIGH",8.8,"2026-10-22",0],["CVE-2026-79876","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-79875","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Acc","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-79874","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass in the API allows Administrative Access of AOS-10","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-79873","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to U","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-79872","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and A","CRITICAL",9.4,"2026-10-22",0],["CVE-2026-79871","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79870","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass leads to Unauthorized Access in AOS-8","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79869","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-10","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79868","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79867","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-8","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79866","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AO","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79865","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79864","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Command Injection Vulnerability in AOS-10","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79863","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79862","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution","CRITICAL",9.6,"2026-10-22",0],["CVE-2026-79861","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79860","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79859","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79858","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79857","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79856","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79855","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79854","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79853","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79852","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Int","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-79851","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10","CRITICAL",10,"2026-10-22",0],["CVE-2026-79850","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-8","CRITICAL",10,"2026-10-22",0],["CVE-2026-79849","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8","CRITICAL",10,"2026-10-22",0],["CVE-2026-79848","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8","CRITICAL",10,"2026-10-22",0],["CVE-2026-79847","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10","CRITICAL",10,"2026-10-22",0],["CVE-2026-79846","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Unauthenticated Command Injection Vulnerabilities in AOS-8","CRITICAL",10,"2026-10-22",0],["CVE-2026-79844","Hewlett Packard Enterprise (HPE)","ArubaOS (AOS)","Authentication Bypass Leading to Remote Code Execution in AOS-10","CRITICAL",10,"2026-10-22",0],["CVE-2026-115414","AWS","aws-sam-cli","OS command injection in the Terraform hook in AWS SAM CLI","HIGH",8.4,"2026-10-22",0],["CVE-2026-114613","msgpack","msgpack-python","MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation fai","HIGH",7.5,"2026-10-22",0],["CVE-2026-115519","KNIME","KNIME Business Hub","Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub","LOW",2.1,"2026-10-22",0],["CVE-2026-115517","KNIME","KNIME Business Hub","Unrestricted network access between execution contexts in KNIME Business Hub","MEDIUM",6.4,"2026-10-22",0],["CVE-2026-114612","BerriAI","litellm","LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","CRITICAL",9.9,"2026-10-22",0],["CVE-2026-113876","SmileCDR","HAPI FHIR","SmileCDR HAPI FHIR unauthorized read","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-113875","SmileCDR","HAPI FHIR","SmileCDR HAPI FHIR unauthorized read via subscription","LOW",2.3,"2026-10-22",0],["CVE-2026-113874","SmileCDR","HAPI FHIR","SmileCDR HAPI FHIR trusted tenant partition override","HIGH",8.6,"2026-10-22",0],["CVE-2026-113873","SmileCDR","HAPI FHIR","SmileCDR HAPI FHIR improper data decompression","HIGH",8.7,"2026-10-22",0],["CVE-2026-97635","Agent Zero","Agent Zero","Agent Zero Web UI XSS","HIGH",8.6,"2026-10-22",0],["CVE-2026-77157","Checkmarx","github.com/checkmarx/ast-cli","ast-cli: Auto-update downloads are not verified against a checksum before execution","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-77156","Checkmarx","github.com/checkmarx/ast-cli","ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-108357","PHPOffice","PhpSpreadsheet","PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Deni","HIGH",8.8,"2026-10-22",0],["CVE-2026-13599","ABB","Ability Edgenius","ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB","MEDIUM",5.8,"2026-10-22",0],["CVE-2026-114611","schorschii","OCO-Server","OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): ","CRITICAL",9.1,"2026-10-22",0],["CVE-2026-108359","PHPOffice","PhpSpreadsheet","PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)","HIGH",8.7,"2026-10-22",0],["CVE-2026-93336","Canonical","Juju","Missing authorization in the unit resources download route in Juju controllers","HIGH",7.1,"2026-10-22",0],["CVE-2026-108358","PHPOffice","PhpSpreadsheet","PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of S","HIGH",8.8,"2026-10-22",0],["CVE-2026-108360","PHPOffice","PhpSpreadsheet","PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath","MEDIUM",6.4,"2026-10-22",0],["CVE-2026-54238","supabase","realtime","Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorizati","LOW",3.1,"2026-10-22",0],["CVE-2026-114610","py-pdf","fpdf2","fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114609","py-pdf","fpdf2","fpdf2 implicitly loads external URLs and local image paths when rendering attacker-control","MEDIUM",5.8,"2026-10-22",0],["CVE-2026-54532","CloudPirates-io","helm-charts","CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poi","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115513","opencats","OpenCATS","OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-115416","AWS","Amazon Athena","Incorrect authorization checks in Amazon Athena engine version 3 query processing","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114608","pylint-dev","pylint","Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_H","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-114607","better-auth","better-auth","better-auth: OAuth state can be used as a Magic Link to sign in as another user","CRITICAL",9.1,"2026-10-22",0],["CVE-2026-114606","jgraph","drawio-desktop","draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)","MEDIUM",5.6,"2026-10-22",0],["CVE-2026-97631","TianoCore","EDK2","Pre-boot RCE in EDK II PXE driver","CRITICAL",9.5,"2026-10-22",0],["CVE-2026-115502","KNIME","KNIME Business Hub","DataApp links without login expose job information to other user in KNIME Business Hub","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-104068","JetBackup","JetBackup","JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore","HIGH",8.6,"2026-10-22",0],["CVE-2026-114605","rthalley","dnspython","dnspython dns.name.from_wire_parser() excessive CPU use","HIGH",7.5,"2026-10-22",0],["CVE-2026-75507","graphql-python","graphql-core","GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerg","HIGH",7.5,"2026-10-22",0],["CVE-2026-75508","graphql-python","graphql-core","GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit","HIGH",7.5,"2026-10-22",0],["CVE-2026-115496","KNIME","KNIME Business Hub","Workflow names may be leaked to unauthenticated users in KNIME Business Hub","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114487","Devolutions","Server","Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.","","","2026-10-22",0],["CVE-2026-115494","KNIME","KNIME Business Hub","CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114486","Devolutions","Server","Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server ","","","2026-10-22",0],["CVE-2026-114485","Devolutions","Server","Insufficient protection of sensitive information in the user list endpoint in Devolutions ","","","2026-10-22",0],["CVE-2026-114603","open-telemetry","opentelemetry-python","OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115454","KNIME","KNIME Business Hub","Large tables in data apps can bring down execution services in KNIME Hub","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-94482","vercel","next.js","Next.js: Denial of Service in App Router using Server Actions","HIGH",8.2,"2026-10-22",0],["CVE-2026-115453","MarcosCamara01","Ecommerce Template","Cross user deletion and modification of cart and wishlist rows in Ecommerce Template throu","HIGH",7.1,"2026-10-22",0],["CVE-2026-115450","MarcosCamara01","Ecommerce Template","Price manipulation in the Ecommerce Template checkout flow through a client supplied Strip","HIGH",7.1,"2026-10-22",0],["CVE-2026-115482","litespeedtech","lsquic","In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory be","HIGH",7.5,"2026-10-22",0],["CVE-2026-114515","schorschii","OCO-Server","OCO-Server: Self-Service Portal uninstall-job authorization bypass","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-61791","schorschii","OCO-Server","OCO-Server: Stored XSS through agent hostnames in command buttons","HIGH",7.4,"2026-10-22",0],["CVE-2026-16477","MTW","CleanShot X","Insecure Deserialization of .cleanshot Files in CleanShot X","HIGH",8.4,"2026-10-22",0],["CVE-2026-114510","stevereiner","flexible-graphrag","Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (","HIGH",7.1,"2026-10-22",0],["CVE-2026-111181","body-parser","body-parser","body-parser vulnerable to Denial of Service via trailing bytes after a compressed request ","HIGH",7.5,"2026-10-22",0],["CVE-2026-113872","multer","multer","multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request","HIGH",7.5,"2026-10-22",0],["CVE-2026-89410","Silicon Labs","Z-Wave SDK","Out-of-bounds read in Z-Wave NCP SPI Handler","MEDIUM",5.1,"2026-10-22",0],["CVE-2026-89409","Silicon Labs","Z-Wave SDK","Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-85079","Silicon Labs","EmberZNet","Out-of-bounds write in Zigbee Simple_Desc_req handling","HIGH",7.5,"2026-10-22",0],["CVE-2026-94502","Silicon Labs","EmberZNet","Out-of-bounds write in Zigbee Publish Price Matrix handling","HIGH",7.5,"2026-10-22",0],["CVE-2026-115249","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input ","MEDIUM",5.1,"2026-10-22",0],["CVE-2026-66282","Silicon Labs","EmberZNet","Authenticated Denial-of-Service in Zigbee Publish Billing Period","MEDIUM",6,"2026-10-22",0],["CVE-2026-66281","Silicon Labs","EmberZNet","Authenticated Denial-of-Service in Zigbee Discover Attributes Handling","MEDIUM",6,"2026-10-22",0],["CVE-2026-85080","Silicon Labs","EmberZNet","Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling","MEDIUM",6,"2026-10-22",0],["CVE-2026-66279","Silicon Labs","Connect SDK","Dis-connect vulnerability in Connect Stack","HIGH",7.2,"2026-10-22",0],["CVE-2026-111497","Google","Brotli","Out-of-Bounds Write in Google Brotli Decoder","CRITICAL",9.2,"2026-10-22",0],["CVE-2026-92709","rsyslog","rsyslog","Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE","HIGH",8.1,"2026-10-22",0],["CVE-2026-115248","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflo","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-113582","Apache Software Foundation","Apache Abdera","Apache Abdera: XML external entity expansion in Atom document parsing","HIGH",8.7,"2026-10-22",0],["CVE-2026-115400","crawlseo","crawlseo","crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens","MEDIUM",6.7,"2026-10-22",0],["CVE-2026-115411","crawlseo","crawlseo","crawlseo before 0.2.4 Server-Side Request Forgery via Crawler","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115247","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system patientregistration.php missing encryption","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115246","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting","MEDIUM",5.1,"2026-10-22",0],["CVE-2026-102785","yootheme.com","YOOtheme Pro extension for Joomla","Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.","CRITICAL",10,"2026-10-22",0],["CVE-2026-112832","CozyThemes","Rootblox","WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-112822","AmentoTech","Workreap Core","WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability","HIGH",8.5,"2026-10-22",0],["CVE-2026-112842","Cozmoslabs","Paid Member Subscriptions","WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-115334","uselotus","lotus","Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint","HIGH",7.6,"2026-10-22",0],["CVE-2026-115333","uselotus","lotus","Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix","HIGH",8.2,"2026-10-22",0],["CVE-2026-115331","uselotus","lotus","Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters","HIGH",8.7,"2026-10-22",0],["CVE-2026-115332","uselotus","lotus","Lotus through 0.10.2 SQL Injection via Subscription Filter Keys","HIGH",8.7,"2026-10-22",0],["CVE-2026-115330","uselotus","lotus","Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics","HIGH",8.7,"2026-10-22",0],["CVE-2026-115329","uselotus","lotus","Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet","MEDIUM",6,"2026-10-22",0],["CVE-2026-115327","CESNET","libyang","libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser","MEDIUM",6,"2026-10-22",0],["CVE-2026-115328","riclolsen","json-scada","JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API","HIGH",8.7,"2026-10-22",0],["CVE-2026-115326","Webkul","QloApps","QloApps through 1.7.0 IDOR via OrderDetailController Refund Request","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115324","mem0ai","mem0","mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store","CRITICAL",9.2,"2026-10-22",0],["CVE-2026-115325","gravitl","netmaker","Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup","HIGH",8.7,"2026-10-22",0],["CVE-2026-115323","evershopcommerce","evershop","EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-115322","bytebase","bytebase","Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115319","junegunn","fzf","fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents","LOW",2,"2026-10-22",0],["CVE-2026-115321","bytebase","bytebase","Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114665","zhenorzz","goploy","Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and","HIGH",7.1,"2026-10-22",0],["CVE-2024-58396","YouDataSum","CPAS Audit Management System","YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId","HIGH",8.7,"2026-10-22",0],["CVE-2025-71434","Weaver Network Co., Ltd.","E-cology","Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list","HIGH",8.8,"2026-10-22",0],["CVE-2024-58394","Retool","Retool","Retool 3.88.0 XSS via /api/imageProxy SVG Proxying","MEDIUM",5.1,"2026-10-22",0],["CVE-2024-58393","i-Netsolution","Readymade Unilevel Ecommerce MLM","i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php","HIGH",8.8,"2026-10-22",0],["CVE-2022-51025","Penta Security Systems","WAPPLES","Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer","HIGH",7.1,"2026-10-22",0],["CVE-2023-54413","OnTheGoSystems","WPML Multilingual CMS","WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang","MEDIUM",5.1,"2026-10-22",0],["CVE-2022-51024","Kareadita","Kavita","Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint","HIGH",8.7,"2026-10-22",0],["CVE-2022-51022","liukuo362573","YiShaAdmin","YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint","HIGH",8.8,"2026-10-22",0],["CVE-2022-51023","PHPOK","PHPOK","PHPOK < 5.4.081 SQL Injection via api.php sort Parameter","HIGH",8.8,"2026-10-22",0],["CVE-2022-51021","WPDeveloper","NotificationX","NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification RES","HIGH",8.8,"2026-10-22",0],["CVE-2021-48016","DedeCMS","DedeCMS","DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php","CRITICAL",9.3,"2026-10-22",0],["CVE-2021-48017","OrbiTeam","BSCW Server","OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi","HIGH",8.7,"2026-10-22",0],["CVE-2021-48015","erzhongxmu","JeeWMS","JeeWMS Path Traversal via showOrDownByurl.do","HIGH",8.7,"2026-10-22",0],["CVE-2021-48013","Weaver Network Co., Ltd.","E-cology","Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload","HIGH",8.7,"2026-10-22",0],["CVE-2021-48014","FanRuan","FineReport","FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer","CRITICAL",9.3,"2026-10-22",0],["CVE-2020-37284","midgetspy","Sickbeard","Sickbeard build-507 Reflected XSS via testNaming pattern Parameter","MEDIUM",5.1,"2026-10-22",0],["CVE-2019-25779","WooThemes","Diarise","WooThemes Diarise 1.5.9 Local File Disclosure via download.php","HIGH",8.7,"2026-10-22",0],["CVE-2018-25439","MetInfo","MetInfo","MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter","HIGH",8.7,"2026-10-22",0],["CVE-2019-25778","SeaCMS","SeaCMS","SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter","HIGH",8.8,"2026-10-22",0],["CVE-2018-25438","Intermesh","Group-Office","Intermesh Group-Office < 3.5.5 Path Traversal via compress.php","HIGH",8.7,"2026-10-22",0],["CVE-2017-20290","Discourse","Discourse","Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed","MEDIUM",5.1,"2026-10-22",0],["CVE-2017-20288","QCubed","QCubed","QCubed 3.1.1 Reflected XSS via installer step_2.php","MEDIUM",5.1,"2026-10-22",0],["CVE-2017-20289","Broadstreet","Ad Widget","Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter","HIGH",7.7,"2026-10-22",0],["CVE-2017-20287","Javo Themes","Javo Spot","Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter","HIGH",8.7,"2026-10-22",0],["CVE-2026-13411","Mattermost","Mattermost","Null condition in Playbooks import crashes the plugin","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-111079","Red Hat","Red Hat Enterprise Linux 10","Goose: goose: shell history and environment leak via terminal integration","HIGH",7.4,"2026-10-22",0],["CVE-2026-115207","Red Hat","Red Hat Enterprise Linux 10","Patch: filename validation bypass in reversal fallback allows file creation outside the wo","MEDIUM",5.5,"2026-10-22",0],["CVE-2026-112313","ACF Extended","ACF Extended","WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-22",0],["CVE-2026-112820","Elated-Themes","Academist Core","WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-22",0],["CVE-2026-114348","webpack-dev-server","webpack-dev-server","webpack-dev-server vulnerable to information disclosure via Host validation bypass in the ","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-112085","webpack-dev-server","webpack-dev-server","webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades","HIGH",8.2,"2026-10-22",0],["CVE-2026-106017","OpenVPN","OpenVPN 3 Core Library","Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 a","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-21812","HCL Software","AppScan Integration with Azure Boards for ASoC & A360","Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 a","LOW",2.2,"2026-10-22",0],["CVE-2026-21811","HCL Software","AppScan Integration with Azure Boards for ASoC & A360","Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 a","LOW",3.8,"2026-10-22",0],["CVE-2026-114703","hupe13","Extensions for Leaflet Map","WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerabil","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114702","nicdark","ND Shortcodes For Visual Composer","WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vul","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114701","xootix","Waitlist Woocommerce ( Back in stock notifier )","WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scr","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114700","Gloriafood","Restaurant Menu – Food Ordering System – Table Reservation","WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cro","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114699","yoomoney","ЮKassa для WooCommerce","WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-110974","vaadin","android-json","Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114195","WP Desk","ShopMagic","WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-112218","Ahmad","Majestic Support","WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114696","miniOrange","Page Restriction WordPress (WP)","WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerab","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-111842","WP Sunshine","Sunshine Photo Cart","WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-115253","WatchGuard","WatchGuard Agent","WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tamperi","HIGH",7.3,"2026-10-22",0],["CVE-2026-96293","WatchGuard","WatchGuard Agent","Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-111851","WProyal","Royal Elementor Addons","WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabili","HIGH",7.6,"2026-10-22",0],["CVE-2026-112311","ACF Extended","ACF Extended","WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-112312","ACF Extended","ACF Extended","WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-22",0],["CVE-2026-111830","WP Mailster","WP Mailster","WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-22",0],["CVE-2026-112241","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-112242","Cozmoslabs","Profile Builder","WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-22",0],["CVE-2026-112845","Jory Hogeveen","Off-Canvas Sidebars & Menus (Slidebars)","WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-110893","Brainstorm Force","SureDash","WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-110894","Brainstorm Force","SureDash","WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114698","myCred","myCred","WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnera","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-112327","TMS","Amelia","WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-112379","Codepeople","Contact Form Email","WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-22",0],["CVE-2026-93471","handnot2","esaml","Unbounded SAML message decompression in esaml allows memory exhaustion","HIGH",8.7,"2026-10-22",0],["CVE-2026-86696","handnot2","esaml","Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom tab","HIGH",8.2,"2026-10-22",0],["CVE-2026-105270","arekinath","esaml","Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion","HIGH",8.7,"2026-10-22",0],["CVE-2026-114182","IdeaBox Creations","PowerPack Addons for Elementor","WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerabi","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-112843","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-112826","eLightUp","Falcon – WordPress Optimizations & Tweaks","WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Contr","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114180","Wpmet","Metform","WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-111847","Kings Plugins","MarketKing","WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-114177","Xpro","Xpro Elementor Addons","WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulne","HIGH",8.8,"2026-10-22",0],["CVE-2026-114175","DigitalME","eRoom","WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-112867","H5P","H5P","WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114184","WPVibes","Elementor Addon Elements","WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerabi","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-103634","Apache Software Foundation","Apache DataSketches","Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch de","","","2026-10-22",0],["CVE-2026-114460","pbuchbinder","mod_qos","Mod_qos: query truncation during json body merging permits security-rule bypass","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114459","pbuchbinder","mod_qos","Mod_qos: out-of-bounds reads in response-body substring matching","LOW",3.7,"2026-10-22",0],["CVE-2026-114458","pbuchbinder","mod_qos","Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-114457","pbuchbinder","mod_qos","Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads","LOW",3.7,"2026-10-22",0],["CVE-2026-111971","","Photo Engine (Media Organizer & Lightroom)","Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-111972","","Photo Engine (Media Organizer & Lightroom)","Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR","MEDIUM",4.9,"2026-10-22",0],["CVE-2026-78392","","Link Library","Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-88849","","MasterStudy LMS WordPress Plugin","MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Stude","LOW",2.7,"2026-10-22",0],["CVE-2026-97328","","WebP Express","WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser","HIGH",7.5,"2026-10-22",0],["CVE-2026-109927","","HIPAA Forms","CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role","HIGH",7.2,"2026-10-22",0],["CVE-2026-109931","","Infility Global","Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update","LOW",3.7,"2026-10-22",0],["CVE-2026-109987","","PixelYourSite","PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie","HIGH",7.2,"2026-10-22",0],["CVE-2026-110010","","MB Custom Post Types & Custom Taxonomies","MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset v","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-110011","","MB Custom Post Types & Custom Taxonomies","MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definitio","LOW",2.7,"2026-10-22",0],["CVE-2026-111958","","Royal MCP","Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token","HIGH",7.5,"2026-10-22",0],["CVE-2026-100142","","FluentCart A New Era of eCommerce","FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-103234","","WP Ultimate Review","WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Em","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-114570","WordPress Foundation","WordPress","WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Qui","MEDIUM",4.9,"2026-10-22",0],["CVE-2026-114223","NewType Infortech","NT OneAPP","NewType Infortech｜NT OneAPP - Exposure of Sensitive Information","MEDIUM",6.7,"2026-10-22",0],["CVE-2026-114222","NewType Infortech","NT OneAPP","NewType Infortech｜NT OneAPP - Authentication Bypass","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114221","NewType Infortech","NT OneAPP","NewType Infortech｜NT OneAPP - Credential Disclosure","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-114220","NewType Infortech","NT OneAPP","NewType Infortech｜NT OneAPP - Improper Certificate Validation","CRITICAL",9.3,"2026-10-22",0],["CVE-2026-114219","NewType Infortech","NT OneAPP","NewType Infortech｜NT OneAPP - Hard-coded Credentials","CRITICAL",9.1,"2026-10-22",0],["CVE-2026-110353","HAProxy","HAProxy","HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of ser","HIGH",7.5,"2026-10-22",0],["CVE-2026-110354","HAProxy","HAProxy","HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of servi","HIGH",7.5,"2026-10-22",0],["CVE-2026-114732","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authenti","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-114731","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled reso","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114730","Roundcube","Webmail","Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side","HIGH",7.2,"2026-10-22",0],["CVE-2026-114729","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blo","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114728","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blo","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114577","oretnom23","php-travel-agency-system","oretnom23 php-travel-agency-system Insertion insert.php sql injection","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114727","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content i","HIGH",8.3,"2026-10-22",0],["CVE-2026-114726","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header inject","MEDIUM",5.8,"2026-10-22",0],["CVE-2026-114725","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header inject","MEDIUM",5,"2026-10-22",0],["CVE-2026-114724","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primit","HIGH",7.4,"2026-10-22",0],["CVE-2026-114723","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource lim","LOW",3.7,"2026-10-22",0],["CVE-2026-114664","frappe","frappe","Frappe before 16.33.0 Blind SQL Injection via get_events","HIGH",7.1,"2026-10-22",0],["CVE-2026-114662","obot-platform","obot","Obot before 0.26.0 API Key Theft via CLI Login Token Request","HIGH",8.6,"2026-10-22",0],["CVE-2026-114663","vyperlang","vyper","Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments","HIGH",8.6,"2026-10-22",0],["CVE-2026-114661","openremote","openremote","OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints","CRITICAL",9,"2026-10-22",0],["CVE-2026-114659","getgrav","grav-plugin-flex-objects","Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes","HIGH",7.1,"2026-10-22",0],["CVE-2026-114660","getgrav","grav","Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives","HIGH",7,"2026-10-22",0],["CVE-2026-114658","getgrav","grav-plugin-login","Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite","HIGH",8.7,"2026-10-22",0],["CVE-2026-114656","traefik","traefik","Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114657","getgrav","grav","Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114642","traefik","traefik","Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper","HIGH",7,"2026-10-22",0],["CVE-2026-114641","traefik","traefik","Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114639","traefik","traefik","Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool","HIGH",7,"2026-10-22",0],["CVE-2026-114640","traefik","traefik","Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router","HIGH",7,"2026-10-22",0],["CVE-2026-114638","traefik","traefik","Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision","HIGH",7,"2026-10-22",0],["CVE-2026-114636","traefik","traefik","Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router","HIGH",7,"2026-10-22",0],["CVE-2026-114637","traefik","traefik","Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak","HIGH",7,"2026-10-22",0],["CVE-2026-114635","traefik","traefik","Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme","HIGH",7,"2026-10-22",0],["CVE-2026-114634","WWBN","AVideo","WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114633","WWBN","AVideo","WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php","HIGH",7,"2026-10-22",0],["CVE-2026-114722","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114721","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configu","LOW",3.1,"2026-10-22",0],["CVE-2026-114720","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command inje","HIGH",7.1,"2026-10-22",0],["CVE-2026-114576","Linksys","RE6250","Linksys RE6250 Web Management strcmp random values","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114719","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation by","LOW",3.7,"2026-10-22",0],["CVE-2026-114718","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripti","MEDIUM",4.7,"2026-10-22",0],["CVE-2026-84910","Drupal","Advanced Search","Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118","MEDIUM",4.2,"2026-10-22",0],["CVE-2026-84911","Drupal","AI (Artificial Intelligence)","AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-202","LOW",3.1,"2026-10-22",0],["CVE-2026-84912","Drupal","AI (Artificial Intelligence)","AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-84913","Drupal","AI Translate","AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-84914","Drupal","Calculate Working Days","Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-84915","Drupal","Component blocks","Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-84923","Drupal","Email Verification / SMS Verification / OTP Verification","Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-C","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-84924","Drupal","Email Verification / SMS Verification / OTP Verification","Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-84916","Drupal","Islandora","Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126","LOW",3.7,"2026-10-22",0],["CVE-2026-84917","Drupal","Jsonapi Role Access","Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-16648","Drupal","Mailer Plus Log","Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128","LOW",3.8,"2026-10-22",0],["CVE-2026-81163","Drupal","Media Library Importer","Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-84918","Drupal","Monobank payment API","Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130","LOW",3.7,"2026-10-22",0],["CVE-2026-84919","Drupal","PhotoSwipe - Responsive JavaScript Modal Image Gallery","PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site ","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-84920","Drupal","Unpublished Node Permissions","Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-84921","Drupal","Webform Submissions Delete","Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-87936","Drupal","amazee.ai Private AI Provider","amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-87937","Drupal","Central Authentication System (CAS) Server","Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONT","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-87938","Drupal","CSP log","CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136","","","2026-10-22",0],["CVE-2026-87939","Drupal","Feed Block","Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137","MEDIUM",4.2,"2026-10-22",0],["CVE-2026-87940","Drupal","Key auth","Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-87941","Drupal","Patreon","Patreon - Critical - Unsupported - SA-CONTRIB-2026-139","","","2026-10-22",0],["CVE-2026-87942","Drupal","SafeDelete","SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-87943","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-87944","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-87945","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-87946","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-14","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-87947","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-202","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-87948","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026","LOW",3.5,"2026-10-22",0],["CVE-2026-87949","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026","LOW",3.3,"2026-10-22",0],["CVE-2026-87950","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-87951","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-20","LOW",3.8,"2026-10-22",0],["CVE-2026-87952","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CO","LOW",3.1,"2026-10-22",0],["CVE-2026-87953","Drupal","SAML SSO - Service Provider","SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTR","LOW",3.3,"2026-10-22",0],["CVE-2026-87954","Drupal","Taxonomy Term Glossary","Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-87955","Drupal","Ultimate Table Field","Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-96360","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154","LOW",3.5,"2026-10-22",0],["CVE-2026-96361","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96358","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96359","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96362","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160","MEDIUM",4.2,"2026-10-22",0],["CVE-2026-96363","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161","","","2026-10-22",0],["CVE-2026-96367","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96368","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96370","Drupal","Webform","Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-20","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-96369","Drupal","Webform","Webform - Less critical - Access bypass - SA-CONTRIB-2026-165","LOW",3.1,"2026-10-22",0],["CVE-2026-96371","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-96372","Drupal","Webform","Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-96366","Drupal","Webform","Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-96373","Drupal","Webform","Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168","LOW",3.3,"2026-10-22",0],["CVE-2026-96365","Drupal","Webform","Webform - Less critical - Denial of service - SA-CONTRIB-2026-170","HIGH",7.5,"2026-10-22",0],["CVE-2026-96364","Drupal","Webform","Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-96357","Drupal","Webform","Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-96398","Drupal","Webform","Webform - Less critical - Access bypass - SA-CONTRIB-2026-173","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-96355","Drupal","Webform","Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175","CRITICAL",9.1,"2026-10-22",0],["CVE-2026-96356","Drupal","Webform","Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-96375","Drupal","Cloud","Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176","MEDIUM",4.8,"2026-10-22",0],["CVE-2026-96376","Drupal","Cloud","Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177","MEDIUM",6.4,"2026-10-22",0],["CVE-2026-96374","Drupal","Project Browser","Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178","MEDIUM",4.2,"2026-10-22",0],["CVE-2026-96378","Drupal","Commerce Decoupled Checkout","Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-96384","Drupal","Mermaid Diagram Field","Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180","LOW",3.5,"2026-10-22",0],["CVE-2026-96379","Drupal","CookieCuttr","CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181","","","2026-10-22",0],["CVE-2026-96385","Drupal","REST & JSON API Authentication for Drupal","REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTR","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-96387","Drupal","Stop administrator login","Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183","LOW",3.8,"2026-10-22",0],["CVE-2026-96388","Drupal","Tawk.to - Live chat application","Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-96390","Drupal","Editoria11y Accessibility Checker","Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-96391","Drupal","Webform REST","Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186","","","2026-10-22",0],["CVE-2026-96377","Drupal","Combined image style","Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-96392","Drupal","AI CKEditor","AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-18","LOW",3.5,"2026-10-22",0],["CVE-2026-96380","Drupal","CSS Usage Analyzer","CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-96386","Drupal","Smart Content","Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-96382","Drupal","Diba carousel slider","Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-","MEDIUM",4.6,"2026-10-22",0],["CVE-2026-114717","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header inject","MEDIUM",4,"2026-10-22",0],["CVE-2026-114716","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header inject","HIGH",8.5,"2026-10-22",0],["CVE-2026-114715","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authori","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-114714","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vul","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114575","TOTOLINK","A950RG","TOTOLINK A950RG product.so UploadCustomModule command injection","CRITICAL",10,"2026-10-22",0],["CVE-2026-110264","GitLab","GitLab","Integer Overflow or Wraparound in GitLab","CRITICAL",10,"2026-10-22",0],["CVE-2025-65200","","","An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code v","","","2026-10-22",0],["CVE-2025-69723","","","A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers","","","2026-10-22",0],["CVE-2026-107079","","","An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial o","","","2026-10-22",0],["CVE-2026-51954","","","An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitr","","","2026-10-22",0],["CVE-2026-78801","","","An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) ","","","2026-10-22",0],["CVE-2026-78846","","","AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local he","","","2026-10-22",0],["CVE-2026-114574","massCodeIO","massCode","massCodeIO massCode Local HTTP Service index.ts information disclosure","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-12664","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-13319","GitLab","GitLab","Authorization Bypass Through User-Controlled Key in GitLab","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-14288","GitLab","GitLab","Use of Incorrectly-Resolved Name or Reference in GitLab","LOW",3.1,"2026-10-22",0],["CVE-2026-15723","GitLab","GitLab","Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Gi","HIGH",8.2,"2026-10-22",0],["CVE-2026-16255","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-103515","GitLab","GitLab","Incorrect Authorization in GitLab","LOW",2.7,"2026-10-22",0],["CVE-2026-105711","GitLab","GitLab","Use of Cache Containing Sensitive Information in GitLab","LOW",3.5,"2026-10-22",0],["CVE-2026-105777","GitLab","GitLab","Insertion of Sensitive Information Into Sent Data in GitLab","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-112378","GitLab","GitLab","Use of Less Trusted Source in GitLab","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-112212","GitLab","GitLab","Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab","HIGH",7.5,"2026-10-22",0],["CVE-2026-112326","GitLab","GitLab","Improper Cleanup on Thrown Exception in GitLab","LOW",3.1,"2026-10-22",0],["CVE-2026-100420","TP-Link Systems Inc.","Deco BE63 V2.0","Information disclosure vulnerability in the cloud-client daemon of Deco BE63","MEDIUM",6.8,"2026-10-22",0],["CVE-2026-76531","Splunk","Splunk SOAR","Files or Directories Accessible to External Parties in Splunk SOAR","CRITICAL",9.9,"2026-10-22",0],["CVE-2026-76530","Splunk","Splunk SOAR","Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR","HIGH",8.8,"2026-10-22",0],["CVE-2026-76529","Splunk","Splunk SOAR","Improper Protection of Alternate Path in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76528","Splunk","Splunk SOAR","Protection Mechanism Failure in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76527","Splunk","Splunk SOAR","Improper Check or Handling of Exceptional Conditions in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76526","Splunk","Splunk SOAR","Improper Neutralization in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76408","Splunk","Splunk SOAR","Improper Control of a Resource Through its Lifetime in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76407","Splunk","Splunk SOAR","Improper Access Control in Splunk SOAR","","","2026-10-22",0],["CVE-2026-76406","Splunk","Splunk SOAR","Information Disclosure through REST API Authentication in Splunk SOAR","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-76308","Splunk","Splunk SOAR","Missing Authorization through the REST API in Splunk SOAR","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-76307","Splunk","Splunk SOAR","Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR","HIGH",7.2,"2026-10-22",0],["CVE-2026-76306","Splunk","Splunk SOAR","Information Disclosure through REST API Query Filters in Splunk SOAR","HIGH",7.5,"2026-10-22",0],["CVE-2026-76305","Splunk","Splunk SOAR","Improper Access Control during App Downloads in Splunk SOAR","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-76304","Splunk","Splunk SOAR","Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-76303","Splunk","Splunk SOAR","Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR","MEDIUM",5.7,"2026-10-22",0],["CVE-2026-76302","Splunk","Splunk Enterprise","Security Hardening in Splunk Enterprise - October 2026","CRITICAL",9.9,"2026-10-22",0],["CVE-2026-76300","Splunk","Splunk Enterprise","Security Hardening in Splunk Enterprise - October 2026","","","2026-10-22",0],["CVE-2026-76301","Splunk","Splunk Enterprise","Security Hardening in Splunk Enterprise - October 2026","","","2026-10-22",0],["CVE-2026-76299","Splunk","Splunk Enterprise","Security Hardening in Splunk Enterprise - October 2026","CRITICAL",9.9,"2026-10-22",0],["CVE-2026-76298","Splunk","Splunk Enterprise","Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise","HIGH",8.8,"2026-10-22",0],["CVE-2026-76297","Splunk","Splunk Enterprise","Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk","MEDIUM",4.2,"2026-10-22",0],["CVE-2026-76296","Splunk","Splunk Enterprise","Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-76295","Splunk","Splunk Enterprise","SPL Injection through the REST API in Splunk Secure Gateway","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-76294","Splunk","Splunk Enterprise","Improper Access Control in Field Extraction Management in Splunk Enterprise","MEDIUM",4.3,"2026-10-22",0],["CVE-2026-76293","Splunk","Splunk Enterprise","Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in","HIGH",7.2,"2026-10-22",0],["CVE-2026-76292","Splunk","Splunk Enterprise","Missing Authorization through REST API Endpoints in Splunk Secure Gateway","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-76291","Splunk","Splunk Enterprise","Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise","HIGH",8.8,"2026-10-22",0],["CVE-2026-76290","Splunk","Splunk Enterprise","Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Spl","HIGH",7.5,"2026-10-22",0],["CVE-2026-76289","Splunk","Splunk Enterprise","Denial of Service (DoS) through the REST API in Splunk Enterprise","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-76288","Splunk","Splunk Enterprise","Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterpris","HIGH",7.5,"2026-10-22",0],["CVE-2026-76287","Splunk","Splunk Enterprise","Authorization Bypass in the Data Management REST API in Splunk Enterprise","MEDIUM",5.4,"2026-10-22",0],["CVE-2026-114441","oretnom23","php-travel-agency-system","oretnom23 php-travel-agency-system update.php sql injection","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-89052","TP-Link Systems Inc.","Archer C6 V2","Hardcoded AES encryption key in Archer C6","MEDIUM",5.9,"2026-10-22",0],["CVE-2026-114440","oretnom23","php-travel-agency-system","oretnom23 php-travel-agency-system delete.php sql injection","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-103090","Google","SAM","Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent M","HIGH",8.8,"2026-10-22",0],["CVE-2026-114439","oretnom23","php-travel-agency-system","oretnom23 php-travel-agency-system Session session.php missing authentication","MEDIUM",6.9,"2026-10-22",0],["CVE-2026-114384","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System transactionsave.php sql injection","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-114509","laravel","framework","Laravel TokenGuard authentication bypass through non-string API credentials","CRITICAL",9.2,"2026-10-22",0],["CVE-2026-114508","laravel","framework","Laravel relationship inclusion can trigger unauthorized data destruction","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-114383","TOTOLINK","EX200","TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow","CRITICAL",10,"2026-10-22",0],["CVE-2026-112921","","Robots-Validate","Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter rob","","","2026-10-22",0],["CVE-2026-114382","TOTOLINK","EX200","TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow","CRITICAL",10,"2026-10-22",0],["CVE-2026-91403","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","CRITICAL",9.1,"2026-10-22",0],["CVE-2026-94423","","Net-LibSSH","Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because co","","","2026-10-22",0],["CVE-2026-94140","","Rex","Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync trans","","","2026-10-22",0],["CVE-2026-114501","python-pillow","Pillow","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1","MEDIUM",6.3,"2026-10-22",0],["CVE-2026-114381","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System orderdetail.php sql injection","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-96639","python-pillow","Pillow","Pillow multi-frame loaders can reuse stale native image storage after mode transitions","CRITICAL",9.8,"2026-10-22",0],["CVE-2026-96636","python-pillow","Pillow","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoIma","MEDIUM",6.5,"2026-10-22",0],["CVE-2026-29001","tastyigniter","TastyIgniter","TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization","HIGH",8.6,"2026-10-22",0],["CVE-2026-96640","python-pillow","Pillow","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","HIGH",8.2,"2026-10-22",0],["CVE-2026-96637","python-pillow","Pillow","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded all","HIGH",7.1,"2026-10-22",0],["CVE-2026-114380","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System inserttrans.php sql injection","MEDIUM",5.3,"2026-10-22",0],["CVE-2026-113811","","Algorithm-UrataniTakeda","Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion","","","2026-10-21",0],["CVE-2026-96778","python-pillow","Pillow","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","HIGH",7.7,"2026-10-21",0],["CVE-2026-114406","Red Hat","Red Hat Enterprise Linux 10","Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-96643","python-pillow","Pillow","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","HIGH",7.1,"2026-10-21",0],["CVE-2026-96644","python-pillow","Pillow","Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows build","HIGH",7.1,"2026-10-21",0],["CVE-2026-96641","python-pillow","Pillow","Pillow: Reachable undefined behavior in native integer operations, potentially leading to ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-96642","python-pillow","Pillow","Pillow: TarIO negative size field causes infinite CPU-spin loop","HIGH",7.1,"2026-10-21",0],["CVE-2026-82987","Viewsonic","vCast","CVE-2026-82987","","","2026-10-21",0],["CVE-2026-96638","python-pillow","Pillow","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mod","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-114379","EKKOLearnAI","ekko-studio","EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114145","gitpython-developers","GitPython","GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","HIGH",7.5,"2026-10-21",0],["CVE-2026-114144","BinaryMuse","toml-node","toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer litera","HIGH",7.5,"2026-10-21",0],["CVE-2026-114143","BinaryMuse","toml-node","toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","HIGH",8.7,"2026-10-21",0],["CVE-2026-114378","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System deleteproduct.php sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114142","BinaryMuse","toml-node","toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","HIGH",8.8,"2026-10-21",0],["CVE-2026-114141","BinaryMuse","toml-node","toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","HIGH",8.7,"2026-10-21",0],["CVE-2026-114140","jupyter","nbconvert","nbconvert: File write via path traversal in cell output filenames","HIGH",8.8,"2026-10-21",0],["CVE-2026-114377","leomoon-studios","wiki-go","leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114139","getsentry","sentry-javascript","Sentry-Javascript: Middleware Bypass when using Tunnel route","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-114138","encode","django-rest-framework","Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU p","HIGH",7.5,"2026-10-21",0],["CVE-2026-114137","encode","django-rest-framework","Django REST framework: TokenProxy.delete() reports success and revokes nothing","HIGH",7.4,"2026-10-21",0],["CVE-2026-114136","encode","django-rest-framework","Django REST framework: JSONParser applies an attacker-named codec to the request stream","HIGH",7.5,"2026-10-21",0],["CVE-2026-114376","leomoon-studios","wiki-go","leomoon-studios wiki-go API editor.go SourceHandler path traversal","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114135","jupyter-server","jupyter_server","Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization","HIGH",8.8,"2026-10-21",0],["CVE-2026-114375","leomoon-studios","wiki-go","leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-85518","Red Hat","Red Hat Hardened Images","Openscap: openscap: arbitrary file write via path traversal in source datastream decomposi","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-112408","AWS","Amazon SageMaker Python SDK","Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()","CRITICAL",9.4,"2026-10-21",0],["CVE-2026-114438","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: required otp enrollment bypassed via update user loc","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-114374","leomoon-studios","wiki-go","leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forger","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-112381","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunk","HIGH",8.2,"2026-10-21",0],["CVE-2026-111817","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeo","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-111812","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the pr","HIGH",7,"2026-10-21",0],["CVE-2026-111811","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network w","CRITICAL",9.4,"2026-10-21",0],["CVE-2026-111809","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable r","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114362","","HarnessRouter","HarnessRouter Targets Test Endpoint app.py server-side request forgery","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-111810","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denia","HIGH",8.7,"2026-10-21",0],["CVE-2026-111815","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT","HIGH",7.8,"2026-10-21",0],["CVE-2026-111814","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pool","HIGH",7.8,"2026-10-21",0],["CVE-2026-111808","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend w","HIGH",7.7,"2026-10-21",0],["CVE-2026-111805","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend work","HIGH",7.7,"2026-10-21",0],["CVE-2026-114361","","HarnessRouter","HarnessRouter Identity Mode app.py improper authorization","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114268","Tenda","BE3L Pro","Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow","CRITICAL",9.4,"2026-10-21",0],["CVE-2026-114267","SourceCodester","Food Order Management System","SourceCodester Food Order Management System Admin Endpoint authorization","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-111816","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the","CRITICAL",9.2,"2026-10-21",0],["CVE-2025-55702","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requ","HIGH",7,"2026-10-21",0],["CVE-2026-110803","vaadin","framework","Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8","HIGH",8.7,"2026-10-21",0],["CVE-2026-107588","vaadin","vaadin","Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts","HIGH",8.4,"2026-10-21",0],["CVE-2025-31699","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: Origin connection still owed a request body is reused, enabling req","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-111804","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest met","HIGH",8.8,"2026-10-21",0],["CVE-2026-111813","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick","CRITICAL",10,"2026-10-21",0],["CVE-2026-19947","zephyrproject","zephyr","Missing kernel object permission check in devmux syscalls allows unprivileged user threads","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-79976","zephyrproject","zephyr","NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C con","HIGH",7.1,"2026-10-21",0],["CVE-2026-78119","zephyrproject","zephyr","Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an un","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-78118","zephyrproject","zephyr","Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration","HIGH",7,"2026-10-21",0],["CVE-2026-78117","zephyrproject","zephyr","Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver c","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-18748","zephyrproject","zephyr","Out-of-bounds read in Bluetooth Classic A2DP codec information element handling","LOW",3.5,"2026-10-21",0],["CVE-2026-78116","zephyrproject","zephyr","Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation e","MEDIUM",5.2,"2026-10-21",0],["CVE-2026-19676","zephyrproject","zephyr","PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing a","HIGH",7.8,"2026-10-21",0],["CVE-2026-105945","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package ","HIGH",7.7,"2026-10-21",0],["CVE-2026-105944","Apache Software Foundation","Apache Pulsar Manager","Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Puls","CRITICAL",10,"2026-10-21",0],["CVE-2026-114266","ProjectWorlds","Advanced Library Management System","ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-105942","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Original principal of proxied requests authorized with the proxy's authenti","HIGH",7.7,"2026-10-21",0],["CVE-2026-105938","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog","LOW",2.3,"2026-10-21",0],["CVE-2026-105937","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant messag","HIGH",8.7,"2026-10-21",0],["CVE-2026-113461","Checkmk GmbH","Checkmk","mk-oracle: Local privilege escalation via insecure Oracle Home library loading","MEDIUM",5.2,"2026-10-21",0],["CVE-2026-105936","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of t","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-105935","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Function trigger publishes to the input topic without checking the caller's","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-105934","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topi","HIGH",7.2,"2026-10-21",0],["CVE-2026-105933","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic ","LOW",2.3,"2026-10-21",0],["CVE-2026-105932","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter end","LOW",2.3,"2026-10-21",0],["CVE-2026-113870","MongoDB","Compass","Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing","HIGH",8.6,"2026-10-21",0],["CVE-2026-111401","Tailored Media","Tailored Tools","WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-105931","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction co","LOW",2.3,"2026-10-21",0],["CVE-2026-105930","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cro","MEDIUM",6,"2026-10-21",0],["CVE-2026-112868","H5P","H5P","WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-105927","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows write","LOW",2.3,"2026-10-21",0],["CVE-2026-114265","ProjectWorlds","Advanced Library Management System","ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysq","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114176","DigitalME","eRoom","WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-105926","Apache Software Foundation","Apache Pulsar","Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSch","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-105869","Apache Software Foundation","Apache Pulsar","Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for ","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-114493","LocalAI","LocalAI","LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-114491","bpampuch","pdfmake","pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114492","flipped-aurora","gin-vue-admin","gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint","HIGH",7,"2026-10-21",0],["CVE-2026-110744","Red Hat","Multicluster Global Hub","Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impe","HIGH",7.2,"2026-10-21",0],["CVE-2026-114133","nuxt","nuxt","Nuxt server islands render `useHeadSafe` input without sanitisation","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-114132","nuxt","nuxt","Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114264","ProjectWorlds","Advanced Library Management System","ProjectWorlds Advanced Library Management System edit_member.php sql injection","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114131","nuxt","nuxt","Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment c","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-114130","nuxt","nuxt","Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII c","LOW",2.3,"2026-10-21",0],["CVE-2026-114129","uhop","stream-json","stream-json: FlexAssembler string/RegExp path filters join the full key stack per containe","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-114128","withastro","astro","Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderin","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-114263","ProjectWorlds","Advanced Library Management System","ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114127","withastro","astro","Astro: Arbitrary CSS injection in Astro View Transitions","LOW",2.3,"2026-10-21",0],["CVE-2026-114126","storybookjs","storybook","Storybook dev server: devices on the same network can obtain the WebSocket token and write","HIGH",8.7,"2026-10-21",0],["CVE-2026-92202","Luxion","KeyShot","Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vul","HIGH",7.8,"2026-10-21",0],["CVE-2026-92183","GIMP","GIMP","GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-21",0],["CVE-2026-92207","MindsDB","MindsDB","MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-21",0],["CVE-2026-92206","CrewAI","CrewAI","CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerabilit","HIGH",8.8,"2026-10-21",0],["CVE-2026-92205","BusyBox","BusyBox","BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-92204","Airbyte","Airbyte","Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Informatio","HIGH",7.7,"2026-10-21",0],["CVE-2026-92203","Airbyte","Airbyte","Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Informat","HIGH",7.7,"2026-10-21",0],["CVE-2026-89035","MikroTik","RouterOS","MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-92210","NoMachine","NoMachine","NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability","HIGH",7.2,"2026-10-21",0],["CVE-2026-92209","NoMachine","NoMachine","NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability","HIGH",7.8,"2026-10-21",0],["CVE-2026-92208","NoMachine","NoMachine","NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-21",0],["CVE-2026-111184","NoMachine","NoMachine","NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerabil","HIGH",7.8,"2026-10-21",0],["CVE-2026-111183","GStreamer","GStreamer","GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-114262","","file-management-system","file-management-system FileController.php store unrestricted upload","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114125","storybookjs","storybook","Storybook: Missing origin validation in Storybook preview allows code injection from malic","HIGH",8.6,"2026-10-21",0],["CVE-2026-114124","electron","electron","Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry","LOW",3.9,"2026-10-21",0],["CVE-2026-114261","MomoTommy","file-management-system","MomoTommy file-management-system Files API FileController.php destroy missing authenticati","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-53986","Girafit","Girafit camera app","Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114123","dynamics365ninja","d365fo-mcp-server","D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disable","HIGH",7.5,"2026-10-21",0],["CVE-2026-114260","oretnom23","file-management-system-php","oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114259","oretnom23","file-management-system-php","oretnom23 file-management-system-php admin_class.php save_files unrestricted upload","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114122","electron","electron","Electron: Frame subscription trusts GPU-supplied frame geometry","LOW",3.9,"2026-10-21",0],["CVE-2026-114121","electron","electron","Electron: openExternal permission requests can be attributed to the wrong origin","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-76497","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-76505","Cisco","Cisco IOS XR Software","Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service V","HIGH",7.5,"2026-10-21",0],["CVE-2026-76524","Cisco","Cisco Open Source Snort3","Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability","HIGH",7.8,"2026-10-21",0],["CVE-2026-76496","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolutio","HIGH",7,"2026-10-21",0],["CVE-2026-76495","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission As","HIGH",7.8,"2026-10-21",0],["CVE-2026-76494","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerab","HIGH",7.8,"2026-10-21",0],["CVE-2026-76493","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vuln","HIGH",7.5,"2026-10-21",0],["CVE-2026-76490","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vul","HIGH",8.6,"2026-10-21",0],["CVE-2026-76489","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Servic","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-76492","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabil","HIGH",7.5,"2026-10-21",0],["CVE-2026-76491","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulne","HIGH",7.5,"2026-10-21",0],["CVE-2026-76481","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or ","HIGH",7.5,"2026-10-21",0],["CVE-2026-76487","Cisco","Cisco Unified Communications Manager","Cisco Unified Communications Manager Improper Access Control Vulnerability","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-113800","electron","electron","Electron: HID and USB permission checks can be attributed to the wrong origin","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-76479","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vul","HIGH",7.8,"2026-10-21",0],["CVE-2026-76478","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Co","HIGH",8.8,"2026-10-21",0],["CVE-2026-76476","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Val","HIGH",8.8,"2026-10-21",0],["CVE-2026-114258","oretnom23","file-management-system-php","oretnom23 file-management-system-php File Management files.php sql injection","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-76477","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerab","HIGH",8.8,"2026-10-21",0],["CVE-2026-113799","abdolence","slack-morphism-rust","Slack Morphism verifier errors disclose valid HMACs in the logs","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-76475","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripti","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-76474","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentic","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-76445","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 Denial of Service Vulnerability","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-76473","Cisco","Cisco Emergency Responder","Cisco Unified Communications Products Hardening Release: October 2026 - Improper control o","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-76435","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Information Disclosure Vulnerability","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-76462","Cisco","Cisco Secure Client","Cisco Secure Client Privilege Escalation Vulnerability","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-76466","Cisco","Cisco TelePresence Video Communication Server (VCS) Expressway","Cisco Expressway Series Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-20356","Cisco","Cisco Cyber Vision","Multiple Cisco Products Snort 3 Software Hardening Release: October 2026","HIGH",7.5,"2026-10-21",0],["CVE-2026-20236","Cisco","Cisco Cyber Vision","Multiple Cisco Products Snort 3 Software Hardening Release: October 2026","HIGH",7.5,"2026-10-21",0],["CVE-2026-20221","Cisco","Cisco Cyber Vision","Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabil","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-20291","Cisco","Cisco Cyber Vision","Multiple Cisco Products Snort 3 Software Hardening Release: October 2026","HIGH",7.8,"2026-10-21",0],["CVE-2026-20197","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-20218","Cisco","Cisco Open Source Snort3","Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-113798","electron","electron","Electron: Pointer lock permission requests can be attributed to the wrong frame","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-20043","Cisco","Cisco Cyber Vision","Multiple Cisco Products Snort 3 Software Hardening Release: October 2026","CRITICAL",9,"2026-10-21",0],["CVE-2026-20179","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabil","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-20019","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-20011","Cisco","Cisco Open Source Snort3","Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-113797","electron","electron","Electron: Extension tabs.query returns tab URLs and titles without the tabs permission","LOW",3.1,"2026-10-21",0],["CVE-2026-113796","electron","electron","Electron: SameSite cookie restrictions are not applied to windows opened from links","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-113795","py-pdf","pypdf","pypdf: Possible large memory usage for streams with multiple filters","MEDIUM",6,"2026-10-21",0],["CVE-2026-114257","oretnom23","file-management-system-php","oretnom23 file-management-system-php File Download download.php readfile sql injection","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-113794","py-pdf","pypdf","pypdf: Possible infinite loop when hitting EOF in standard xref table","MEDIUM",6,"2026-10-21",0],["CVE-2026-113793","py-pdf","pypdf","pypdf: Possible infinite loop when removing tree items","MEDIUM",6,"2026-10-21",0],["CVE-2026-113792","py-pdf","pypdf","pypdf: Possible infinite loop in PdfWriter.find_outline_item","MEDIUM",6,"2026-10-21",0],["CVE-2026-114256","oretnom23","file-management-system-php","oretnom23 file-management-system-php Folder Management admin_class.php save_files sql inje","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-113791","py-pdf","pypdf","pypdf: Possible large memory usage when parsing content streams","MEDIUM",6,"2026-10-21",0],["CVE-2026-113790","py-pdf","pypdf","pypdf: Possible large memory usage when parsing arrays and dictionaries","MEDIUM",6,"2026-10-21",0],["CVE-2026-114490","Progressive Robot Ltd","hMailServer","Incorrect Authorization in hMailServer","HIGH",7.8,"2026-10-21",0],["CVE-2026-114489","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","HIGH",8.1,"2026-10-21",0],["CVE-2026-113789","py-pdf","pypdf","pypdf: Possible long runtimes/large memory usage when retrieving form fields","MEDIUM",6,"2026-10-21",0],["CVE-2026-113788","uselagoon","lagoon","Lagoon core ssh service vulnerable to remote code execution","CRITICAL",9.4,"2026-10-21",0],["CVE-2026-114255","oretnom23","file-management-system-php","oretnom23 file-management-system-php User Account Management admin_class.php save_user sql","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-113787","GitHubNewbie0","odf-kit","odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-114254","oretnom23","file-management-system-php","oretnom23 file-management-system-php admin_class.php login sql injection","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114479","Progressive Robot Ltd","hMailServer","Not Failing Securely ('Failing Open') in hMailServer","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-114478","Progressive Robot Ltd","hMailServer","Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-114477","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-114476","Progressive Robot Ltd","hMailServer","Incorrect Authorization in hMailServer","HIGH",7.5,"2026-10-21",0],["CVE-2026-114475","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-114474","Progressive Robot Ltd","hMailServer","Use of Less Trusted Source in hMailServer","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-114473","Progressive Robot Ltd","hMailServer","Incorrect Authorization in hMailServer","MEDIUM",5,"2026-10-21",0],["CVE-2026-114472","Progressive Robot Ltd","hMailServer","Insufficient Resource Pool in hMailServer","LOW",3.7,"2026-10-21",0],["CVE-2026-114471","Progressive Robot Ltd","hMailServer","Insertion of Sensitive Information into Log File in hMailServer","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-114470","Progressive Robot Ltd","hMailServer","Cross-Site Request Forgery (CSRF) in hMailServer","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-102486","NTPsec","ntpsec","Out-of-bounds Read in ntpsec","HIGH",7.5,"2026-10-21",0],["CVE-2026-102485","NTPsec","ntpsec","Out-of-bounds Read in ntpsec","MEDIUM",5.2,"2026-10-21",0],["CVE-2026-102484","NTPsec","ntpsec","Heap-based Buffer Overflow in ntpsec","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-102483","NTPsec","ntpsec","Reachable Assertion in ntpsec","HIGH",7.5,"2026-10-21",0],["CVE-2026-114462","Velneo","vServer","Arbitrary File Read via Symlink in Velneo vServer HTTP Server","MEDIUM",6,"2026-10-21",0],["CVE-2026-114370","Red Hat","Red Hat build of Apache Camel for Spring Boot 4","Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink t","LOW",3.7,"2026-10-21",0],["CVE-2026-114463","Nous Research","Hermes Agent","CVE-2026-114463","","","2026-10-21",0],["CVE-2026-114253","oretnom23","file-management-system-php","oretnom23 file-management-system-php index.php include file inclusion","MEDIUM",5.3,"2026-10-21",0],["CVE-2023-7356","Linux","Linux","Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID","HIGH",8.8,"2026-10-21",0],["CVE-2026-98869","Linux","Linux","bpf: Infer zext_dst based on static register liveness analysis","HIGH",7.8,"2026-10-21",0],["CVE-2026-114252","itsourcecode","Sales-and-Inventory-System","itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-113786","py-pdf","pypdf","pypdf: Unvalidated JPEG image data loading","LOW",2.3,"2026-10-21",0],["CVE-2026-114251","itsourcecode","Sales-and-Inventory-System","itsourcecode Sales-and-Inventory-System cust_del.php sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114250","itsourcecode","Sales-and-Inventory-System","itsourcecode Sales-and-Inventory-System cust_edit.php sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-113779","pfrest","pfSense-pkg-RESTAPI","pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Pe","HIGH",8.8,"2026-10-21",0],["CVE-2026-111832","WP Mailster","WP Mailster","WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability","CRITICAL",10,"2026-10-21",0],["CVE-2026-111834","Kitae Park","Mang Board WP","WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-111835","bjorntech","BjornTech Swish for WooCommerce","WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerab","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-111833","Bold Grid","weForms","WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability","HIGH",7.5,"2026-10-21",0],["CVE-2026-111837","Wasiliy Strecker","Contest Gallery","WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-111838","ThemeHunk","ThemeHunk Customizer","WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-21",0],["CVE-2026-111840","VideoWhisper.com","Paid Videochat Turnkey Site","WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulner","HIGH",7.1,"2026-10-21",0],["CVE-2026-111848","Dylan Kuhn","Geo Mashup","WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-21",0],["CVE-2026-111852","WPdreams","Ajax Search Lite","WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-112221","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-21",0],["CVE-2024-6423","WSO2","WSO2 API Manager","Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential I","MEDIUM",4,"2026-10-21",0],["CVE-2026-109619","PHP Group","PHP","RCE via stale global state","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-104949","EnterpriseDB","WarehousePG","WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing","LOW",2.3,"2026-10-21",0],["CVE-2026-104948","EnterpriseDB","WarehousePG","WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing","HIGH",7.1,"2026-10-21",0],["CVE-2026-104947","EnterpriseDB","WarehousePG","WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerabilit","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114437","go-chi","chi","Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For","MEDIUM",6.3,"2026-10-21",0],["CVE-2025-0326","WSO2","WSO2 Identity Server","Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access","","","2026-10-21",0],["CVE-2024-7478","WSO2","WSO2 API Manager","Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Accoun","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-109618","PHP Group","PHP","RCE via OOM corruption","CRITICAL",9.2,"2026-10-21",0],["CVE-2024-5563","WSO2","WSO2 Identity Server","Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows","MEDIUM",4.8,"2026-10-21",0],["CVE-2024-4989","WSO2","WSO2 API Manager","Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks","MEDIUM",5.4,"2026-10-21",0],["CVE-2024-5139","WSO2","WSO2 Enterprise Integrator","Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Mani","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-114249","dhikshitha29","Insurance-Management-System","dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-111849","Magepeople inc.","WpTravelly","WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114248","dhikshitha29","Insurance-Management-System","dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing a","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-97313","ISC","BIND 9","Specific RPZ configurations and query patterns may result in an unexpected exit","HIGH",7.5,"2026-10-21",0],["CVE-2026-96888","ISC","BIND 9","Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimizati","HIGH",7.5,"2026-10-21",0],["CVE-2026-94300","ISC","BIND 9","Concurrent GSS-TSIG messages corrupt memory","HIGH",8.1,"2026-10-21",0],["CVE-2026-114245","dhikshitha29","Insurance-Management-System","dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php imprope","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-19630","ISC","BIND 9","Amplified resource exhaustion in inbound message processing","HIGH",7.5,"2026-10-21",0],["CVE-2026-114404","PHPOffice","PHPPresentation","PHPPresentation 1.2.0 XSS via Writer\\HTML Text Runs, Hyperlinks and Descriptions","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114403","PHPOffice","PHPPresentation","PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\\Serialized::load","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-114401","polonel","trudesk","Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114402","polonel","trudesk","Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114400","polonel","trudesk","Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads","HIGH",8.2,"2026-10-21",0],["CVE-2026-114398","polonel","trudesk","Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114399","polonel","trudesk","Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API","HIGH",7,"2026-10-21",0],["CVE-2026-114397","polonel","trudesk","Trudesk through 1.2.11 Missing Authentication on Debug Routes","HIGH",8.3,"2026-10-21",0],["CVE-2026-114395","polonel","trudesk","Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114396","polonel","trudesk","Trudesk through 1.2.11 MongoDB $where Injection via tickets search API","HIGH",7.1,"2026-10-21",0],["CVE-2026-114394","polonel","trudesk","Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114392","polonel","trudesk","Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114393","polonel","trudesk","Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114391","easysoft","zentaopms","ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods","HIGH",7.1,"2026-10-21",0],["CVE-2026-114390","chamilo","chamilo-lms","Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114388","chamilo","chamilo-lms","Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114389","chamilo","chamilo-lms","Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114387","shopperlabs","shopper","Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components","HIGH",8.7,"2026-10-21",0],["CVE-2026-114120","WPDeveloper","SchedulePress","SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114386","pydantic","pydantic-ai-harness","Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114405","Velneo","vServer","Denial of Service via Malformed VATP Packet in Velneo vServer","HIGH",8.7,"2026-10-21",0],["CVE-2026-90484","Apache Software Foundation","Apache bRPC","Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash","","","2026-10-21",0],["CVE-2026-87849","Apache Software Foundation","Apache bRPC","Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply pa","","","2026-10-21",0],["CVE-2026-86249","Apache Software Foundation","Apache bRPC","Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and Serv","","","2026-10-21",0],["CVE-2026-86147","Apache Software Foundation","Apache bRPC","Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duratio","","","2026-10-21",0],["CVE-2026-86146","Apache Software Foundation","Apache bRPC","Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsi","","","2026-10-21",0],["CVE-2026-114243","dhikshitha29","Insurance-Management-System","dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-84748","Apache Software Foundation","Apache bRPC","Apache bRPC: Builtin services reachable from the public port via protobuf protocols despit","","","2026-10-21",0],["CVE-2026-84747","Apache Software Foundation","Apache bRPC","Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments","","","2026-10-21",0],["CVE-2026-84727","Apache Software Foundation","Apache bRPC","Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-82953","Apache Software Foundation","Apache bRPC","Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote De","","","2026-10-21",0],["CVE-2026-82942","Apache Software Foundation","Apache bRPC","Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes","","","2026-10-21",0],["CVE-2026-82425","Apache Software Foundation","Apache bRPC","Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service","","","2026-10-21",0],["CVE-2026-82231","Apache Software Foundation","Apache bRPC","Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift clien","","","2026-10-21",0],["CVE-2026-82230","Apache Software Foundation","Apache bRPC","Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser","HIGH",7.5,"2026-10-21",0],["CVE-2026-82210","Apache Software Foundation","Apache bRPC","Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames","","","2026-10-21",0],["CVE-2026-114407","e107inc","e107","e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-81755","Apache Software Foundation","Apache bRPC","Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Reque","","","2026-10-21",0],["CVE-2026-80463","Apache Software Foundation","Apache bRPC","Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly","","","2026-10-21",0],["CVE-2026-79704","Apache Software Foundation","Apache bRPC","Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling","","","2026-10-21",0],["CVE-2026-78334","Apache Software Foundation","Apache bRPC","Apache bRPC: Missing Authentication for Streaming RPC Frames","","","2026-10-21",0],["CVE-2026-78066","Apache Software Foundation","Apache bRPC","Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared","","","2026-10-21",0],["CVE-2026-78058","Apache Software Foundation","Apache bRPC","Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path","","","2026-10-21",0],["CVE-2026-78048","Apache Software Foundation","Apache bRPC","Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco","","","2026-10-21",0],["CVE-2026-74758","Apache Software Foundation","Apache bRPC","Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling","","","2026-10-21",0],["CVE-2026-74757","Apache Software Foundation","Apache bRPC","Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count","","","2026-10-21",0],["CVE-2026-74755","Apache Software Foundation","Apache bRPC","Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service","","","2026-10-21",0],["CVE-2026-114242","dhikshitha29","Insurance-Management-System","dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-66392","Apache Software Foundation","Apache bRPC","Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names","","","2026-10-21",0],["CVE-2026-61916","Apache Software Foundation","Apache bRPC","Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms","","","2026-10-21",0],["CVE-2026-61902","Apache Software Foundation","Apache bRPC","Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits","","","2026-10-21",0],["CVE-2026-58064","Apache Software Foundation","Apache bRPC","Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation","","","2026-10-21",0],["CVE-2026-56388","Apache Software Foundation","Apache bRPC","Apache bRPC: Out-of-Bounds Write in Redis Command Parser","","","2026-10-21",0],["CVE-2026-56387","Apache Software Foundation","Apache bRPC","Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser","","","2026-10-21",0],["CVE-2026-56386","Apache Software Foundation","Apache bRPC","Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser","HIGH",7.5,"2026-10-21",0],["CVE-2026-54427","Apache Software Foundation","Apache bRPC","Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser","","","2026-10-21",0],["CVE-2026-54426","Apache Software Foundation","Apache bRPC","Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser","","","2026-10-21",0],["CVE-2026-54425","Apache Software Foundation","Apache bRPC","Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding","","","2026-10-21",0],["CVE-2026-48830","Apache Software Foundation","Apache bRPC","Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for ","","","2026-10-21",0],["CVE-2026-59229","Apache Software Foundation","Apache IoTDB","Apache IoTDB: Legacy Pipe Privilege Escalation","","","2026-10-21",0],["CVE-2026-59562","Apache Software Foundation","Apache IoTDB","Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send","","","2026-10-21",0],["CVE-2026-41114","Apache Software Foundation","Apache IoTDB JDBC driver","Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD","","","2026-10-21",0],["CVE-2026-58663","Apache Software Foundation","Apache IoTDB","Apache IoTDB: Auth Bypass in pipeTransfer() interface","","","2026-10-21",0],["CVE-2026-87096","Acronis","Acronis Cyber Infrastructure","Sensitive information disclosure and manipulation due to improper authorization checks. Th","LOW",3.3,"2026-10-21",0],["CVE-2026-87095","Acronis","Acronis Cyber Infrastructure","Sensitive information disclosure and manipulation due to improper authorization checks. Th","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-105923","qt","Qt","Null-pointer dereference in QTriangulator reachable through VectorImage","MEDIUM",4,"2026-10-21",0],["CVE-2026-110369","GS Plugins","WordPress Team Members – GS Plugins","WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulne","HIGH",8.8,"2026-10-21",0],["CVE-2026-110370","GS Plugins","GS Pins for Pinterest","WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-21",0],["CVE-2026-110884","geekontheroad","Live Summary for Gravity Forms","WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vul","HIGH",7.1,"2026-10-21",0],["CVE-2026-70387","OnePlus","OxygenOS","OnePlus OxygenOS exposed dangerous method vulnerability","HIGH",8.4,"2026-10-21",0],["CVE-2026-97206","NLnet Labs","Unbound","DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployment","HIGH",7.5,"2026-10-21",0],["CVE-2026-96405","NLnet Labs","Unbound","Aggregate DNS name chained pointer decompression work leads to degradation of service.","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-50106","NLnet Labs","Unbound","Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-35501","NLnet Labs","Unbound","Bypass of a configured island trust anchor underneath an insecure parent from an atacker-c","LOW",3.7,"2026-10-21",0],["CVE-2026-109125","NLnet Labs","Unbound","Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-70386","OnePlus","OxygenOS","OnePlus OxygenOS improper neutralization of special elements vulnerability","HIGH",8.5,"2026-10-21",0],["CVE-2026-85683","","Jane Menu","Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL","HIGH",8.8,"2026-10-21",0],["CVE-2026-14556","","HappyForms","HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-105256","","LatePoint","LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-107447","","Contest Gallery","Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-104642","","Simple Shopping Cart","Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio","LOW",2.7,"2026-10-21",0],["CVE-2026-103301","","Payment Gateway for Telcell","Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-104641","","Simple Shopping Cart","Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101138","","CMP – Coming Soon & Maintenance","CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114236","Red Hat","Confidential Compute Attestation","Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompre","LOW",3.3,"2026-10-21",0],["CVE-2026-110938","Eclipse Foundation","Eclipse OpenJ9","JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during ","HIGH",8.7,"2026-10-21",0],["CVE-2026-111075","Eclipse Foundation","Eclipse OpenJ9","JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap re","HIGH",8.7,"2026-10-21",0],["CVE-2026-110899","Kevin Stover","Ninja Forms","WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-21",0],["CVE-2026-107435","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-21",0],["CVE-2026-17557","Red Hat","Red Hat OpenShift AI (RHOAI)","Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer cred","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-111074","Eclipse Foundation","Eclipse OpenJ9","JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop ","HIGH",8.7,"2026-10-21",0],["CVE-2026-92999","","Click n Chat (Chat Widget Integration)","Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-96901","","Cart Abandonment Recovery for WooCommerce","Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass ","LOW",3.7,"2026-10-21",0],["CVE-2026-86611","","Download Manager","Download Manager (Free & Pro) - Privacy Settings Update via CSRF","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-87837","","Wava Payment Plugin","Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87838","","Wava Payment Plugin","Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Web","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-88784","","Translate WordPress with Weglot 2.0","Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting","HIGH",7.5,"2026-10-21",0],["CVE-2026-92997","","Click n Chat (Chat Widget Integration)","Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter","HIGH",8.6,"2026-10-21",0],["CVE-2026-92998","","Click n Chat (Chat Widget Integration)","Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters","HIGH",8.6,"2026-10-21",0],["CVE-2026-79627","","Advanced File Manager","Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content","HIGH",7.1,"2026-10-21",0],["CVE-2026-81812","","Elementor Website Builder","Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-81813","","Elementor Website Builder","Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-85642","","Formidable Forms","Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS","HIGH",7.5,"2026-10-21",0],["CVE-2026-111955","","WholesaleX","WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-111956","","WholesaleX","WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-111957","","SUMIT Payment Gateway for WooCommerce","SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forge","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-15261","","TI WooCommerce Wishlist","TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_k","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-110982","","AI Engine","AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title ","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-111574","","Redirection for Contact Form 7","Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug ","HIGH",7.5,"2026-10-21",0],["CVE-2026-111596","","Kliken: Ads + Pixel for Meta","Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-111947","","Pricing Table WordPress Plugin","Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Tab","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-111948","","User Profile Builder","Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions","HIGH",7.1,"2026-10-21",0],["CVE-2026-111949","","miniOrange 2FA","miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding","HIGH",7.5,"2026-10-21",0],["CVE-2026-108073","","SureCart","SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-109147","","WP Booking System","WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter","HIGH",7.1,"2026-10-21",0],["CVE-2026-109926","","Productive Commerce","Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-110514","","WPZOOM Portfolio Lite","WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-110523","","WP User Manager","WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati","HIGH",8.1,"2026-10-21",0],["CVE-2026-110651","","Swift Performance Lite","Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-107506","","Simple Banner","Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting","HIGH",7.5,"2026-10-21",0],["CVE-2026-107788","","SmartyParcel","SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-107789","","SmartyParcel","SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-107790","","HireZoot","WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-105999","","Booking Package","Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-106932","","Moloni","Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-107127","","Uncanny Toolkit for LearnDash","Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF","HIGH",7.5,"2026-10-21",0],["CVE-2026-107128","","Uncanny Toolkit for LearnDash","Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth","MEDIUM",5,"2026-10-21",0],["CVE-2026-107237","","Backup and Staging by WP Time Capsule","Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment v","HIGH",8.2,"2026-10-21",0],["CVE-2026-105257","","Appointment Booking Plugin","LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR","LOW",2.7,"2026-10-21",0],["CVE-2026-105262","","Falang multilanguage for WordPress","Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation","HIGH",8,"2026-10-21",0],["CVE-2026-105992","","Ettrick Escape Room Booking","Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-105996","","Booking Package","Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Pre","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-105998","","Booking Package","Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authoriza","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-103302","","Payment Gateway for Idram","Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-100145","","Synchrony Financing","Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-102499","","Modern Events Calendar Lite","Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Act","HIGH",7.7,"2026-10-21",0],["CVE-2026-93856","OpenStack","Cinder","In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the ","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-71195","OpenStack","Manila","In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not ","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-82819","Cerberus","Cerberus FTP Server","Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server","HIGH",7.1,"2026-10-21",0],["CVE-2026-114040","DT42","BerryNet","DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path trav","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114039","projectworlds","Advanced Library Management System","projectworlds Advanced Library Management System report_search.php mysqli_query sql inject","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-92824","Red Hat","Red Hat Enterprise Linux 10","Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-92822","Red Hat","Red Hat Enterprise Linux 10","Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-92823","Red Hat","Red Hat Enterprise Linux 10","Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-82814","smub","Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More","Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection","HIGH",8.8,"2026-10-21",0],["CVE-2026-113744","Tenda","AC19","Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based over","CRITICAL",10,"2026-10-21",0],["CVE-2026-113743","Tenstorrent","tt-metal","Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-105044","Qingteng","Host Adaptive Security Platform","OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox","HIGH",8.5,"2026-10-21",0],["CVE-2026-113741","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System 404.php cross site scripting","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-111943","Go standard library","crypto/x509","Distrust compromised intermediate certificates in crypto/x509","","","2026-10-21",0],["CVE-2026-113740","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System deletecustomer.php sql injection","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114198","Mandiant FLARE","floss","Deserialization of untrusted data in floss","HIGH",8.7,"2026-10-21",0],["CVE-2026-114197","Mandiant FLARE","capa","Deserialization of untrusted data in capa","HIGH",8.7,"2026-10-21",0],["CVE-2026-114119","Best Practice Software","Bp Premier","Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative C","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-114118","vyperlang","vyper","Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wr","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114117","vyperlang","vyper","Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches","HIGH",8.2,"2026-10-21",0],["CVE-2026-114115","vyperlang","vyper","Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114116","vyperlang","vyper","Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators","MEDIUM",6,"2026-10-21",0],["CVE-2026-114114","vyperlang","vyper","Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters","MEDIUM",6,"2026-10-21",0],["CVE-2026-114112","lovell","sharp","Sharp before 0.35.4 RCE via bundled libheif AVIF decoding","HIGH",8.9,"2026-10-21",0],["CVE-2026-114113","lovell","sharp","Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders","HIGH",8.4,"2026-10-21",0],["CVE-2026-114111","lovell","sharp","Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability","HIGH",8.9,"2026-10-21",0],["CVE-2026-114110","astral-sh","uv","Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries","HIGH",8.7,"2026-10-21",0],["CVE-2026-114108","HKUDS","Vibe-Trading","HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-114109","astral-sh","uv","uv before 0.11.15 Arbitrary File Write via Entry Point Names","HIGH",8.7,"2026-10-21",0],["CVE-2026-114107","HKUDS","Vibe-Trading","HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and Backg","HIGH",8.7,"2026-10-21",0],["CVE-2026-114105","cthackers","adm-zip","Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114106","HKUDS","Vibe-Trading","HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path","HIGH",8.7,"2026-10-21",0],["CVE-2026-114104","cthackers","adm-zip","adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass","HIGH",8.2,"2026-10-21",0],["CVE-2026-114103","cthackers","adm-zip","adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114101","corazawaf","coraza","Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114102","cthackers","adm-zip","adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event","HIGH",8.7,"2026-10-21",0],["CVE-2026-114100","corazawaf","coraza","Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114098","jelmer","dulwich","Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks","HIGH",7.3,"2026-10-21",0],["CVE-2026-114099","corazawaf","coraza","Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114097","jelmer","dulwich","Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter","HIGH",7.3,"2026-10-21",0],["CVE-2026-114095","jelmer","dulwich","Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object","HIGH",7.1,"2026-10-21",0],["CVE-2026-114096","jelmer","dulwich","Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths","HIGH",7.3,"2026-10-21",0],["CVE-2026-114094","jelmer","dulwich","Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths","HIGH",8.7,"2026-10-21",0],["CVE-2026-114093","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114091","triggerdotdev","trigger.dev","Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route","MEDIUM",6,"2026-10-21",0],["CVE-2026-114092","triggerdotdev","trigger.dev","Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action","HIGH",8.3,"2026-10-21",0],["CVE-2026-114090","trigger.dev","cli-v3","Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server","HIGH",7.6,"2026-10-21",0],["CVE-2026-114088","triggerdotdev","trigger.dev","Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO","HIGH",8.3,"2026-10-21",0],["CVE-2026-114089","triggerdotdev","trigger.dev","Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover","HIGH",8.7,"2026-10-21",0],["CVE-2026-114087","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-114085","triggerdotdev","trigger.dev","Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API","HIGH",8.8,"2026-10-21",0],["CVE-2026-114086","triggerdotdev","trigger.dev","Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoi","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114084","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API","HIGH",8.3,"2026-10-21",0],["CVE-2026-114083","triggerdotdev","trigger.dev","Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints","HIGH",8.6,"2026-10-21",0],["CVE-2026-114081","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name","HIGH",8.3,"2026-10-21",0],["CVE-2026-114082","triggerdotdev","trigger.dev","Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials","HIGH",7.2,"2026-10-21",0],["CVE-2026-114080","triggerdotdev","trigger.dev","Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114078","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Look","HIGH",7.2,"2026-10-21",0],["CVE-2026-114079","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114077","triggerdotdev","trigger.dev","Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWork","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-114075","triggerdotdev","trigger.dev","Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114076","triggerdotdev","trigger.dev","Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114074","triggerdotdev","trigger.dev","Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114072","triggerdotdev","trigger.dev","Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114073","triggerdotdev","trigger.dev","Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-114071","triggerdotdev","trigger.dev","Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route","LOW",2.3,"2026-10-21",0],["CVE-2026-114070","triggerdotdev","trigger.dev","Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114068","triggerdotdev","trigger.dev","Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint","HIGH",7.2,"2026-10-21",0],["CVE-2026-114069","triggerdotdev","trigger.dev","Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint","HIGH",8.6,"2026-10-21",0],["CVE-2026-114067","triggerdotdev","trigger.dev","Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route","HIGH",7.1,"2026-10-21",0],["CVE-2026-114065","triggerdotdev","trigger.dev","Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders","HIGH",7.1,"2026-10-21",0],["CVE-2026-114066","triggerdotdev","trigger.dev","Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints","HIGH",7.2,"2026-10-21",0],["CVE-2026-114064","grokability","snipe-it","Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114062","sveltejs","kit","SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114063","sveltejs","kit","SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows","HIGH",8.7,"2026-10-21",0],["CVE-2026-114061","sveltejs","kit","SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","LOW",2.3,"2026-10-21",0],["CVE-2026-114059","ArcadeData","arcadedb","ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization","HIGH",7.7,"2026-10-21",0],["CVE-2026-114060","sveltejs","kit","SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions","LOW",2.1,"2026-10-21",0],["CVE-2026-114058","ArcadeData","arcadedb","ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114057","ArcadeData","arcadedb","ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114055","vllm-project","vllm","vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs","HIGH",8.7,"2026-10-21",0],["CVE-2026-114056","ArcadeData","arcadedb","ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114054","vllm-project","vllm","vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys","HIGH",7.1,"2026-10-21",0],["CVE-2026-114052","vllm-project","vllm","vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs","HIGH",8.7,"2026-10-21",0],["CVE-2026-114053","vllm-project","vllm","vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision","CRITICAL",9.2,"2026-10-21",0],["CVE-2026-114051","vllm-project","vllm","vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate","HIGH",7.1,"2026-10-21",0],["CVE-2026-114050","vllm-project","vllm","vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID","HIGH",7.1,"2026-10-21",0],["CVE-2026-114048","WWBN","AVideo","WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-114049","vllm-project","vllm","vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-114047","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation","HIGH",7.6,"2026-10-21",0],["CVE-2026-114045","FreeRDP","FreeRDP","FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format","HIGH",8.7,"2026-10-21",0],["CVE-2026-114046","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard","HIGH",7.1,"2026-10-21",0],["CVE-2026-114044","FreeRDP","FreeRDP","FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-114042","FreeRDP","FreeRDP","FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU","HIGH",7.1,"2026-10-21",0],["CVE-2026-114043","FreeRDP","FreeRDP","Vulnerability in FreeRDP","HIGH",7.1,"2026-10-21",0],["CVE-2026-114041","FreeRDP","FreeRDP","FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message","MEDIUM",6.9,"2026-10-21",0],["CVE-2025-71437","astral-sh","uv","Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction","HIGH",8.7,"2026-10-21",0],["CVE-2021-48020","vyperlang","vyper","Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays","HIGH",8.3,"2026-10-21",0],["CVE-2021-48018","vyperlang","vyper","Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator","HIGH",8.3,"2026-10-21",0],["CVE-2021-48019","vyperlang","vyper","Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies","MEDIUM",6.3,"2026-10-21",0],["CVE-2020-37289","vyperlang","vyper","Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values","MEDIUM",6.3,"2026-10-21",0],["CVE-2020-37287","vyperlang","vyper","Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments","HIGH",8.2,"2026-10-21",0],["CVE-2020-37288","vyperlang","vyper","Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops","MEDIUM",6.3,"2026-10-21",0],["CVE-2020-37286","vyperlang","vyper","Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls","HIGH",8.3,"2026-10-21",0],["CVE-2026-113738","R6410418","Jackrong-llm-finetuning-guide","R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mt","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-114038","Red Hat","Red Hat Enterprise Linux 10","Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed for","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-113737","R6410418","Jackrong-llm-finetuning-guide","R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors ","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-113736","D-Link","DHP-W610AV","D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password","CRITICAL",9.3,"2026-10-21",0],["CVE-2025-60469","","","A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_pa","","","2026-10-21",0],["CVE-2025-60476","","","A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GP","","","2026-10-21",0],["CVE-2025-60478","","","A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of G","","","2026-10-21",0],["CVE-2025-60479","","","A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of G","","","2026-10-21",0],["CVE-2025-60487","","","A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC P","","","2026-10-21",0],["CVE-2025-60489","","","A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c","","","2026-10-21",0],["CVE-2025-60490","","","A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/fi","","","2026-10-21",0],["CVE-2025-60491","","","A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Pro","","","2026-10-21",0],["CVE-2025-60492","","","A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/M","MEDIUM",5.5,"2026-10-21",0],["CVE-2025-60493","","","A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Pr","","","2026-10-21",0],["CVE-2025-60497","","","A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box","MEDIUM",5.5,"2026-10-21",0],["CVE-2025-71438","","","An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box","","","2026-10-21",0],["CVE-2026-113735","D-Link","DCS-6501LH","D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-113707","a2aproject","a2a-rs","a2aproject a2a-rs inmemory.rs update race condition","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-113706","a2aproject","a2a-rs","a2aproject a2a-rs inmemory.rs information disclosure","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-109682","Rapid7","Metasploit Framework","Metasploit Framework HTTP Redirect Server-Side Request Forgery","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-109681","Rapid7","Metasploit Framework","Metasploit Framework FTP PASV Response SSRF","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-113705","a2aproject","a2a-rs","a2aproject a2a-rs error.rs information exposure","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-112202","","Imager-File-GIF","Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidat","","","2026-10-21",0],["CVE-2026-76587","IBM","Planning Analytics","IBM Planning Analytics Buffer Overflow","HIGH",8.8,"2026-10-21",0],["CVE-2026-113726","pypa","virtualenv","virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","HIGH",7.8,"2026-10-21",0],["CVE-2026-113776","pypa","virtualenv","virtualenv activation scripts run code from a path that contains a placeholder name","HIGH",7.8,"2026-10-21",0],["CVE-2026-9825","IBM","CyberFraud","IBM Cyber Fraud Reachable Assertion","LOW",3.7,"2026-10-21",0],["CVE-2026-113732","pypa","virtualenv","virtualenv activate.fish runs commands from a path or prompt with a backslash before a quo","HIGH",7.8,"2026-10-21",0],["CVE-2026-113704","a2aproject","a2a-rs","a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-81212","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Improper Authorization","CRITICAL",10,"2026-10-21",0],["CVE-2026-82891","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by a security vulnerability","HIGH",8.1,"2026-10-21",0],["CVE-2026-87800","IBM","Cyber Fraud","IBM Cyber Fraud includes components with multiple known vulnerabilities","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-92559","IBM","App Connect Enterprise","IBM App Connect Enterprise is vulnerable to a credential exposure","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-93441","IBM","QRadar Security Information and Event Management","IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service","HIGH",8.6,"2026-10-21",0],["CVE-2026-93442","IBM","QRadar","IBM QRadar SIEM Out-of-bounds Read","HIGH",8.2,"2026-10-21",0],["CVE-2026-93744","IBM","i","IBM i Improper Authentication","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-93888","IBM","Sterling Connect Direct for Unix","IBM Sterling Connect:Direct for Unix Buffer Overflow","HIGH",7.8,"2026-10-21",0],["CVE-2026-94402","IBM","@carbon/charts","IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-113731","djust-org","djust","djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool","LOW",3.3,"2026-10-21",0],["CVE-2026-85783","","Crypt-Age","Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of ","","","2026-10-21",0],["CVE-2026-91665","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91668","Oracle Corporation","Oracle Data Integrator","Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component","HIGH",8.8,"2026-10-21",0],["CVE-2026-91662","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that ","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-91663","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91664","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.5,"2026-10-21",0],["CVE-2026-91659","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Build). The supported version that is affected","HIGH",7.7,"2026-10-21",0],["CVE-2026-91660","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91661","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.7,"2026-10-21",0],["CVE-2026-91656","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version t","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91657","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91658","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91654","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-91655","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91651","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version t","HIGH",8.5,"2026-10-21",0],["CVE-2026-91652","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5,"2026-10-21",0],["CVE-2026-91653","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version t","HIGH",8.5,"2026-10-21",0],["CVE-2026-91648","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91649","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that ","MEDIUM",6,"2026-10-21",0],["CVE-2026-91650","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that ","LOW",3.7,"2026-10-21",0],["CVE-2026-91645","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91646","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5.6,"2026-10-21",0],["CVE-2026-91647","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",8.1,"2026-10-21",0],["CVE-2026-91642","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.3,"2026-10-21",0],["CVE-2026-91643","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91644","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-91639","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.7,"2026-10-21",0],["CVE-2026-91640","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5,"2026-10-21",0],["CVE-2026-91641","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5,"2026-10-21",0],["CVE-2026-91636","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.7,"2026-10-21",0],["CVE-2026-91637","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91638","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91634","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91635","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",8.1,"2026-10-21",0],["CVE-2026-91631","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",5,"2026-10-21",0],["CVE-2026-91632","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","HIGH",7.7,"2026-10-21",0],["CVE-2026-91633","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",6,"2026-10-21",0],["CVE-2026-91628","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91629","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91630","Oracle Corporation","Oracle Essbase","Vulnerability in Oracle Essbase (component: Security). The supported version that is affec","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-91625","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.2,"2026-10-21",0],["CVE-2026-91627","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","HIGH",7.8,"2026-10-21",0],["CVE-2026-91622","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-91623","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",7.4,"2026-10-21",0],["CVE-2026-91624","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91615","Oracle Corporation","Oracle Database Server","Vulnerability in the Java VM component of Oracle Database Server. Supported versions that ","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-91616","Oracle Corporation","Oracle Middleware Common Libraries and Tools","Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion","LOW",3.7,"2026-10-21",0],["CVE-2026-91617","Oracle Corporation","Oracle Middleware Common Libraries and Tools","Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91612","Oracle Corporation","Oracle Communications Unified Inventory Management","Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle ","LOW",3.3,"2026-10-21",0],["CVE-2026-91613","Oracle Corporation","Oracle Communications Unified Inventory Management","Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle ","LOW",3.3,"2026-10-21",0],["CVE-2026-91614","Oracle Corporation","Oracle Communications Unified Inventory Management","Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle ","LOW",3.3,"2026-10-21",0],["CVE-2026-91609","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91610","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: General). Supported versions that a","HIGH",8.8,"2026-10-21",0],["CVE-2026-91604","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",7.5,"2026-10-21",0],["CVE-2026-91607","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91608","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Serve","HIGH",7.5,"2026-10-21",0],["CVE-2026-91597","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",8.3,"2026-10-21",0],["CVE-2026-91598","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91600","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91582","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","LOW",3.7,"2026-10-21",0],["CVE-2026-91588","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91590","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Servi","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91576","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91577","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-91579","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platfo","HIGH",8.8,"2026-10-21",0],["CVE-2026-91568","Oracle Corporation","Oracle Database Server","Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that ar","HIGH",7.7,"2026-10-21",0],["CVE-2026-91573","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.2,"2026-10-21",0],["CVE-2026-91574","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publis","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91563","Oracle Corporation","Oracle OLAP","Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions t","HIGH",8.8,"2026-10-21",0],["CVE-2026-91565","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-91557","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",7,"2026-10-21",0],["CVE-2026-91559","Oracle Corporation","PeopleSoft Enterprise FIN Manufacturing Brazil","Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle Peop","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-91562","Oracle Corporation","PeopleSoft Enterprise FIN Inventory Brazil","Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-91553","Oracle Corporation","PeopleSoft Enterprise FIN Product Configurator Brazil","Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Orac","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-91554","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91555","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Serve","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91549","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",7.8,"2026-10-21",0],["CVE-2026-91550","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.8,"2026-10-21",0],["CVE-2026-91552","Oracle Corporation","Oracle WebCenter Sites","Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component","HIGH",7.5,"2026-10-21",0],["CVE-2026-91545","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",7.8,"2026-10-21",0],["CVE-2026-91546","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",8.1,"2026-10-21",0],["CVE-2026-91547","Oracle Corporation","Oracle GoldenGate","Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions t","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91539","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",7.8,"2026-10-21",0],["CVE-2026-91541","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Brazil","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle Peo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91542","Oracle Corporation","Oracle WebCenter Sites","Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component","HIGH",7.5,"2026-10-21",0],["CVE-2026-91535","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",8.8,"2026-10-21",0],["CVE-2026-91536","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","MEDIUM",5,"2026-10-21",0],["CVE-2026-91537","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The su","HIGH",7.8,"2026-10-21",0],["CVE-2026-91532","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-91534","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",8.6,"2026-10-21",0],["CVE-2026-91527","Oracle Corporation","Oracle ZFS Storage Appliance Kit","Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component","HIGH",8.8,"2026-10-21",0],["CVE-2026-91528","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platfo","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91530","Oracle Corporation","Oracle GoldenGate","Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported version","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-91523","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91524","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91526","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Serve","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91519","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91520","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.8,"2026-10-21",0],["CVE-2026-91521","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.8,"2026-10-21",0],["CVE-2026-91515","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",7.5,"2026-10-21",0],["CVE-2026-91517","Oracle Corporation","Oracle Management Pack for Oracle GoldenGate","Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle Golden","HIGH",8,"2026-10-21",0],["CVE-2026-91518","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publis","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91512","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",7.2,"2026-10-21",0],["CVE-2026-91514","Oracle Corporation","Oracle BI Publisher","Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91505","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6,"2026-10-21",0],["CVE-2026-91506","Oracle Corporation","Workflow","Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Noti","HIGH",8.1,"2026-10-21",0],["CVE-2026-91511","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Inte","HIGH",7.1,"2026-10-21",0],["CVE-2026-91502","Oracle Corporation","Oracle WebLogic Server","Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component","HIGH",7.3,"2026-10-21",0],["CVE-2026-91503","Oracle Corporation","Oracle Database Server","Vulnerability in the VPD component of Oracle Database Server. Supported versions that are ","HIGH",8.1,"2026-10-21",0],["CVE-2026-91504","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","HIGH",7.5,"2026-10-21",0],["CVE-2026-91497","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91499","Oracle Corporation","Oracle Database Server","Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that ar","HIGH",8.8,"2026-10-21",0],["CVE-2026-91501","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91494","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",7.4,"2026-10-21",0],["CVE-2026-91495","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91496","Oracle Corporation","Workflow","Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Noti","HIGH",7.5,"2026-10-21",0],["CVE-2026-91491","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91492","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",8.7,"2026-10-21",0],["CVE-2026-91493","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",7.5,"2026-10-21",0],["CVE-2026-91489","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",7.1,"2026-10-21",0],["CVE-2026-91490","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91486","Oracle Corporation","PeopleSoft Enterprise FIN General Ledger Brazil","Vulnerability in the PeopleSoft Enterprise FIN General Ledger Brazil product of Oracle Peo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-91487","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affecte","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-91488","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",7.1,"2026-10-21",0],["CVE-2026-91483","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.8,"2026-10-21",0],["CVE-2026-91484","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affe","HIGH",7.5,"2026-10-21",0],["CVE-2026-91485","Oracle Corporation","PeopleSoft Enterprise FIN Cash Management","Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSof","LOW",3.8,"2026-10-21",0],["CVE-2026-91480","Oracle Corporation","PeopleSoft Enterprise SCM Strategic Sourcing","Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle People","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91481","Oracle Corporation","PeopleSoft Enterprise SCM Purchasing","Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (co","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91482","Oracle Corporation","PeopleSoft Enterprise SCM Strategic Sourcing","Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle People","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91477","Oracle Corporation","Oracle JavaFX","Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supporte","LOW",3.1,"2026-10-21",0],["CVE-2026-91478","Oracle Corporation","PeopleSoft Enterprise SCM Strategic Sourcing","Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle People","HIGH",8.8,"2026-10-21",0],["CVE-2026-91479","Oracle Corporation","Oracle Database Server","Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that ar","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91474","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Brazil","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle Peo","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91475","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-91476","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Brazil","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle Peo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91468","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91471","Oracle Corporation","PeopleSoft Enterprise CC Common Application Objects","Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle","LOW",3.7,"2026-10-21",0],["CVE-2026-91473","Oracle Corporation","Oracle HTTP Server","Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: We","HIGH",7.8,"2026-10-21",0],["CVE-2026-91465","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Argentina","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle ","HIGH",7.5,"2026-10-21",0],["CVE-2026-91466","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Argentina","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle ","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-91467","Oracle Corporation","Oracle Fusion Middleware Control","Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware ","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-91462","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91463","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91464","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91460","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.8,"2026-10-21",0],["CVE-2026-91461","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.7,"2026-10-21",0],["CVE-2026-91457","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.8,"2026-10-21",0],["CVE-2026-91458","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.8,"2026-10-21",0],["CVE-2026-91459","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.8,"2026-10-21",0],["CVE-2026-91452","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91453","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91455","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91449","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.4,"2026-10-21",0],["CVE-2026-91450","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.4,"2026-10-21",0],["CVE-2026-91451","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affec","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91446","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-91447","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.5,"2026-10-21",0],["CVE-2026-91448","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.5,"2026-10-21",0],["CVE-2026-91444","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-91445","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communic","HIGH",8.2,"2026-10-21",0],["CVE-2026-91441","Oracle Corporation","Siebel Apps - Customer Order Management","Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91442","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",8.8,"2026-10-21",0],["CVE-2026-91443","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91438","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.1,"2026-10-21",0],["CVE-2026-91439","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91440","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91435","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91436","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","LOW",3.9,"2026-10-21",0],["CVE-2026-91437","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",8.7,"2026-10-21",0],["CVE-2026-91432","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91433","Oracle Corporation","Siebel Apps - Field Service","Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: ","HIGH",7.2,"2026-10-21",0],["CVE-2026-91434","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-91429","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91430","Oracle Corporation","Siebel Apps - Financial Services","Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (compon","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91431","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91426","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91427","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","LOW",2.3,"2026-10-21",0],["CVE-2026-91428","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91422","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91423","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6,"2026-10-21",0],["CVE-2026-91424","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-91419","Oracle Corporation","Oracle HTTP Server","Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OS","HIGH",7.8,"2026-10-21",0],["CVE-2026-91420","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91421","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91417","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle J","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91418","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91413","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integ","MEDIUM",6,"2026-10-21",0],["CVE-2026-91414","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91415","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","HIGH",7,"2026-10-21",0],["CVE-2026-91410","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affect","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91411","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91412","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91407","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91408","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91409","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Networking). The supported version that is aff","LOW",3.7,"2026-10-21",0],["CVE-2026-91404","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",4,"2026-10-21",0],["CVE-2026-91405","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91406","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91399","Oracle Corporation","Primavera P6 Enterprise Project Portfolio Management","Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracl","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91400","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.1,"2026-10-21",0],["CVE-2026-91402","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition prod","LOW",3.1,"2026-10-21",0],["CVE-2026-91397","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.6,"2026-10-21",0],["CVE-2026-91398","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-91394","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (com","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91395","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91396","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91392","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","LOW",3.7,"2026-10-21",0],["CVE-2026-91393","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","LOW",3.1,"2026-10-21",0],["CVE-2026-91389","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91390","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91391","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","LOW",3.7,"2026-10-21",0],["CVE-2026-91386","Oracle Corporation","JD Edwards EnterpriseOne Orchestrator","Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-91387","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91388","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI)","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91384","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91385","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition prod","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91381","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle J","LOW",3.7,"2026-10-21",0],["CVE-2026-91382","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91383","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-91378","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open ","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91379","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91380","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",4,"2026-10-21",0],["CVE-2026-91375","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affect","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91376","Oracle Corporation","Primavera P6 Enterprise Project Portfolio Management","Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracl","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91377","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open ","HIGH",7.5,"2026-10-21",0],["CVE-2026-91372","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","LOW",3.3,"2026-10-21",0],["CVE-2026-91373","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected ar","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91374","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-91369","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91370","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91371","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-91366","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91367","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91368","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",4.1,"2026-10-21",0],["CVE-2026-91364","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-91365","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91361","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91362","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91363","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","LOW",3.7,"2026-10-21",0],["CVE-2026-91358","Oracle Corporation","Oracle Business Process Management Suite","Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid","HIGH",8.2,"2026-10-21",0],["CVE-2026-91359","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91360","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91355","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.4,"2026-10-21",0],["CVE-2026-91356","Oracle Corporation","PeopleSoft Enterprise HCM Global Payroll Switzerland","Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracl","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-91357","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91352","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91353","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.6,"2026-10-21",0],["CVE-2026-91354","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91349","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91350","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91351","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91347","Oracle Corporation","iSupport","Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Reque","HIGH",8.5,"2026-10-21",0],["CVE-2026-91348","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Suppor","HIGH",8.4,"2026-10-21",0],["CVE-2026-91344","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91345","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-91346","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.2,"2026-10-21",0],["CVE-2026-91341","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91342","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.2,"2026-10-21",0],["CVE-2026-91343","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.6,"2026-10-21",0],["CVE-2026-91338","Oracle Corporation","iSupport","Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal oper","HIGH",7.1,"2026-10-21",0],["CVE-2026-91339","Oracle Corporation","iSupport","Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Reque","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91340","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.8,"2026-10-21",0],["CVE-2026-91336","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The su","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91337","Oracle Corporation","iProcurement","Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal ","HIGH",7.4,"2026-10-21",0],["CVE-2026-91333","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Security). Supported versions that are affecte","LOW",3.7,"2026-10-21",0],["CVE-2026-91334","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.7,"2026-10-21",0],["CVE-2026-91335","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",2.6,"2026-10-21",0],["CVE-2026-91330","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.3,"2026-10-21",0],["CVE-2026-91331","Oracle Corporation","PeopleSoft Enterprise CC Common Application Objects","Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle","LOW",3.8,"2026-10-21",0],["CVE-2026-91332","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affec","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91327","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-91328","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91329","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91324","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The ","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91325","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-91326","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91321","Oracle Corporation","iProcurement","Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisiti","HIGH",7.5,"2026-10-21",0],["CVE-2026-91322","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Ora","LOW",3.3,"2026-10-21",0],["CVE-2026-91323","Oracle Corporation","Oracle WebLogic Server","Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91319","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Jav","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91320","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Ora","MEDIUM",5.7,"2026-10-21",0],["CVE-2026-91316","Oracle Corporation","iProcurement","Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content","HIGH",7.2,"2026-10-21",0],["CVE-2026-91317","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91318","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Sec","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91313","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-91314","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91315","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91310","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91311","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91312","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91307","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-91308","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-91309","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91304","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91305","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91306","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-91301","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.6,"2026-10-21",0],["CVE-2026-91302","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.3,"2026-10-21",0],["CVE-2026-91303","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91298","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91299","Oracle Corporation","JD Edwards EnterpriseOne Orchestrator","Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c","CRITICAL",10,"2026-10-21",0],["CVE-2026-91300","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.1,"2026-10-21",0],["CVE-2026-91295","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91296","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91297","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91292","Oracle Corporation","JD Edwards EnterpriseOne Localizations","Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD Edwards (","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91293","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91294","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91289","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91290","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91291","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.6,"2026-10-21",0],["CVE-2026-91286","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.2,"2026-10-21",0],["CVE-2026-91287","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-91288","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.4,"2026-10-21",0],["CVE-2026-91283","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-91284","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91285","Oracle Corporation","JD Edwards EnterpriseOne Orchestrator","Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91281","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91282","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91278","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-91279","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91280","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91275","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-91276","Oracle Corporation","JD Edwards EnterpriseOne Orchestrator","Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91277","Oracle Corporation","JD Edwards EnterpriseOne Orchestrator","Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91273","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.6,"2026-10-21",0],["CVE-2026-91274","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91270","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91271","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-91272","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.4,"2026-10-21",0],["CVE-2026-91267","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.6,"2026-10-21",0],["CVE-2026-91268","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91269","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-91264","Oracle Corporation","PeopleSoft Enterprise SCM Manufacturing","Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft ","LOW",3.7,"2026-10-21",0],["CVE-2026-91265","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91266","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.4,"2026-10-21",0],["CVE-2026-91261","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","LOW",3.1,"2026-10-21",0],["CVE-2026-91262","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-91263","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-91257","Oracle Corporation","iSupport","Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Reque","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91259","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-91260","Oracle Corporation","iProcurement","Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content","HIGH",7.2,"2026-10-21",0],["CVE-2026-91255","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The sup","HIGH",7.5,"2026-10-21",0],["CVE-2026-91256","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","HIGH",7.1,"2026-10-21",0],["CVE-2026-91252","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","HIGH",8.2,"2026-10-21",0],["CVE-2026-91253","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The sup","HIGH",7.8,"2026-10-21",0],["CVE-2026-91254","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The sup","HIGH",7.5,"2026-10-21",0],["CVE-2026-91249","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The ","LOW",3.3,"2026-10-21",0],["CVE-2026-91250","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91251","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91246","Oracle Corporation","Oracle WebCenter Portal","Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-91247","Oracle Corporation","Oracle WebCenter Portal","Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91248","Oracle Corporation","Oracle WebCenter Portal","Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-91243","Oracle Corporation","Oracle Business Process Management Suite","Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-91244","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-91245","Oracle Corporation","Oracle WebCenter Portal","Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91241","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91242","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins). The su","HIGH",7.4,"2026-10-21",0],["CVE-2026-91238","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.1,"2026-10-21",0],["CVE-2026-91239","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",8.8,"2026-10-21",0],["CVE-2026-91240","Oracle Corporation","Oracle WebCenter Sites","Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-91235","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91236","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91237","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.5,"2026-10-21",0],["CVE-2026-91232","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91233","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Ente","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91234","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91229","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.5,"2026-10-21",0],["CVE-2026-91230","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.3,"2026-10-21",0],["CVE-2026-91231","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap","CRITICAL",10,"2026-10-21",0],["CVE-2026-91226","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.5,"2026-10-21",0],["CVE-2026-91227","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.5,"2026-10-21",0],["CVE-2026-91228","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",7.1,"2026-10-21",0],["CVE-2026-91224","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91225","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-91222","Oracle Corporation","Oracle Business Process Management Suite","Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-91223","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",8.8,"2026-10-21",0],["CVE-2026-91219","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",8.6,"2026-10-21",0],["CVE-2026-91220","Oracle Corporation","Oracle Business Process Management Suite","Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91221","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",10,"2026-10-21",0],["CVE-2026-91216","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",10,"2026-10-21",0],["CVE-2026-91217","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",8.6,"2026-10-21",0],["CVE-2026-91218","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-91213","Oracle Corporation","Oracle Business Process Management Suite","Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid","HIGH",8.8,"2026-10-21",0],["CVE-2026-91214","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-91215","Oracle Corporation","Oracle SOA Suite","Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr","HIGH",8.8,"2026-10-21",0],["CVE-2026-91210","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-91211","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",8.7,"2026-10-21",0],["CVE-2026-91212","Oracle Corporation","Oracle Identity Manager Connector","Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware","HIGH",8.6,"2026-10-21",0],["CVE-2026-87423","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System)","MEDIUM",4.5,"2026-10-21",0],["CVE-2026-91208","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","MEDIUM",5.1,"2026-10-21",0],["CVE-2026-91209","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System)","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-87420","Oracle Corporation","Oracle Service Bus","Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Co","HIGH",8.8,"2026-10-21",0],["CVE-2026-87421","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging ","HIGH",7.1,"2026-10-21",0],["CVE-2026-87422","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","LOW",2.5,"2026-10-21",0],["CVE-2026-87417","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging ","HIGH",7.5,"2026-10-21",0],["CVE-2026-87418","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",2.5,"2026-10-21",0],["CVE-2026-87419","Oracle Corporation","Oracle Service Bus","Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Co","HIGH",8.8,"2026-10-21",0],["CVE-2026-87415","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87416","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.7,"2026-10-21",0],["CVE-2026-87412","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",2.7,"2026-10-21",0],["CVE-2026-87413","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Th","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-87414","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging ","LOW",3.1,"2026-10-21",0],["CVE-2026-87409","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87410","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-87411","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Th","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-87404","Oracle Corporation","Pasta","Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine)","HIGH",7.5,"2026-10-21",0],["CVE-2026-87407","Oracle Corporation","Oracle Applications Framework","Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (com","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87408","Oracle Corporation","Oracle Applications Framework","Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (com","HIGH",8.7,"2026-10-21",0],["CVE-2026-87401","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.3,"2026-10-21",0],["CVE-2026-87402","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7.3,"2026-10-21",0],["CVE-2026-87403","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7.1,"2026-10-21",0],["CVE-2026-87398","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-87399","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-87400","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-87395","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-87396","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87397","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.8,"2026-10-21",0],["CVE-2026-87392","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87393","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87394","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.2,"2026-10-21",0],["CVE-2026-87389","Oracle Corporation","JD Edwards EnterpriseOne Human Resources Management","Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle","LOW",3.7,"2026-10-21",0],["CVE-2026-87390","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-87391","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-87386","Oracle Corporation","JD Edwards EnterpriseOne General Ledger","Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87387","Oracle Corporation","JD Edwards EnterpriseOne Homebuilder","Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (co","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87388","Oracle Corporation","JD Edwards EnterpriseOne Configurator","Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (c","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87383","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-87384","Oracle Corporation","JD Edwards EnterpriseOne Human Resources Management","Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-87385","Oracle Corporation","JD Edwards EnterpriseOne Human Resources Management","Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-113730","orphan-oss","ognl","OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies","MEDIUM",5.6,"2026-10-21",0],["CVE-2026-87381","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-87382","Oracle Corporation","JD Edwards EnterpriseOne Operational Sourcing","Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Ed","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87378","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87379","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-87380","Oracle Corporation","JD Edwards EnterpriseOne Sales Order Entry","Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwar","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87375","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87376","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-87377","Oracle Corporation","WebCenter Content: Imaging","Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-87372","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87373","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87374","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-87369","Oracle Corporation","Oracle Service Bus","Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Co","HIGH",7.5,"2026-10-21",0],["CVE-2026-87370","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87371","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-87365","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87366","Oracle Corporation","Oracle Applications Framework","Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (com","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-87367","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.7,"2026-10-21",0],["CVE-2026-87362","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87363","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-87364","Oracle Corporation","Oracle Service Bus","Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Co","HIGH",8.8,"2026-10-21",0],["CVE-2026-87360","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87361","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-87357","Oracle Corporation","Order Capture","Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal","HIGH",7.2,"2026-10-21",0],["CVE-2026-87358","Oracle Corporation","Oracle General Ledger","Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ","HIGH",7.1,"2026-10-21",0],["CVE-2026-87359","Oracle Corporation","Oracle Service Bus","Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Co","HIGH",8.8,"2026-10-21",0],["CVE-2026-87354","Oracle Corporation","Oracle TimesTen In-Memory Database","Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator). Supp","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-87355","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-87356","Oracle Corporation","Applications Platform Engineering","Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite ","HIGH",7.8,"2026-10-21",0],["CVE-2026-87351","Oracle Corporation","Oracle GoldenGate","Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported version","HIGH",8.8,"2026-10-21",0],["CVE-2026-87352","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-87353","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.5,"2026-10-21",0],["CVE-2026-87348","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-87349","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87350","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.5,"2026-10-21",0],["CVE-2026-87345","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-87346","Oracle Corporation","Oracle HTTP Server","Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Or","HIGH",8.7,"2026-10-21",0],["CVE-2026-87347","Oracle Corporation","Oracle HTTP Server","Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OS","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-87343","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-87344","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87339","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST)","LOW",3.1,"2026-10-21",0],["CVE-2026-87340","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.7,"2026-10-21",0],["CVE-2026-87342","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87336","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87337","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","CRITICAL",10,"2026-10-21",0],["CVE-2026-87338","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-87334","Oracle Corporation","Oracle JDeveloper","Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-87335","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87331","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.4,"2026-10-21",0],["CVE-2026-87332","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3,"2026-10-21",0],["CVE-2026-87333","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","LOW",3.6,"2026-10-21",0],["CVE-2026-87328","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-87329","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87330","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-87325","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-87326","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-87327","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-87323","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-87324","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-87320","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-87321","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-87322","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","HIGH",8.4,"2026-10-21",0],["CVE-2026-87317","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-87318","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-87319","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-87315","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-87316","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.8,"2026-10-21",0],["CVE-2026-111879","","DBI","DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a fail","","","2026-10-21",0],["CVE-2026-87313","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-87314","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.4,"2026-10-21",0],["CVE-2026-87310","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-87311","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","MEDIUM",5.6,"2026-10-21",0],["CVE-2026-87312","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-87307","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.1,"2026-10-21",0],["CVE-2026-87308","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",7.1,"2026-10-21",0],["CVE-2026-87309","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-87305","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-87306","Oracle Corporation","JD Edwards EnterpriseOne Tools","Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen","HIGH",8.1,"2026-10-21",0],["CVE-2026-87303","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-87304","Oracle Corporation","Oracle Outside In Technology","Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com","HIGH",8.6,"2026-10-21",0],["CVE-2026-87300","Oracle Corporation","Oracle Weblogic Server Proxy Plug-in","Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middlew","HIGH",8.7,"2026-10-21",0],["CVE-2026-87301","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","HIGH",8.4,"2026-10-21",0],["CVE-2026-87302","Oracle Corporation","Oracle WebLogic Server","Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-87297","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-87298","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87299","Oracle Corporation","Oracle WebCenter Content","Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-87295","Oracle Corporation","Oracle HRMS (India)","Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: In","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87296","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","HIGH",7.5,"2026-10-21",0],["CVE-2026-87292","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.7,"2026-10-21",0],["CVE-2026-87293","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-87294","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-87263","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",8.8,"2026-10-21",0],["CVE-2026-87290","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-87291","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affec","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-87251","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-87255","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affecte","LOW",3.7,"2026-10-21",0],["CVE-2026-83409","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","HIGH",8.1,"2026-10-21",0],["CVE-2026-83426","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","HIGH",8.7,"2026-10-21",0],["CVE-2026-83427","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-83404","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python","HIGH",7.5,"2026-10-21",0],["CVE-2026-83406","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-83407","Oracle Corporation","Oracle Access Manager","Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:","HIGH",8.6,"2026-10-21",0],["CVE-2026-83401","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-83402","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-83403","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","HIGH",8.8,"2026-10-21",0],["CVE-2026-83399","Oracle Corporation","Oracle WebLogic Server","Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-83400","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-83396","Oracle Corporation","Oracle Data Integrator","Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-83397","Oracle Corporation","Oracle Data Integrator","Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-83398","Oracle Corporation","Oracle Data Integrator","Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component","HIGH",8.2,"2026-10-21",0],["CVE-2026-83394","Oracle Corporation","Oracle Demand Planning","Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Int","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-83395","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83391","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Pa","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-83392","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","LOW",3.1,"2026-10-21",0],["CVE-2026-83393","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","HIGH",8.5,"2026-10-21",0],["CVE-2026-83388","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","LOW",2.2,"2026-10-21",0],["CVE-2026-83389","Oracle Corporation","Oracle HRMS (UK)","Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Inter","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-83390","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-83386","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83387","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-83384","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83385","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83381","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Security). Supported versions that are affecte","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-83382","Oracle Corporation","Oracle Report Manager","Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: ","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-83383","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83379","Oracle Corporation","Oracle Weblogic Server Proxy Plug-in","Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middlew","HIGH",8.7,"2026-10-21",0],["CVE-2026-83380","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-83376","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","LOW",3.7,"2026-10-21",0],["CVE-2026-83377","Oracle Corporation","Oracle HRMS (US)","Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Mobil","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-83378","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affecte","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-83373","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3,"2026-10-21",0],["CVE-2026-83374","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-83375","Oracle Corporation","PeopleSoft Enterprise HCM Human Resources","Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSof","MEDIUM",6,"2026-10-21",0],["CVE-2026-83370","Oracle Corporation","Sourcing","Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Su","HIGH",7.5,"2026-10-21",0],["CVE-2026-83371","Oracle Corporation","Oracle HRMS (UK)","Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Inter","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-83372","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-83366","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",7.4,"2026-10-21",0],["CVE-2026-83367","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",7.4,"2026-10-21",0],["CVE-2026-83360","Oracle Corporation","Oracle HRMS (Republic of Korea)","Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (c","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83361","Oracle Corporation","Oracle Contract Lifecycle Management for Public Sector","Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Ora","HIGH",8.1,"2026-10-21",0],["CVE-2026-83363","Oracle Corporation","Oracle Contract Lifecycle Management for Public Sector","Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Ora","HIGH",8.8,"2026-10-21",0],["CVE-2026-83358","Oracle Corporation","Oracle HRMS (Norway)","Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: I","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-83359","Oracle Corporation","Oracle HRMS (India)","Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: In","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-70869","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-73964","Oracle Corporation","Oracle Database Server","Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that ar","LOW",2.7,"2026-10-21",0],["CVE-2026-83139","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-60964","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",1.9,"2026-10-21",0],["CVE-2026-60968","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6,"2026-10-21",0],["CVE-2026-70860","Oracle Corporation","PeopleSoft Enterprise FIN Common Objects Argentina","Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle ","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-60885","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-60887","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.8,"2026-10-21",0],["CVE-2026-60878","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-60881","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-60882","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-60869","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-60874","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-60876","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-60819","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.7,"2026-10-21",0],["CVE-2026-60839","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-60746","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-60809","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-60814","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.9,"2026-10-21",0],["CVE-2026-60743","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-60745","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-60453","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System)","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-60500","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-60662","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The s","HIGH",7.8,"2026-10-21",0],["CVE-2026-101857","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-47025","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Suppor","HIGH",8.8,"2026-10-21",0],["CVE-2026-60432","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging ","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101854","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","HIGH",8.8,"2026-10-21",0],["CVE-2026-101855","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101856","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101852","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","HIGH",8.8,"2026-10-21",0],["CVE-2026-101853","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","HIGH",8.8,"2026-10-21",0],["CVE-2026-101849","Oracle Corporation","Installed Base","Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create ","HIGH",7.6,"2026-10-21",0],["CVE-2026-101850","Oracle Corporation","Installed Base","Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101851","Oracle Corporation","Installed Base","Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Pr","HIGH",7.1,"2026-10-21",0],["CVE-2026-101846","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Inte","LOW",3.5,"2026-10-21",0],["CVE-2026-101847","Oracle Corporation","Oracle Bills of Material","Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-101843","Oracle Corporation","Production Scheduling","Vulnerability in the Production Scheduling product of Oracle E-Business Suite (component: ","MEDIUM",4.5,"2026-10-21",0],["CVE-2026-101844","Oracle Corporation","Oracle Concurrent Processing","Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp","LOW",3.1,"2026-10-21",0],["CVE-2026-101845","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Inte","LOW",3.1,"2026-10-21",0],["CVE-2026-101840","Oracle Corporation","Oracle Contract Lifecycle Management for Public Sector","Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Ora","HIGH",7.2,"2026-10-21",0],["CVE-2026-101841","Oracle Corporation","Global Order Promising","Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component:","HIGH",8.2,"2026-10-21",0],["CVE-2026-101842","Oracle Corporation","Strategic Network Optimization","Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (co","HIGH",8.8,"2026-10-21",0],["CVE-2026-101835","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",7.5,"2026-10-21",0],["CVE-2026-101836","Oracle Corporation","iSupplier Portal","Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Inter","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101837","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",7.7,"2026-10-21",0],["CVE-2026-101833","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",7.6,"2026-10-21",0],["CVE-2026-101834","Oracle Corporation","Oracle Shipping Execution","Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (compone","HIGH",8.1,"2026-10-21",0],["CVE-2026-101831","Oracle Corporation","Oracle Quality","Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Interna","HIGH",8.1,"2026-10-21",0],["CVE-2026-101832","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-108518","","DBI","DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database","","","2026-10-21",0],["CVE-2026-101829","Oracle Corporation","Oracle Mobile Application Server","Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (","HIGH",7.4,"2026-10-21",0],["CVE-2026-101830","Oracle Corporation","Oracle Project Contracts","Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (componen","HIGH",7.7,"2026-10-21",0],["CVE-2026-101827","Oracle Corporation","Oracle HCM Common Architecture","Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (co","HIGH",7.1,"2026-10-21",0],["CVE-2026-101828","Oracle Corporation","Oracle Mobile Application Server","Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101825","Oracle Corporation","Oracle HCM Common Architecture","Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (co","HIGH",7.5,"2026-10-21",0],["CVE-2026-101826","Oracle Corporation","Oracle HCM Common Architecture","Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (co","HIGH",7.5,"2026-10-21",0],["CVE-2026-101823","Oracle Corporation","Oracle Bills of Material","Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (componen","HIGH",7.5,"2026-10-21",0],["CVE-2026-101824","Oracle Corporation","Document Management and Collaboration","Vulnerability in the Document Management and Collaboration product of Oracle E-Business Su","HIGH",8.7,"2026-10-21",0],["CVE-2026-101820","Oracle Corporation","Oracle General Ledger","Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101821","Oracle Corporation","Oracle Compensation Workbench","Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (com","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101822","Oracle Corporation","Oracle Bills of Material","Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (componen","HIGH",7.2,"2026-10-21",0],["CVE-2026-101816","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Int","HIGH",7.2,"2026-10-21",0],["CVE-2026-101818","Oracle Corporation","Oracle Product Hub","Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Ite","HIGH",7.7,"2026-10-21",0],["CVE-2026-101819","Oracle Corporation","Oracle General Ledger","Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101814","Oracle Corporation","Oracle Engineering","Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Cha","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101815","Oracle Corporation","Assets","Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operat","HIGH",7.6,"2026-10-21",0],["CVE-2026-101810","Oracle Corporation","MySQL Router","Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Th","HIGH",7.5,"2026-10-21",0],["CVE-2026-101812","Oracle Corporation","Oracle Complex Maintenance, Repair and Overhaul","Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-B","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101813","Oracle Corporation","Oracle Engineering","Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Cha","HIGH",8.8,"2026-10-21",0],["CVE-2026-101807","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-101808","Oracle Corporation","Oracle Product Workbench","Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (componen","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-101809","Oracle Corporation","Workflow","Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Noti","CRITICAL",10,"2026-10-21",0],["CVE-2026-101804","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).","LOW",2.5,"2026-10-21",0],["CVE-2026-101805","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","LOW",3.3,"2026-10-21",0],["CVE-2026-101806","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101802","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101803","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101800","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101801","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101798","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101799","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101795","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-101796","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",7.5,"2026-10-21",0],["CVE-2026-101797","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","HIGH",7.5,"2026-10-21",0],["CVE-2026-101793","Oracle Corporation","Oracle Communications BRM - Elastic Charging Engine","Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101794","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101790","Oracle Corporation","Oracle Communications BRM - Elastic Charging Engine","Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle","LOW",3.3,"2026-10-21",0],["CVE-2026-101791","Oracle Corporation","Oracle Communications BRM - Elastic Charging Engine","Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle","HIGH",8.1,"2026-10-21",0],["CVE-2026-101792","Oracle Corporation","Oracle Communications BRM - Elastic Charging Engine","Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101788","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101789","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101785","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",8.3,"2026-10-21",0],["CVE-2026-101786","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",7.2,"2026-10-21",0],["CVE-2026-101787","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101782","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101783","Oracle Corporation","MySQL Router","Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Th","HIGH",7.4,"2026-10-21",0],["CVE-2026-101784","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101780","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101781","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",8.8,"2026-10-21",0],["CVE-2026-101777","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101778","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101779","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","LOW",2.7,"2026-10-21",0],["CVE-2026-101774","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101775","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",7.4,"2026-10-21",0],["CVE-2026-101776","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101771","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","HIGH",8.1,"2026-10-21",0],["CVE-2026-101772","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","HIGH",8.1,"2026-10-21",0],["CVE-2026-101773","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","HIGH",7.1,"2026-10-21",0],["CVE-2026-101769","Oracle Corporation","MySQL Cluster","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). ","HIGH",7,"2026-10-21",0],["CVE-2026-101770","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","HIGH",8.1,"2026-10-21",0],["CVE-2026-101766","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101767","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101768","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Th","HIGH",8.1,"2026-10-21",0],["CVE-2026-101763","Oracle Corporation","Oracle Communications BRM - Elastic Charging Engine","Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101764","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101765","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-101761","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101762","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101759","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","HIGH",7.5,"2026-10-21",0],["CVE-2026-101760","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101756","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101757","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","HIGH",7.8,"2026-10-21",0],["CVE-2026-101758","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","HIGH",8.2,"2026-10-21",0],["CVE-2026-101754","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101755","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101752","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101753","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101749","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101750","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101751","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101746","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","HIGH",7.3,"2026-10-21",0],["CVE-2026-101747","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101748","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101744","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","HIGH",8.4,"2026-10-21",0],["CVE-2026-101745","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101741","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101742","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101743","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101739","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","HIGH",7,"2026-10-21",0],["CVE-2026-101740","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","LOW",3.6,"2026-10-21",0],["CVE-2026-101736","Oracle Corporation","Primavera Unifier","Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (com","HIGH",7.4,"2026-10-21",0],["CVE-2026-101737","Oracle Corporation","Oracle Java SE","Vulnerability in Oracle Java SE (component: Compiler). The supported version that is affec","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101738","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","LOW",3.1,"2026-10-21",0],["CVE-2026-101733","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101734","Oracle Corporation","Oracle Agile Engineering Data Management","Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Cha","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101735","Oracle Corporation","Primavera Unifier","Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (com","HIGH",7.1,"2026-10-21",0],["CVE-2026-101731","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101732","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101728","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101729","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101730","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101725","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101726","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101727","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101722","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101723","Oracle Corporation","Oracle Agile PLM MCAD Connector","Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (compo","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-101724","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101720","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101721","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101717","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security)","MEDIUM",6.4,"2026-10-21",0],["CVE-2026-101718","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Applicati","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101719","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Applicati","HIGH",7.5,"2026-10-21",0],["CVE-2026-101714","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Clien","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101715","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Applicati","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101716","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Clien","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101711","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-101712","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-101713","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Applicati","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101709","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101710","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101706","Oracle Corporation","Oracle One-to-One Fulfillment","Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (com","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101707","Oracle Corporation","Oracle Concurrent Processing","Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp","HIGH",7.4,"2026-10-21",0],["CVE-2026-101708","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-101703","Oracle Corporation","Pasta","Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operati","HIGH",7.5,"2026-10-21",0],["CVE-2026-101704","Oracle Corporation","Oracle Concurrent Processing","Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp","HIGH",8.2,"2026-10-21",0],["CVE-2026-101705","Oracle Corporation","Oracle Common Applications","Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (compon","HIGH",7.7,"2026-10-21",0],["CVE-2026-101700","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","HIGH",8.1,"2026-10-21",0],["CVE-2026-101701","Oracle Corporation","Oracle Concurrent Processing","Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp","MEDIUM",6,"2026-10-21",0],["CVE-2026-101697","Oracle Corporation","Oracle One-to-One Fulfillment","Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (com","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101698","Oracle Corporation","Oracle One-to-One Fulfillment","Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-101699","Oracle Corporation","Oracle One-to-One Fulfillment","Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (com","HIGH",7.5,"2026-10-21",0],["CVE-2026-101694","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.2,"2026-10-21",0],["CVE-2026-101695","Oracle Corporation","Oracle One-to-One Fulfillment","Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (com","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101696","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101689","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",7.7,"2026-10-21",0],["CVE-2026-101690","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",8.2,"2026-10-21",0],["CVE-2026-101692","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101687","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",7.5,"2026-10-21",0],["CVE-2026-101688","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",8.6,"2026-10-21",0],["CVE-2026-101684","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",8.3,"2026-10-21",0],["CVE-2026-101685","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",8.8,"2026-10-21",0],["CVE-2026-101686","Oracle Corporation","Oracle E-Business Suite Integrated SOA Gateway","Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Bu","HIGH",8.8,"2026-10-21",0],["CVE-2026-101681","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7,"2026-10-21",0],["CVE-2026-101682","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7.8,"2026-10-21",0],["CVE-2026-101683","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7,"2026-10-21",0],["CVE-2026-101678","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Th","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101679","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Clien","HIGH",7.5,"2026-10-21",0],["CVE-2026-101680","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","HIGH",7.4,"2026-10-21",0],["CVE-2026-101676","Oracle Corporation","Oracle Concurrent Processing","Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp","HIGH",7.8,"2026-10-21",0],["CVE-2026-101677","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Th","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101673","Oracle Corporation","Oracle US Federal Human Resources","Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101674","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-101675","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-101670","Oracle Corporation","Oracle Email Center","Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Me","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101671","Oracle Corporation","Oracle Email Center","Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Me","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101672","Oracle Corporation","Oracle Call Center Technology","Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (com","HIGH",8.1,"2026-10-21",0],["CVE-2026-101668","Oracle Corporation","Oracle Customer Care","Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: I","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101669","Oracle Corporation","Oracle Public Sector Human Resources","Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Sui","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101665","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.1,"2026-10-21",0],["CVE-2026-101666","Oracle Corporation","Oracle Trade Management","Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101667","Oracle Corporation","Oracle Trade Management","Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101661","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.4,"2026-10-21",0],["CVE-2026-101662","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.1,"2026-10-21",0],["CVE-2026-101664","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101656","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101658","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.4,"2026-10-21",0],["CVE-2026-101660","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101654","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101655","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101650","Oracle Corporation","Oracle Partner Management","Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (compone","HIGH",7.1,"2026-10-21",0],["CVE-2026-101651","Oracle Corporation","Oracle Partner Management","Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (compone","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101653","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101647","Oracle Corporation","Oracle iSetup","Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101648","Oracle Corporation","Oracle Partner Management","Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (compone","HIGH",8.4,"2026-10-21",0],["CVE-2026-101649","Oracle Corporation","Oracle Partner Management","Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (compone","HIGH",7.1,"2026-10-21",0],["CVE-2026-101645","Oracle Corporation","Oracle iSetup","Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101646","Oracle Corporation","Oracle iSetup","Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General ","HIGH",7.2,"2026-10-21",0],["CVE-2026-101642","Oracle Corporation","Oracle Report Manager","Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: ","HIGH",7.1,"2026-10-21",0],["CVE-2026-101643","Oracle Corporation","Oracle Sales Online","Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: In","HIGH",7.1,"2026-10-21",0],["CVE-2026-101644","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-101639","Oracle Corporation","Oracle Marketing","Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audie","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101640","Oracle Corporation","Oracle Marketing","Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audie","HIGH",8.2,"2026-10-21",0],["CVE-2026-101641","Oracle Corporation","Oracle Report Manager","Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: ","HIGH",7.6,"2026-10-21",0],["CVE-2026-101636","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",7.4,"2026-10-21",0],["CVE-2026-101637","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101638","Oracle Corporation","Applications DBA","Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut","HIGH",7.3,"2026-10-21",0],["CVE-2026-101634","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-101635","Oracle Corporation","Oracle Mobile Field Service","Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo","HIGH",8.8,"2026-10-21",0],["CVE-2026-101631","Oracle Corporation","MySQL Router","Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Th","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101632","Oracle Corporation","MySQL Router","Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Th","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101633","Oracle Corporation","MySQL Router","Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Th","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101628","Oracle Corporation","MySQL Cluster","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operat","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101629","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101630","Oracle Corporation","Oracle Advanced Outbound Telephony","Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101626","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). ","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101627","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101623","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101624","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101625","Oracle Corporation","MySQL Connectors","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). ","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101620","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101621","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101622","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101618","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101619","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101615","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101616","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101617","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101612","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4,"2026-10-21",0],["CVE-2026-101613","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101614","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101610","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101611","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101607","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101608","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Serve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101609","Oracle Corporation","MySQL Server","Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoD","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101604","Oracle Corporation","Oracle Communications Unified Inventory Management","Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101605","Oracle Corporation","Oracle Utilities Network Management System","Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilitie","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101606","Oracle Corporation","Oracle Communications Billing and Revenue Management","Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracl","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101601","Oracle Corporation","Oracle GoldenGate","Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions t","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101602","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8,"2026-10-21",0],["CVE-2026-101603","Oracle Corporation","Oracle Communications Unified Inventory Management","Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101599","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","HIGH",7.5,"2026-10-21",0],["CVE-2026-101600","Oracle Corporation","Oracle TimesTen In-Memory Database","Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB). Supported ","LOW",3.6,"2026-10-21",0],["CVE-2026-101596","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.8,"2026-10-21",0],["CVE-2026-101597","Oracle Corporation","Oracle ZFS Storage Appliance Kit","Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101598","Oracle Corporation","Oracle VM VirtualBox","Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Cor","HIGH",7.8,"2026-10-21",0],["CVE-2026-101594","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.8,"2026-10-21",0],["CVE-2026-101595","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101591","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101592","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101593","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.3,"2026-10-21",0],["CVE-2026-101589","Oracle Corporation","Oracle Utilities Network Management System","Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilitie","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101590","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-micro","CRITICAL",9.1,"2026-10-21",0],["CVE-2026-101586","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101587","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101588","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). S","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101584","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101585","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors)","HIGH",7.2,"2026-10-21",0],["CVE-2026-101582","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integ","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-101583","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-commo","HIGH",7,"2026-10-21",0],["CVE-2026-101579","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-","HIGH",7.2,"2026-10-21",0],["CVE-2026-101580","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-101581","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101576","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Support","LOW",3.7,"2026-10-21",0],["CVE-2026-101577","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors)","LOW",3.1,"2026-10-21",0],["CVE-2026-101578","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101573","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur","MEDIUM",6.8,"2026-10-21",0],["CVE-2026-101574","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Suppor","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-101575","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Support","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101571","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur","MEDIUM",5.6,"2026-10-21",0],["CVE-2026-101572","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl","HIGH",7.5,"2026-10-21",0],["CVE-2026-101568","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-healt","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101569","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-commo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101570","Oracle Corporation","Helidon","Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webse","LOW",3.7,"2026-10-21",0],["CVE-2026-101565","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Import). ","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-101566","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","HIGH",7.8,"2026-10-21",0],["CVE-2026-101567","Oracle Corporation","Oracle Cost Management","Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component:","HIGH",8.8,"2026-10-21",0],["CVE-2026-101562","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect)","HIGH",7.5,"2026-10-21",0],["CVE-2026-101564","Oracle Corporation","Oracle Agile PLM","Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect)","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101558","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Appr","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101559","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: PO V","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101560","Oracle Corporation","Oracle Commerce Platform","Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynam","HIGH",7.1,"2026-10-21",0],["CVE-2026-101555","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-101556","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-101557","Oracle Corporation","Oracle Purchasing","Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Inte","HIGH",8.8,"2026-10-21",0],["CVE-2026-101553","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Element","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101554","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7.5,"2026-10-21",0],["CVE-2026-101549","Oracle Corporation","Oracle Application Testing Suite","Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported v","HIGH",7.8,"2026-10-21",0],["CVE-2026-101551","Oracle Corporation","Oracle Applications Manager","Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101552","Oracle Corporation","Oracle Application Object Library","Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101546","Oracle Corporation","Oracle Materials Requirement Planning","Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Su","HIGH",7.5,"2026-10-21",0],["CVE-2026-101547","Oracle Corporation","Oracle Demand Planning","Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Int","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101548","Oracle Corporation","Oracle Application Testing Suite","Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported v","HIGH",7,"2026-10-21",0],["CVE-2026-101544","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","HIGH",7,"2026-10-21",0],["CVE-2026-101545","Oracle Corporation","Oracle Inventory Management","Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (compo","HIGH",7,"2026-10-21",0],["CVE-2026-101541","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",7.7,"2026-10-21",0],["CVE-2026-101542","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",8.8,"2026-10-21",0],["CVE-2026-101543","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",7.5,"2026-10-21",0],["CVE-2026-101538","Oracle Corporation","Oracle Order Management","Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101539","Oracle Corporation","Oracle Payroll","Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Interna","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101540","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",7.7,"2026-10-21",0],["CVE-2026-101535","Oracle Corporation","Oracle Sales Foundation","Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component","HIGH",7.5,"2026-10-21",0],["CVE-2026-101536","Oracle Corporation","Oracle Cost Management","Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component:","HIGH",7.5,"2026-10-21",0],["CVE-2026-101537","Oracle Corporation","Oracle Solaris","Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The su","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101533","Oracle Corporation","Oracle EDI Gateway","Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-101534","Oracle Corporation","Oracle EDI Gateway","Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI","HIGH",8.5,"2026-10-21",0],["CVE-2026-101531","Oracle Corporation","Oracle Business Intelligence Enterprise Edition","Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana","HIGH",7.5,"2026-10-21",0],["CVE-2026-101532","Oracle Corporation","Oracle EDI Gateway","Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All","HIGH",7.2,"2026-10-21",0],["CVE-2026-101527","Oracle Corporation","Oracle Enterprise Manager Base Platform","Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise ","HIGH",7.8,"2026-10-21",0],["CVE-2026-101528","Oracle Corporation","Oracle Enterprise Manager for Oracle Database","Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enter","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-101529","Oracle Corporation","Oracle Enterprise Manager for Oracle Database","Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enter","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-101525","Oracle Corporation","Oracle Enterprise Manager for Siebel","Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Man","HIGH",8.8,"2026-10-21",0],["CVE-2026-101526","Oracle Corporation","Oracle Enterprise Manager for Siebel","Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Man","HIGH",8.8,"2026-10-21",0],["CVE-2026-101521","Oracle Corporation","Oracle APEX","Vulnerability in Oracle APEX (component: General). Supported versions that are affected ar","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101522","Oracle Corporation","Oracle TimesTen In-Memory Database","Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB). Supported ","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101524","Oracle Corporation","Oracle Enterprise Manager Base Platform","Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise ","MEDIUM",5.6,"2026-10-21",0],["CVE-2026-101518","Oracle Corporation","Oracle Enterprise Manager Base Platform","Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise ","HIGH",8.8,"2026-10-21",0],["CVE-2026-101519","Oracle Corporation","Oracle EDI Gateway","Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All","HIGH",7.2,"2026-10-21",0],["CVE-2026-101520","Oracle Corporation","Oracle Global Lifecycle Management NextGen OUI Framework","Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of O","HIGH",7.5,"2026-10-21",0],["CVE-2026-101516","Oracle Corporation","Oracle Java SE","Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101517","Oracle Corporation","Oracle Utilities Network Management System","Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilitie","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101512","Oracle Corporation","Oracle Database Server","Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that ar","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101513","Oracle Corporation","MySQL Cluster","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported ","LOW",3.8,"2026-10-21",0],["CVE-2026-101515","Oracle Corporation","Oracle WebLogic Server","Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101510","Oracle Corporation","Oracle Net Services","Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported ve","MEDIUM",4.4,"2026-10-21",0],["CVE-2026-101511","Oracle Corporation","Oracle Enterprise Manager Base Platform","Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise ","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101506","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supp","HIGH",7.7,"2026-10-21",0],["CVE-2026-101507","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported ve","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101508","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).","HIGH",7.5,"2026-10-21",0],["CVE-2026-101503","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported ve","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-101504","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supp","HIGH",7.6,"2026-10-21",0],["CVE-2026-101505","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supp","HIGH",8.7,"2026-10-21",0],["CVE-2026-101500","Oracle Corporation","Oracle Global Lifecycle Management OPatchAuto","Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Globa","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101501","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported ve","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-101502","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported ve","MEDIUM",5,"2026-10-21",0],["CVE-2026-101498","Oracle Corporation","Oracle Trusted Answer Search","Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported ve","HIGH",8.1,"2026-10-21",0],["CVE-2026-101499","Oracle Corporation","Oracle WebCenter Sites","Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101494","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","HIGH",7.7,"2026-10-21",0],["CVE-2026-101495","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebe","HIGH",8.8,"2026-10-21",0],["CVE-2026-101497","Oracle Corporation","Oracle Identity Manager","Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101491","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5,"2026-10-21",0],["CVE-2026-101492","Oracle Corporation","Siebel CRM Integration","Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open ","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-101493","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101488","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101489","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101490","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101486","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101487","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101483","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supporte","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101484","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions ","CRITICAL",9.8,"2026-10-21",0],["CVE-2026-101485","Oracle Corporation","Oracle Autonomous Health Framework","Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supp","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101480","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that ar","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101481","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supporte","HIGH",8.8,"2026-10-21",0],["CVE-2026-101482","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supporte","HIGH",7.8,"2026-10-21",0],["CVE-2026-101477","Oracle Corporation","Oracle Autonomous Health Framework","Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supp","HIGH",7.8,"2026-10-21",0],["CVE-2026-101478","Oracle Corporation","Oracle Autonomous Health Framework","Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supp","HIGH",7.8,"2026-10-21",0],["CVE-2026-101479","Oracle Corporation","Oracle Secure Backup","Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions ","HIGH",8.6,"2026-10-21",0],["CVE-2026-101475","Oracle Corporation","Primavera Unifier","Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (com","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101476","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101472","Oracle Corporation","Oracle Product Lifecycle Analytics","Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101473","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","HIGH",8.1,"2026-10-21",0],["CVE-2026-101474","Oracle Corporation","Oracle Agile Product Lifecycle Management for Process","Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101469","Oracle Corporation","Oracle Product Lifecycle Analytics","Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co","HIGH",7.5,"2026-10-21",0],["CVE-2026-101470","Oracle Corporation","Oracle Product Lifecycle Analytics","Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co","MEDIUM",6,"2026-10-21",0],["CVE-2026-101471","Oracle Corporation","Oracle Product Lifecycle Analytics","Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101467","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal F","HIGH",7.4,"2026-10-21",0],["CVE-2026-101468","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud ","HIGH",7.5,"2026-10-21",0],["CVE-2026-101464","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.1,"2026-10-21",0],["CVE-2026-101465","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-101466","Oracle Corporation","Oracle EDI Gateway","Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All","HIGH",7.2,"2026-10-21",0],["CVE-2026-101461","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.5,"2026-10-21",0],["CVE-2026-101462","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101463","Oracle Corporation","Siebel CRM End User","Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open","HIGH",7.5,"2026-10-21",0],["CVE-2026-101459","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",8.3,"2026-10-21",0],["CVE-2026-101460","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",7.5,"2026-10-21",0],["CVE-2026-101456","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Confi","MEDIUM",6,"2026-10-21",0],["CVE-2026-101457","Oracle Corporation","Siebel Apps - Life Sciences","Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: ","HIGH",8.8,"2026-10-21",0],["CVE-2026-101458","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","HIGH",8.2,"2026-10-21",0],["CVE-2026-101454","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Confi","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101455","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integ","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-101451","Oracle Corporation","Siebel Life Sciences","Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI)","HIGH",8.7,"2026-10-21",0],["CVE-2026-101452","Oracle Corporation","Oracle Autonomous Health Framework","Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Rep","HIGH",7.8,"2026-10-21",0],["CVE-2026-101453","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server","MEDIUM",6.7,"2026-10-21",0],["CVE-2026-101448","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101449","Oracle Corporation","Siebel CRM Deployment","Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel","LOW",2.4,"2026-10-21",0],["CVE-2026-101450","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.1,"2026-10-21",0],["CVE-2026-101445","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","LOW",3.6,"2026-10-21",0],["CVE-2026-101446","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","CRITICAL",9.9,"2026-10-21",0],["CVE-2026-101447","Oracle Corporation","Siebel CRM Development","Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workf","HIGH",7.1,"2026-10-21",0],["CVE-2026-101442","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","LOW",3.1,"2026-10-21",0],["CVE-2026-101443","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101444","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101439","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101440","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101441","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101436","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",4.1,"2026-10-21",0],["CVE-2026-101437","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-101438","Oracle Corporation","Siebel CRM Cloud Applications","Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component","HIGH",8,"2026-10-21",0],["CVE-2026-101434","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.6,"2026-10-21",0],["CVE-2026-101435","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.6,"2026-10-21",0],["CVE-2026-101431","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",8.7,"2026-10-21",0],["CVE-2026-101432","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101433","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101428","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101429","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7,"2026-10-21",0],["CVE-2026-101430","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.2,"2026-10-21",0],["CVE-2026-101425","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",2.5,"2026-10-21",0],["CVE-2026-101426","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-101427","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",8.1,"2026-10-21",0],["CVE-2026-101422","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",8.1,"2026-10-21",0],["CVE-2026-101423","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101424","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-101419","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101420","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-101421","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101417","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.7,"2026-10-21",0],["CVE-2026-101418","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-101414","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",2.9,"2026-10-21",0],["CVE-2026-101415","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","LOW",3.1,"2026-10-21",0],["CVE-2026-101416","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101411","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",8.1,"2026-10-21",0],["CVE-2026-101412","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.8,"2026-10-21",0],["CVE-2026-101413","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101409","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101410","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.5,"2026-10-21",0],["CVE-2026-101407","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101408","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Emai","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101404","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","LOW",3.9,"2026-10-21",0],["CVE-2026-101405","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",4.8,"2026-10-21",0],["CVE-2026-101406","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","LOW",3.7,"2026-10-21",0],["CVE-2026-101401","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","LOW",2.9,"2026-10-21",0],["CVE-2026-101402","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Emai","LOW",3.7,"2026-10-21",0],["CVE-2026-101403","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Emai","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101398","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",7.6,"2026-10-21",0],["CVE-2026-101399","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101400","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","LOW",2.9,"2026-10-21",0],["CVE-2026-101395","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101396","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-101397","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","LOW",2.2,"2026-10-21",0],["CVE-2026-101392","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",5.5,"2026-10-21",0],["CVE-2026-101393","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101394","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101389","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101390","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",8.1,"2026-10-21",0],["CVE-2026-101391","Oracle Corporation","Siebel Apps - Marketing","Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101386","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-101387","Oracle Corporation","Oracle Capacity","Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern","HIGH",7.6,"2026-10-21",0],["CVE-2026-101388","Oracle Corporation","PeopleSoft Enterprise PeopleTools","Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo","HIGH",7.1,"2026-10-21",0],["CVE-2026-101384","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",5,"2026-10-21",0],["CVE-2026-101385","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",4.9,"2026-10-21",0],["CVE-2026-101381","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101382","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-101383","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101378","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101379","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101380","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101375","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versio","MEDIUM",6.3,"2026-10-21",0],["CVE-2026-101376","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versio","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-101377","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versio","LOW",2.7,"2026-10-21",0],["CVE-2026-101372","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","LOW",3.7,"2026-10-21",0],["CVE-2026-101373","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","LOW",2.4,"2026-10-21",0],["CVE-2026-101374","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported ve","MEDIUM",5.9,"2026-10-21",0],["CVE-2026-101370","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","LOW",3.1,"2026-10-21",0],["CVE-2026-101371","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","LOW",3.1,"2026-10-21",0],["CVE-2026-101367","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101368","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported ve","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101369","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported ve","MEDIUM",6.1,"2026-10-21",0],["CVE-2026-101364","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versio","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101365","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versio","MEDIUM",4.7,"2026-10-21",0],["CVE-2026-101366","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are a","MEDIUM",4.3,"2026-10-21",0],["CVE-2026-101361","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",4.2,"2026-10-21",0],["CVE-2026-101362","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",6.9,"2026-10-21",0],["CVE-2026-101363","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-101360","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",5.4,"2026-10-21",0],["CVE-2026-101359","Oracle Corporation","Oracle REST Data Services","Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are ","MEDIUM",5.3,"2026-10-21",0],["CVE-2026-113729","moov-io","signedxml","Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","HIGH",7.5,"2026-10-21",0],["CVE-2026-113728","bulwarkmail","webmail","Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint","HIGH",7.5,"2026-10-21",0],["CVE-2026-113727","openchoreo","openchoreo","OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of wo","HIGH",7.4,"2026-10-21",0],["CVE-2026-113812","","Mozilla-CA","Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a","","","2026-10-21",0],["CVE-2026-113274","Google","Chrome","Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113013","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113039","Google","Chrome","Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113083","Google","Chrome","Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113088","Google","Chrome","Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113125","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-112996","Google","Chrome","Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113122","Google","Chrome","Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attac","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113227","Google","Chrome","Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113286","Google","Chrome","Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113294","Google","Chrome","Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113046","Google","Chrome","Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a r","HIGH",8.8,"2026-10-21",0],["CVE-2026-113067","Google","Chrome","Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113074","Google","Chrome","Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113130","Google","Chrome","Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113182","Google","Chrome","Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote at","HIGH",8.8,"2026-10-21",0],["CVE-2026-112994","Google","Chrome","Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113063","Google","Chrome","Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113237","Google","Chrome","Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113314","Google","Chrome","Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113331","Google","Chrome","Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113121","Google","Chrome","Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 all","HIGH",8.8,"2026-10-21",0],["CVE-2026-113132","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113169","Google","Chrome","Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113254","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113287","Google","Chrome","Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113066","Google","Chrome","Memory corruption in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attack","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113085","Google","Chrome","Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113107","Google","Chrome","Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113248","Google","Chrome","Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113288","Google","Chrome","Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113036","Google","Chrome","Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113038","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113061","Google","Chrome","Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113268","Google","Chrome","Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113313","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113047","Google","Chrome","Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113116","Google","Chrome","Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attack","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113173","Google","Chrome","Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113260","Google","Chrome","Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113269","Google","Chrome","Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-112998","Google","Chrome","Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113021","Google","Chrome","Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113145","Google","Chrome","Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowe","HIGH",8.8,"2026-10-21",0],["CVE-2026-113156","Google","Chrome","Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113292","Google","Chrome","Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47","HIGH",8.8,"2026-10-21",0],["CVE-2026-113017","Google","Chrome","Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113140","Google","Chrome","Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113180","Google","Chrome","Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113184","Google","Chrome","Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113186","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113024","Google","Chrome","Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113025","Google","Chrome","Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113080","Google","Chrome","Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113245","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113299","Google","Chrome","Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113029","Google","Chrome","Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113152","Google","Chrome","Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113226","Google","Chrome","Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113296","Google","Chrome","Memory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attack","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113306","Google","Chrome","Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a rem","HIGH",8.8,"2026-10-21",0],["CVE-2026-113023","Google","Chrome","Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113048","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113247","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113330","Google","Chrome","Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113167","Google","Chrome","Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113213","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113223","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113241","Google","Chrome","Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113244","Google","Chrome","Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113291","Google","Chrome","Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113004","Google","Chrome","Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113027","Google","Chrome","Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113201","Google","Chrome","Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113214","Google","Chrome","Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113300","Google","Chrome","Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote atta","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113056","Google","Chrome","Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a rem","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113103","Google","Chrome","Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113168","Google","Chrome","Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113229","Google","Chrome","Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113256","Google","Chrome","Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113015","Google","Chrome","Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113091","Google","Chrome","Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 al","HIGH",8.8,"2026-10-21",0],["CVE-2026-113114","Google","Chrome","Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113312","Google","Chrome","Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113323","Google","Chrome","Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113052","Google","Chrome","Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113053","Google","Chrome","Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113086","Google","Chrome","Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113133","Google","Chrome","Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113215","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113251","Google","Chrome","Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113089","Google","Chrome","Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113143","Google","Chrome","Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attack","","","2026-10-21",0],["CVE-2026-113157","Google","Chrome","Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113235","Google","Chrome","Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a r","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113340","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113008","Google","Chrome","Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113050","Google","Chrome","Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113096","Google","Chrome","Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113111","Google","Chrome","Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113200","Google","Chrome","Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113062","Google","Chrome","Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113170","Google","Chrome","Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113203","Google","Chrome","Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113258","Google","Chrome","Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113297","Google","Chrome","Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113002","Google","Chrome","Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113065","Google","Chrome","Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113197","Google","Chrome","Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113199","Google","Chrome","Out of bounds read in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote at","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113233","Google","Chrome","Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113100","Google","Chrome","Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113159","Google","Chrome","Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113221","Google","Chrome","Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113342","Google","Chrome","Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote atta","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113344","Google","Chrome","Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-112997","Google","Chrome","Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113030","Google","Chrome","Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote att","","","2026-10-21",0],["CVE-2026-113037","Google","Chrome","Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113138","Google","Chrome","Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remo","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113153","Google","Chrome","Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113028","Google","Chrome","Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113120","Google","Chrome","Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113151","Google","Chrome","Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attac","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113177","Google","Chrome","Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113304","Google","Chrome","Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a r","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113087","Google","Chrome","Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113099","Google","Chrome","Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47","HIGH",8.8,"2026-10-21",0],["CVE-2026-113216","Google","Chrome","Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113267","Google","Chrome","Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113270","Google","Chrome","Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attac","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113007","Google","Chrome","Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113075","Google","Chrome","Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113110","Google","Chrome","Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote at","HIGH",8.8,"2026-10-21",0],["CVE-2026-113187","Google","Chrome","Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113228","Google","Chrome","Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113259","Google","Chrome","Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113077","Google","Chrome","Memory corruption in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113158","Google","Chrome","Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113165","Google","Chrome","Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113178","Google","Chrome","Memory corruption in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a rem","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113282","Google","Chrome","Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote","HIGH",8.8,"2026-10-21",0],["CVE-2026-113090","Google","Chrome","Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113124","Google","Chrome","Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote","HIGH",8.8,"2026-10-21",0],["CVE-2026-113230","Google","Chrome","Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a rem","HIGH",8.8,"2026-10-21",0],["CVE-2026-113243","Google","Chrome","Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113326","Google","Chrome","Memory corruption in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113001","Google","Chrome","Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113064","Google","Chrome","Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a r","HIGH",8.8,"2026-10-21",0],["CVE-2026-113106","Google","Chrome","Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113136","Google","Chrome","Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113277","Google","Chrome","Out of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 all","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113032","Google","Chrome","Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113054","Google","Chrome","Out of bounds read in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remo","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113123","Google","Chrome","Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113144","Google","Chrome","Memory corruption in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attac","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113204","Google","Chrome","Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.","HIGH",8.8,"2026-10-21",0],["CVE-2026-113031","Google","Chrome","Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113049","Google","Chrome","Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113081","Google","Chrome","Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113126","Google","Chrome","Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a rem","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113128","Google","Chrome","Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remot","","","2026-10-21",0],["CVE-2026-113139","Google","Chrome","Memory corruption in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote att","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113016","Google","Chrome","Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113041","Google","Chrome","Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113202","Google","Chrome","Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113246","Google","Chrome","Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113010","Google","Chrome","Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113043","Google","Chrome","Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113073","Google","Chrome","Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113265","Google","Chrome","Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113329","Google","Chrome","Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113076","Google","Chrome","Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113084","Google","Chrome","Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113148","Google","Chrome","Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113224","Google","Chrome","Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113308","Google","Chrome","Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t","HIGH",8.8,"2026-10-21",0],["CVE-2026-113325","Google","Chrome","Memory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a re","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113195","Google","Chrome","Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a r","HIGH",8.8,"2026-10-21",0],["CVE-2026-113218","Google","Chrome","Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote at","HIGH",8.8,"2026-10-21",0],["CVE-2026-113255","Google","Chrome","Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113328","Google","Chrome","Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a rem","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113335","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113042","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113171","Google","Chrome","Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113185","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113206","Google","Chrome","Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113276","Google","Chrome","Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allow","HIGH",8.8,"2026-10-21",0],["CVE-2026-113149","Google","Chrome","Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113172","Google","Chrome","Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113261","Google","Chrome","Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113262","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113332","Google","Chrome","Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-112992","Google","Chrome","Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attac","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-112995","Google","Chrome","Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113071","Google","Chrome","Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113190","Google","Chrome","Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113278","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113009","Google","Chrome","Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113045","Google","Chrome","Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowe","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113060","Google","Chrome","Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a r","HIGH",8.8,"2026-10-21",0],["CVE-2026-113115","Google","Chrome","Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113307","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113137","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113189","Google","Chrome","Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113194","Google","Chrome","Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113208","Google","Chrome","Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113238","Google","Chrome","Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113059","Google","Chrome","Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113112","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113272","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113321","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-112999","Google","Chrome","Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113118","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113162","Google","Chrome","Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113232","Google","Chrome","Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113249","Google","Chrome","Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113327","Google","Chrome","Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113146","Google","Chrome","Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a rem","HIGH",8.8,"2026-10-21",0],["CVE-2026-113183","Google","Chrome","Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113205","Google","Chrome","Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113207","Google","Chrome","Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113289","Google","Chrome","Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allow","HIGH",8.8,"2026-10-21",0],["CVE-2026-113003","Google","Chrome","Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113051","Google","Chrome","Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113155","Google","Chrome","Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t","HIGH",8.8,"2026-10-21",0],["CVE-2026-113196","Google","Chrome","Improper access control in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowe","","","2026-10-21",0],["CVE-2026-113290","Google","Chrome","Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113005","Google","Chrome","Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote at","HIGH",8.8,"2026-10-21",0],["CVE-2026-113057","Google","Chrome","Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed","","","2026-10-21",0],["CVE-2026-113166","Google","Chrome","Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113209","Google","Chrome","Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113219","Google","Chrome","Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113014","Google","Chrome","Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113108","Google","Chrome","Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113283","Google","Chrome","Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113319","Google","Chrome","Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113343","Google","Chrome","Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113105","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113129","Google","Chrome","Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a re","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113220","Google","Chrome","Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113264","Google","Chrome","Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a ","","","2026-10-21",0],["CVE-2026-113275","Google","Chrome","Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113127","Google","Chrome","Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113131","Google","Chrome","Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote at","HIGH",8.8,"2026-10-21",0],["CVE-2026-113147","Google","Chrome","Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113239","Google","Chrome","Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113333","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113337","Google","Chrome","Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113026","Google","Chrome","Memory corruption in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a r","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113033","Google","Chrome","Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113078","Google","Chrome","Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113164","Google","Chrome","Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113302","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113070","Google","Chrome","Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remot","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113150","Google","Chrome","Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote att","HIGH",8.8,"2026-10-21",0],["CVE-2026-113176","Google","Chrome","Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113257","Google","Chrome","Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113311","Google","Chrome","Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113011","Google","Chrome","Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47","HIGH",8.8,"2026-10-21",0],["CVE-2026-113035","Google","Chrome","Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113198","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113211","Google","Chrome","Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remot","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113281","Google","Chrome","Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113034","Google","Chrome","Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113094","Google","Chrome","Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113102","Google","Chrome","Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113142","Google","Chrome","Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113240","Google","Chrome","Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113006","Google","Chrome","Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113018","Google","Chrome","Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113069","Google","Chrome","Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113263","Google","Chrome","Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a rem","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113301","Google","Chrome","Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113022","Google","Chrome","Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113079","Google","Chrome","Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113109","Google","Chrome","Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113113","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113191","Google","Chrome","Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113250","Google","Chrome","Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113055","Google","Chrome","Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed","HIGH",8.8,"2026-10-21",0],["CVE-2026-113068","Google","Chrome","Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113174","Google","Chrome","Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113231","Google","Chrome","Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113320","Google","Chrome","Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed ","HIGH",8.8,"2026-10-21",0],["CVE-2026-112993","Google","Chrome","Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113000","Google","Chrome","Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113160","Google","Chrome","Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113179","Google","Chrome","Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113212","Google","Chrome","Memory corruption in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","","","2026-10-21",0],["CVE-2026-113019","Google","Chrome","Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113095","Google","Chrome","Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113154","Google","Chrome","Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113181","Google","Chrome","Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113336","Google","Chrome","Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113040","Google","Chrome","Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113161","Google","Chrome","Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113217","Google","Chrome","Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 all","HIGH",8.8,"2026-10-21",0],["CVE-2026-113295","Google","Chrome","Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113309","Google","Chrome","Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attac","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113012","Google","Chrome","Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113093","Google","Chrome","Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remo","HIGH",8.8,"2026-10-21",0],["CVE-2026-113175","Google","Chrome","Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113192","Google","Chrome","Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113338","Google","Chrome","Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113020","Google","Chrome","Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113222","Google","Chrome","Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to ","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113310","Google","Chrome","Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113318","Google","Chrome","Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113334","Google","Chrome","Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113210","Google","Chrome","Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113225","Google","Chrome","Memory corruption in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113285","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113293","Google","Chrome","Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113324","Google","Chrome","Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113044","Google","Chrome","Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113135","Google","Chrome","Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113252","Google","Chrome","Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 a","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113266","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113273","Google","Chrome","Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113305","Google","Chrome","Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","HIGH",8.8,"2026-10-21",0],["CVE-2026-113141","Google","Chrome","Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113234","Google","Chrome","Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113236","Google","Chrome","Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a r","HIGH",8.8,"2026-10-21",0],["CVE-2026-113284","Google","Chrome","Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113316","Google","Chrome","Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113163","Google","Chrome","Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a re","HIGH",8.8,"2026-10-21",0],["CVE-2026-113253","Google","Chrome","Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113298","Google","Chrome","Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113315","Google","Chrome","Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113322","Google","Chrome","Memory corruption in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacke","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113104","Google","Chrome","Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113117","Google","Chrome","Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allow","HIGH",8.8,"2026-10-21",0],["CVE-2026-113188","Google","Chrome","Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","HIGH",8.8,"2026-10-21",0],["CVE-2026-113193","Google","Chrome","Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113317","Google","Chrome","Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allow","HIGH",8.8,"2026-10-21",0],["CVE-2026-113082","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113092","Google","Chrome","Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113119","Google","Chrome","Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113134","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113339","Google","Chrome","Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to","HIGH",8.8,"2026-10-21",0],["CVE-2026-113058","Google","Chrome","Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker ","HIGH",8.8,"2026-10-21",0],["CVE-2026-113097","Google","Chrome","Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote atta","HIGH",8.8,"2026-10-21",0],["CVE-2026-113098","Google","Chrome","Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-113101","Google","Chrome","Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113242","Google","Chrome","Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113072","Google","Chrome","Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker","CRITICAL",9.6,"2026-10-21",0],["CVE-2026-113271","Google","Chrome","Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote a","HIGH",8.8,"2026-10-21",0],["CVE-2026-113280","Google","Chrome","Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attack","HIGH",8.8,"2026-10-21",0],["CVE-2026-113303","Google","Chrome","Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attac","HIGH",8.8,"2026-10-21",0],["CVE-2026-113279","Google","Chrome","Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remot","HIGH",8.8,"2026-10-21",0],["CVE-2026-113341","Google","Chrome","Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a ","MEDIUM",6.5,"2026-10-21",0],["CVE-2026-112712","@fastify/middie","@fastify/middie","@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-112407","AWS","CICD-toolchain-for-serverless-applications","Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications","HIGH",8.7,"2026-10-20",0],["CVE-2016-20104","EyeLock","nano NXT","EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php","HIGH",8.7,"2026-10-20",0],["CVE-2016-20102","JavaMelody","JavaMelody","JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter","MEDIUM",5.1,"2026-10-20",0],["CVE-2016-20103","Cherry Team","Cherry Plugin","Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php","HIGH",8.7,"2026-10-20",0],["CVE-2016-20101","Pedro Marcelo","Issuu Panel","Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php","CRITICAL",9.2,"2026-10-20",0],["CVE-2015-20128","FooSun","DotNetCMS","FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx","HIGH",8.8,"2026-10-20",0],["CVE-2016-20100","Ian Howatson","Memphis Documents Library","Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview","HIGH",8.7,"2026-10-20",0],["CVE-2015-20125","Aspose","Aspose PDF Exporter","Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download","HIGH",8.7,"2026-10-20",0],["CVE-2015-20123","Aspose","Aspose Doc Exporter","Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download","HIGH",8.7,"2026-10-20",0],["CVE-2015-20124","Aspose","Aspose Importer & Exporter","Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_","HIGH",8.7,"2026-10-20",0],["CVE-2014-125134","ChurcHope","ChurcHope","ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php","HIGH",8.7,"2026-10-20",0],["CVE-2014-125132","Jason Newman","Blogroll Fun","Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php","MEDIUM",5.1,"2026-10-20",0],["CVE-2014-125133","imithemes","NativeChurch","NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php","HIGH",8.7,"2026-10-20",0],["CVE-2014-125131","DedeCMS","DedeCMS","DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php","MEDIUM",5.1,"2026-10-20",0],["CVE-2012-20005","Łukasz Więcek","SocialFit","SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter","MEDIUM",5.1,"2026-10-20",0],["CVE-2012-20003","Web Updates KMU","Custom Tables","Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php","MEDIUM",5.1,"2026-10-20",0],["CVE-2012-20004","Carles Reverter","K-news","K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter","MEDIUM",5.1,"2026-10-20",0],["CVE-2012-20002","James Charlesworth","TinyMCE Thumbnail Gallery","TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php","HIGH",8.7,"2026-10-20",0],["CVE-2026-107929","curl","curl","local interface connection reuse mixup","","","2026-10-20",0],["CVE-2026-111758","markdown-it","markdown-it","markdown-it: Quadratic-time rendering of a single multi-line link reference definition wit","HIGH",7.5,"2026-10-20",0],["CVE-2026-107928","curl","curl","info leak uploading over WebSockets with GnuTLS","","","2026-10-20",0],["CVE-2026-105960","HMS Networks","PEAK-System Device Driver Setup","HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Incons","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-94266","curl","curl","password leak in CURLINFO_EFFECTIVE_URL","","","2026-10-20",0],["CVE-2026-110322","HMS Networks","PEAK-System Device Driver Setup","HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-94265","curl","curl","Authorization: Negotiate sent to foreign origin","","","2026-10-20",0],["CVE-2026-35499","totolink","Totolink","An os command injection vulnerability exists in the boa formWsc peerRptPin functionality o","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-28763","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname fu","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-40627","totolink","Totolink","An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-41223","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr func","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-33568","totolink","Totolink","A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionali","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-40615","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-41222","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formParentControl url functi","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42019","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe ","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42020","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe ","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42021","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42022","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42023","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42024","totolink","Totolink","Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42025","totolink","Totolink","Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-42026","totolink","Totolink","Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9659","totolink","Totolink","Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9660","totolink","Totolink","Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9814","totolink","Totolink","An OS command injection vulnerability exists in the boa formWizard newPass functionality o","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9817","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9827","totolink","Totolink","A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X20","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-9869","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionalit","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10131","totolink","Totolink","An OS command injection vulnerability exists in the boa formPasswordSetup functionality of","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10132","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality ","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10133","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10135","totolink","Totolink","A OS command injection vulnerability exists in the batchupg functionality of X2000R (versi","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10136","totolink","Totolink","A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10137","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality o","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10138","totolink","Totolink","A OS command injection vulnerability exists in the boa formUpload() functionality of X2000","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10139","totolink","Totolink","A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (ve","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-10141","totolink","Totolink","A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-92391","curl","curl","curl_mime_free stack overflow by recursion","","","2026-10-20",0],["CVE-2026-103672","HMS Networks","PEAK-System Device Driver Setup","HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-92390","curl","curl","-J no-clobber guarantee bypassed with 103 early hints","","","2026-10-20",0],["CVE-2026-92389","curl","curl","TFTP direction confusion","","","2026-10-20",0],["CVE-2026-92388","curl","curl","FTP wildcard write callback mixup","","","2026-10-20",0],["CVE-2026-92387","curl","curl","never-ending loop via server response omission","","","2026-10-20",0],["CVE-2026-101103","HMS Networks","PEAK-System Device Driver Setup","HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-92386","curl","curl","server-set cookie aborts cookie jar load","","","2026-10-20",0],["CVE-2026-87866","curl","curl","wolfSSL public-key pinning bypass","","","2026-10-20",0],["CVE-2026-109576","HMS Networks","PEAK-System Device Driver Setup","HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-87865","curl","curl","knownhost callback mismatches key as missing","","","2026-10-20",0],["CVE-2026-87863","curl","curl","HSTS response erases persisted entries","","","2026-10-20",0],["CVE-2026-87864","curl","curl","IMAP APPEND plus CRLF conversion command injection","","","2026-10-20",0],["CVE-2026-87862","curl","curl","HSTS cache import drops longer-lived child","","","2026-10-20",0],["CVE-2026-87861","curl","curl","cross-origin reuse of a Negotiate connection","","","2026-10-20",0],["CVE-2026-86415","curl","curl","auto client cert connection reuse mixup","","","2026-10-20",0],["CVE-2026-86414","curl","curl","leaking host credentials to HTTP proxy","","","2026-10-20",0],["CVE-2026-86413","curl","curl","Negotiate credentials sent to redirected origin","","","2026-10-20",0],["CVE-2026-112380","Amazon","Kiro Crew","Missing authorization in the WhatsApp channel in Kiro Crew","CRITICAL",9,"2026-10-20",0],["CVE-2026-86412","curl","curl","server-set cookie erases cookie jar","","","2026-10-20",0],["CVE-2026-86411","curl","curl","FTP connection reuse inherits client-certificate","","","2026-10-20",0],["CVE-2026-86410","curl","curl","redirect to SFTP or SCP bypasses host verification","","","2026-10-20",0],["CVE-2026-86409","curl","curl","stale SigV4 headers sent unintended","","","2026-10-20",0],["CVE-2026-113725","pypa","virtualenv","virtualenv bash activate runs commands from an environment name with a backslash before $","HIGH",7.8,"2026-10-20",0],["CVE-2026-113724","pypa","virtualenv","virtualenv: Deletion recovery can change a symlink target's mode","MEDIUM",4.5,"2026-10-20",0],["CVE-2026-113723","pypa","virtualenv","virtualenv: Bash prompt values can change meaning under older compatibility modes","HIGH",7.1,"2026-10-20",0],["CVE-2026-107692","Gaijin Entertainment","War Thunder","War Thunder Account Impersonation","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113722","pypa","virtualenv","virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","HIGH",7.8,"2026-10-20",0],["CVE-2026-113721","pypa","virtualenv","virtualenv: Generated files can follow existing destination links","MEDIUM",4.5,"2026-10-20",0],["CVE-2026-113720","pypa","virtualenv","virtualenv: Seeded files retain permissions from an older cache","MEDIUM",4.4,"2026-10-20",0],["CVE-2026-113715","pypa","virtualenv","virtualenv: Venv configuration readback can reinterpret path boundaries","LOW",2,"2026-10-20",0],["CVE-2026-113719","pypa","virtualenv","virtualenv: Seed replacement does not contain metadata deletion paths","MEDIUM",4.5,"2026-10-20",0],["CVE-2026-113718","pypa","virtualenv","virtualenv: Xonsh activation literals depend on the script decoding codec","HIGH",7.1,"2026-10-20",0],["CVE-2026-113717","pypa","virtualenv","virtualenv: Pip seeding with download omits wheel digest verification","LOW",2.3,"2026-10-20",0],["CVE-2026-113716","pypa","virtualenv","virtualenv: Builtin creation follows linked environment directories","MEDIUM",4.5,"2026-10-20",0],["CVE-2026-113867","Mozilla","Thunderbird","Stanza injection in XMPP chat","","","2026-10-20",0],["CVE-2026-113868","Mozilla","Thunderbird","Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authenticatio","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113869","Mozilla","Thunderbird","Use-after-free in S/MIME decryption during a security device password prompt","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-113866","Mozilla","Thunderbird","Account password sent unencrypted during Exchange account setup","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-113712","cachethq","cachet","Cachet has Stored XSS in Incident Component","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113714","pypa","virtualenv","virtualenv: Downloaded wheel selection and caching precede verification","LOW",2.3,"2026-10-20",0],["CVE-2026-113713","pypa","virtualenv","virtualenv: Temporary app-data can leave dangling seed package links","MEDIUM",4.4,"2026-10-20",0],["CVE-2026-111088","Stormshield","Stormshield Network Security","Stored XSS in the VPN logs monitor","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-113810","Stormshield","Stormshield Network Security","Stored XSS on SNS Enrollment Portal","HIGH",7,"2026-10-20",0],["CVE-2026-111767","modelcontextprotocol","typescript-sdk","MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","HIGH",8.6,"2026-10-20",0],["CVE-2026-100134","Adobe","Acrobat for Edge","Acrobat for Edge | Out-of-bounds Write (CWE-787)","HIGH",8.8,"2026-10-20",0],["CVE-2026-100132","Adobe","Acrobat for Edge","Acrobat for Edge | Out-of-bounds Read (CWE-125)","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-113808","Stormshield","Stormshield Network Security","Stored XSS on SNS Enrollment Portal","HIGH",7.1,"2026-10-20",0],["CVE-2026-113643","","EspoCRM","EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-97406","Xerj","Console API","Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting","","","2026-10-20",0],["CVE-2026-113709","argoproj","argo-cd","Argo CD: A Kustomize Helm config home can run commands in the repo-server","CRITICAL",9.9,"2026-10-20",0],["CVE-2026-113708","argoproj","argo-cd","Argo CD: A Kustomize remote ref can run commands in the repo-server","CRITICAL",9.9,"2026-10-20",0],["CVE-2026-113672","argoproj","argo-cd","Argo CD: A Jsonnet import can read files from the repo-server","CRITICAL",9.9,"2026-10-20",0],["CVE-2026-113802","Wavlink","WL-WN530BE1-A","Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file ","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-111756","follow-redirects","follow-redirects","follow-redirects array-form headers bypass cross-origin credential stripping","HIGH",8.2,"2026-10-20",0],["CVE-2026-105772","Google","ADK TypeScript (@google/adk)","Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService v","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-113711","apostrophecms","apostrophe","ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing i","HIGH",7.5,"2026-10-20",0],["CVE-2026-112861","xnau webdesign","Participants Database","WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDO","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-113710","apostrophecms","apostrophe","ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unl","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-113671","apostrophecms","apostrophe","ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-he","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-113669","apostrophecms","apostrophe","ApostropheCMS: Cross-domain session token in URL confers session takeover","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113667","apostrophecms","apostrophe","ApostropheCMS: CAPTCHA response token not URL-encoded","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113668","apostrophecms","apostrophe","ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113507","","aaPanel","aaPanel common.py GetClientIp access control","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113666","apostrophecms","apostrophe","ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophe","HIGH",7.1,"2026-10-20",0],["CVE-2026-113665","apostrophecms","apostrophe","ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints","LOW",3.7,"2026-10-20",0],["CVE-2026-113506","","aaPanel","aaPanel File Manager common.py ExecShell os command injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-113664","apostrophecms","apostrophe","ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substrin","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113662","apostrophecms","apostrophe","ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import ma","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-113661","apostrophecms","apostrophe","ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships ","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-113660","apostrophecms","apostrophe","ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals ","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-113659","apostrophecms","apostrophe","ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-base","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-113658","apostrophecms","apostrophe","ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system te","HIGH",7.5,"2026-10-20",0],["CVE-2026-92539","Grafana","Grafana Enterprise","Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise","MEDIUM",6.7,"2026-10-20",0],["CVE-2026-113657","apostrophecms","apostrophe","ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI","LOW",3.7,"2026-10-20",0],["CVE-2026-113656","apostrophecms","apostrophe","ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113649","apostrophecms","apostrophe","ApostropheCMS: Import API bypasses publication roles for protected content","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-113655","apostrophecms","apostrophe","ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricte","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-113654","apostrophecms","apostrophe","ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, le","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113653","apostrophecms","apostrophe","ApostropheCMS: The general public can access @apostrophecms/user objects via a relationshi","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113652","apostrophecms","apostrophe","ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attac","MEDIUM",5.6,"2026-10-20",0],["CVE-2026-28330","SolarWinds","SolarWinds Observability Self-Hosted","SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability","MEDIUM",4.6,"2026-10-20",0],["CVE-2026-28329","SolarWinds","SolarWinds Observability Self-Hosted","SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)","MEDIUM",6.4,"2026-10-20",0],["CVE-2026-113651","apostrophecms","apostrophe","ApostropheCMS: Path traversal in uploadfs","LOW",3.3,"2026-10-20",0],["CVE-2026-113650","apostrophecms","apostrophe","ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a disc","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-28328","SolarWinds","SolarWinds Observability Self-Hosted","SolarWinds Observability Self-Hosted broken authorization schema","HIGH",8.8,"2026-10-20",0],["CVE-2026-113505","","aaPanel","aaPanel Download Endpoint v2.py send_file path traversal","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-28331","SolarWinds","Patch Manager","SolarWinds Patch Manager Sensitive Information Exposure Vulnerability","MEDIUM",4.4,"2026-10-20",0],["CVE-2026-113648","apostrophecms","apostrophe","ApostropheCMS: Missing Authentication in `cleanExport` Route","LOW",3.1,"2026-10-20",0],["CVE-2026-112958","apostrophecms","apostrophe","ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-112957","apostrophecms","apostrophe","ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and expos","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-112956","apostrophecms","apostrophe","ApostropheCMS: Archive duplicate continuation lets contributors overwrite published conten","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-113703","giuseppe99barchetta","SuggestArr","SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-112955","apostrophecms","apostrophe","ApostropheCMS: Import archives can exhaust server storage and deny service","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-112954","apostrophecms","apostrophe","ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builde","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112953","apostrophecms","apostrophe","ApostropheCMS: Exposure of Sensitive Information via predictable export filenames","MEDIUM",6,"2026-10-20",0],["CVE-2026-112952","apostrophecms","apostrophe","ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/ad","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-107755","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication End","MEDIUM",6,"2026-10-20",0],["CVE-2026-90800","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Auth bypass in prefixed _users and _replicator databases","HIGH",8.1,"2026-10-20",0],["CVE-2026-113683","jcrodriguez-dis","moodle-mod_vpl","VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-113682","networknt","light-4j","Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-113680","harfbuzz","harfbuzz","HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-113681","AcademySoftwareFoundation","OpenImageIO","OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon ","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-113679","harfbuzz","harfbuzz","HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string","HIGH",7.3,"2026-10-20",0],["CVE-2026-113678","froxlor","froxlor","Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-113676","froxlor","froxlor","Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113677","froxlor","froxlor","Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113613","FlexGet","FlexGet","FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-113611","outline","outline","Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113612","CodeWithCJ","SparkyFitness","SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113610","vatesfr","xen-orchestra","Xen Orchestra before 6.9.0 Authorization Bypass via user.set API","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113608","jleyva","moodle-block_configurablereports","Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var","MEDIUM",6,"2026-10-20",0],["CVE-2026-113609","Bandisoft","Bandizip","Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113607","jleyva","moodle-block_configurablereports","Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_dat","HIGH",7.1,"2026-10-20",0],["CVE-2026-113605","Stirling-Tools","Stirling-PDF","Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database","HIGH",8.6,"2026-10-20",0],["CVE-2026-113606","Stirling-Tools","Stirling-PDF","Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders","HIGH",7.1,"2026-10-20",0],["CVE-2026-113604","NationalSecurityAgency","ghidra","Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-113603","x402-foundation","@x402/extensions","x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113602","json-smart","json-smart","json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113600","fatfreecrm","fat_free_crm","Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113601","usememos","memos","Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113599","modoboa","modoboa","Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113597","blinkospace","blinko","Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113598","modoboa","modoboa","Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113596","webstudio-is","webstudio","Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds","LOW",2.3,"2026-10-20",0],["CVE-2026-113595","Sharkord","sharkord","Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113359","Baserow","Baserow","Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113594","Sharkord","sharkord","Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route","MEDIUM",5.3,"2026-10-20",0],["CVE-2025-71436","librdf","Raptor RDF Syntax Library","Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag","HIGH",7.1,"2026-10-20",0],["CVE-2026-90799","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with spe","LOW",1.3,"2026-10-20",0],["CVE-2026-90798","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Replicator follows redirects indefinitely","LOW",0.6,"2026-10-20",0],["CVE-2026-90797","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session","HIGH",7.7,"2026-10-20",0],["CVE-2026-86471","Apache Software Foundation","Apache CouchDB","Apache CouchDB: Admin credentials leading to code execution as operating system user","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-112951","apostrophecms","apostrophe","ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-93003","Eclipse Foundation","Eclipse ThreadX - NetX Duo","NetX Duo Web HTTP server interprets request body content as HTTP header fields","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112950","vitest-dev","vitest","Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-95107","Eclipse Foundation","Eclipse ThreadX","Module object allocation size overflow corrupts the manager object pool","HIGH",7,"2026-10-20",0],["CVE-2026-94202","Eclipse Foundation","Eclipse ThreadX","Module block-pool create validates two of the four parameter words it reads","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-95108","Eclipse Foundation","Eclipse ThreadX","Deleting a user-mode module thread leaks its privileged kernel stack","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-112949","vitest-dev","vitest","Vitest: Code injection via unauthenticated manual mock registration","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-94024","Eclipse Foundation","Eclipse ThreadX","Module Manager object lookup validates one byte of a module's search name","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-94023","Eclipse Foundation","Eclipse ThreadX","Module delete dispatchers do not enforce kernel-object ownership before irreversible delet","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-95109","Eclipse Foundation","Eclipse ThreadX","Cortex-A7 module data validation checks only the first address of a caller-supplied range","HIGH",8.5,"2026-10-20",0],["CVE-2026-94192","Eclipse Foundation","Eclipse ThreadX","Module object deallocation can free a live ThreadX kernel object","HIGH",8.5,"2026-10-20",0],["CVE-2026-112948","vitest-dev","vitest","Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the A","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-112823","WP User Manager","WP User Manager","WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-112824","Magepeople inc.","Bus Ticket Booking with Seat Reservation","WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-92843","Eclipse Foundation","Eclipse ThreadX - NetX Duo","Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure","HIGH",8.7,"2026-10-20",0],["CVE-2026-111843","CozyThemes","Rootblox","WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-112829","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112840","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-111765","a2aproject","a2a-java","A2A Java SDK: Android synchronous POST forwards credentials across authorities after incom","HIGH",7.5,"2026-10-20",0],["CVE-2026-112947","vitejs","vite","Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-inst","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-112836","e4jvikwp","VikRentCar","WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability","HIGH",8.8,"2026-10-20",0],["CVE-2026-92853","Eclipse Foundation","Eclipse ThreadX - NetX Duo","Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure","HIGH",8.7,"2026-10-20",0],["CVE-2026-94018","Eclipse Foundation","Eclipse ThreadX - NetX Duo","NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Lengt","HIGH",8.8,"2026-10-20",0],["CVE-2026-109700","eLightUp","Meta Box – WordPress Custom Fields Framework","WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Co","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-111764","a2aproject","a2a-java","A2A Java SDK has a fail-open default task authorization","HIGH",7.5,"2026-10-20",0],["CVE-2026-93475","Eclipse Foundation","Eclipse ThreadX - NetX Duo","Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-112946","vitejs","vite","Vite: Files outside `server.fs.allow` could be served when project paths match system path","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-111763","a2aproject","a2a-java","A2A Java SDK send client credentials under server-controlled HTTP header name, enabling le","MEDIUM",5.7,"2026-10-20",0],["CVE-2026-91057","Eclipse Foundation","Eclipse ThreadX - GUIX","Out-of-bounds read when a multi-line text view string ends with a carriage return","MEDIUM",4.6,"2026-10-20",0],["CVE-2026-112945","vitejs","vite","Vite: Cross origin script execution through Vite custom middleware","LOW",2.1,"2026-10-20",0],["CVE-2026-92454","Eclipse Foundation","Eclipse ThreadX - GUIX","JPEG decoder: truncated segments are read past the image buffer, and a zero sampling facto","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-112944","vitejs","launch-editor","launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for s","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-111762","a2aproject","a2a-java","A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure","MEDIUM",5.7,"2026-10-20",0],["CVE-2026-111761","a2aproject","a2a-java","A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery","MEDIUM",5.8,"2026-10-20",0],["CVE-2026-91059","Eclipse Foundation","Eclipse ThreadX - GUIX","JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allo","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-112834","Castos","Seriously Simple Podcasting","WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerabili","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-91189","Eclipse Foundation","Eclipse ThreadX - GUIX","GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a hea","HIGH",7.1,"2026-10-20",0],["CVE-2026-112943","vitejs","launch-editor","launch-editor: escapeCmdArgs() omits % escaping on Windows","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-112833","Castos","Seriously Simple Podcasting","WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulner","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-92446","Eclipse Foundation","Eclipse ThreadX - GUIX","GUIX binary resource loader reads past the end of a resource, because no length for it eve","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-92449","Eclipse Foundation","Eclipse ThreadX - GUIX","Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds wri","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-112942","vitejs","launch-editor","launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","HIGH",7.5,"2026-10-20",0],["CVE-2026-91186","Eclipse Foundation","Eclipse ThreadX - GUIX","PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing","HIGH",8.4,"2026-10-20",0],["CVE-2026-113466","","MinIO","MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112941","tox-dev","filelock","filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and wri","LOW",3.3,"2026-10-20",0],["CVE-2026-112940","tox-dev","filelock","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or ","HIGH",7.1,"2026-10-20",0],["CVE-2026-92162","flatpak","flatpak","Flatpak vulnerable to path traversal via unvalidated \"arch\" parameter in DeployAppstream","HIGH",7.2,"2026-10-20",0],["CVE-2026-112939","tox-dev","filelock","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in ","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-112937","tox-dev","filelock","filelock: ReadWriteLock on the hard-link route deletes any directory another user renames ","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-95111","Eclipse Foundation","Eclipse ThreadX","Module queue front-send validates a word count as a byte count","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-112936","tox-dev","filelock","filelock: ReadWriteLock follows a symlink at the lock path into SQLite","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-112935","tox-dev","filelock","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number ","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-96402","Eclipse Foundation","Eclipse ThreadX - USBX","USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its obje","MEDIUM",5.2,"2026-10-20",0],["CVE-2026-112934","tox-dev","filelock","filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-113411","Nerimity","Desktop","Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in ha","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112915","tox-dev","filelock","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardle","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-112914","tox-dev","filelock","filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-lin","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112912","tox-dev","filelock","filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists","LOW",2.5,"2026-10-20",0],["CVE-2026-112911","tox-dev","filelock","filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-112909","tox-dev","filelock","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-113397","DrayTek","Vigor2960","DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112906","tox-dev","filelock","filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-97400","Eclipse Foundation","Eclipse OpenJ9","jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when ope","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-113396","DrayTek","Vigor2960","DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-103119","Apache Software Foundation","Apache Tomcat","Apache Tomcat: AJP response mix-up","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-101356","Apache Software Foundation","Apache Tomcat","Apache Tomcat: HTTP/2 request/response mix-up after error during async processing","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-101296","Apache Software Foundation","Apache Tomcat","Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechani","CRITICAL",9.1,"2026-10-20",0],["CVE-2026-113395","DrayTek","Vigor2960","DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-93446","Apache Software Foundation","Apache Tomcat","Apache Tomcat: Possible TLS 1.3 connection failures","","","2026-10-20",0],["CVE-2026-88041","Apache Software Foundation","Apache Tomcat","Apache Tomcat: HTTP/2 trailer header cross-contamination","","","2026-10-20",0],["CVE-2026-80353","Apache Software Foundation","Apache Tomcat","Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for ","","","2026-10-20",0],["CVE-2026-74049","Apache Software Foundation","Apache Tomcat","Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE","","","2026-10-20",0],["CVE-2026-74048","Apache Software Foundation","Apache Tomcat","Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up","","","2026-10-20",0],["CVE-2026-113394","DrayTek","Vigor2960","DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-96406","Eclipse Foundation","Eclipse ThreadX -  USBX","VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound","MEDIUM",4.9,"2026-10-20",0],["CVE-2026-113393","DrayTek","Vigor2960","DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-96582","Eclipse Foundation","Eclipse ThreadX - USBX","Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser","MEDIUM",4.9,"2026-10-20",0],["CVE-2026-91041","Eclipse Foundation","Eclipse ThreadX - FileX","FileX fault-tolerant log replay writes past the destination sector when mounting a crafted","HIGH",7.8,"2026-10-20",0],["CVE-2026-113392","DrayTek","Vigor2960","DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-105941","Red Hat","streams for Apache Kafka 3","Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azur","HIGH",8.1,"2026-10-20",0],["CVE-2026-113401","Mozilla","Firefox","Denial-of-service in the PDF Viewer component","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-113400","Mozilla","Firefox","Uninitialized memory in the Audio/Video: cubeb component","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-113399","Mozilla","Firefox","Incorrect boundary conditions in the SVG component","","","2026-10-20",0],["CVE-2026-113470","Mozilla","Firefox","Cryptographic issue in the Security Block-lists, Allow-lists, and other State component","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-113391","DrayTek","Vigor2960","DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-113620","Eclipse Foundation","Eclipse ioFog","Eclipse ioFog operator WebSocket accepts an unverified JWT","CRITICAL",9.8,"2026-10-20",0],["CVE-2026-113390","DrayTek","Vigor2960","DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-113619","Eclipse Foundation","Eclipse ioFog","Eclipse ioFog renders request templates before authentication","HIGH",7.5,"2026-10-20",0],["CVE-2026-34485","Nokia","Nokia 1830 Global Express (GX)","A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)","","","2026-10-20",0],["CVE-2026-34484","Nokia","Nokia 1830 Global Express (GX)","A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)","","","2026-10-20",0],["CVE-2026-113389","DrayTek","Vigor2960","DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-113388","","opensource-socialnetwork","opensource-socialnetwork Cache Settings dynamic.php input code injection","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113583","cypht-org","cypht","Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-105949","Red Hat","streams for Apache Kafka 2","Cruise-control: streams for apache kafka cruise control: authentication bypass via extra p","HIGH",8.8,"2026-10-20",0],["CVE-2026-105312","Red Hat","StreamsHub Console for Apache Kafka®","Console-operator: streams for apache kafka console: tenant-controlled container image on c","CRITICAL",9.9,"2026-10-20",0],["CVE-2026-105311","Red Hat","StreamsHub Console for Apache Kafka®","Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfil","HIGH",7.7,"2026-10-20",0],["CVE-2026-18205","Ticimax Informatics Technologies Inc.","Ticimax E-Commerce Platform","XSS in Ticimax Informatics' Ticimax E-Commerce Platform","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-113385","LeeDrOiD Labs","Shortcutter 2 App","LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of androi","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113496","Red Hat","Red Hat Enterprise Linux 10","Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments","MEDIUM",5,"2026-10-20",0],["CVE-2026-113495","Red Hat","Red Hat Enterprise Linux 10","Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments","MEDIUM",5,"2026-10-20",0],["CVE-2026-14933","Unblu inc.","Unblu Spark","Unblu Spark Cross-Site Scripting in Embedded Co-Browsing","HIGH",8.6,"2026-10-20",0],["CVE-2026-9589","Unblu inc.","Unblu Spark","Unblu Spark Authorization Bypass in Configuration Cascade Operations","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-113384","Optimal IdM","OptimalCloud","Optimal IdM OptimalCloud social redirect","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113383","Optimal IdM","OptimalCloud","Optimal IdM OptimalCloud Login cross site scripting","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113358","lavalite","cms","LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes","HIGH",8.7,"2026-10-20",0],["CVE-2026-113357","tester-army","@e2e-dev/github","@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-113355","chatwoot","chatwoot","Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-113356","DokuWiki","DokuWiki","DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition","HIGH",7.7,"2026-10-20",0],["CVE-2026-113354","Finsys","dockhand","Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content","HIGH",7.1,"2026-10-20",0],["CVE-2026-113352","uTox","uTox","uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers","HIGH",7.7,"2026-10-20",0],["CVE-2026-113353","ThimPress","LearnPress","LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113351","libexpat","libexpat","libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset","HIGH",8.2,"2026-10-20",0],["CVE-2026-113349","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113350","marmelab","react-admin","react-admin before 5.15.5 Stored XSS via UrlField and FileField","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-112787","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112786","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization via Import Revert Action","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112784","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112785","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112783","opencats","OpenCATS","OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-108089","Apache Software Foundation","Apache Cocoon","Apache Cocoon: Unauthenticated access to diagnostic interfaces","HIGH",7.5,"2026-10-20",0],["CVE-2026-108088","Apache Software Foundation","Apache Cocoon","Apache Cocoon: Cross-user cache poisoning","","","2026-10-20",0],["CVE-2026-108087","Apache Software Foundation","Apache Cocoon","Apache Cocoon: SQL Injection","","","2026-10-20",0],["CVE-2026-108086","Apache Software Foundation","Apache Cocoon","Apache Cocoon: XEE could lead to SSRF and information disclosure","","","2026-10-20",0],["CVE-2026-113382","arizu-id","fast-tunnel","arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-107597","Eclipse Foundation","Eclipse CSI - PIA","jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-108062","Eclipse Foundation","Eclipse CSI - PIA","Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event ","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-111844","Brizy","Brizy","WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-113381","","Osclass","Osclass Item Model Item.php findUserItems sql injection","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112069","TYPO3","Extension \"FAL Protect\"","Broken Access Control in extension \"FAL Protect\" (fal_protect)","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-112065","TYPO3","Extension \"sgalinski Cookie Consent\"","Missing Authorization in extension \"sgalinski Cookie Consent\" (sg_cookie_optin)","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112064","TYPO3","Extension \"sgalinski Cookie Consent\"","SQL Injection in extension \"sgalinski Cookie Consent\" (sg_cookie_optin)","HIGH",7.1,"2026-10-20",0],["CVE-2026-112066","TYPO3","Extension \"sgalinski Cookie Consent\"","Missing Authorization in extension \"sgalinski Cookie Consent\" (sg_cookie_optin)","HIGH",7.1,"2026-10-20",0],["CVE-2026-112067","TYPO3","Extension \"Accessible Form Captcha\"","Captcha Bypass in extension \"Accessible Form Captcha\" (bw_captcha)","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112068","TYPO3","Extension \"Analytics\"","Insecure Direct Object Reference in extension \"Analytics\" (analytics)","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112237","TYPO3","Extension \"Kitodo.Presentation\"","Server-Side Request Forgery in extension \"Kitodo.Presentation\" (dlf)","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112240","TYPO3","Extension \"TYPO3 Fluid-Form by coding.ms\"","Broken Access Control in extension \"TYPO3 Fluid-Form by coding.ms\" (fluid_form)","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-113442","TYPO3","Extension \"TYPO3 Fluid-Form by coding.ms\"","Cross-Site Scripting in extension \"TYPO3 Fluid-Form by coding.ms\" (fluid_form)","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112238","TYPO3","Extension \"File manager\"","SQL Injection in extension \"File manager\" (ameos_filemanager)","HIGH",8.7,"2026-10-20",0],["CVE-2026-112071","TYPO3","Extension \"TYPO3 Shop by coding.ms\"","Broken Access Control in extension \"TYPO3 Shop by coding.ms\" (shop)","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112239","TYPO3","Extension \"TYPO3 AI Integration Extension\"","Broken Access Control in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)","HIGH",7.2,"2026-10-20",0],["CVE-2026-113468","TYPO3","Extension \"TYPO3 Shop by coding.ms\"","Broken Access Control in extension \"TYPO3 Shop by coding.ms\" (shop)","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113459","TYPO3","Extension \"TYPO3 AI Integration Extension\"","Sensitive Data Exposure in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)","HIGH",7.1,"2026-10-20",0],["CVE-2026-112070","TYPO3","Extension \"Analytics\"","Broken Access Control in extension \"Analytics\" (analytics)","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-113378","mcollina","mcp-ripgrep","mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-43858","Advantech","ADAM-3600","A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to","HIGH",8.6,"2026-10-20",0],["CVE-2026-43857","Advantech","ADAM-3600","A vulnerability could allow a remote authenticated attacker to achieve arbitrary code exec","HIGH",8.6,"2026-10-20",0],["CVE-2026-85267","Google Cloud","Cloud Shell","Cross-Site WebSocket Hijacking in Google Cloud Shell","HIGH",8.7,"2026-10-20",0],["CVE-2026-43856","Advantech","ADAM-3600","A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could al","HIGH",8.6,"2026-10-20",0],["CVE-2026-43855","Advantech","ADAM-3600","A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to ","HIGH",7.5,"2026-10-20",0],["CVE-2026-43854","Advantech","ADAM-3600","A vulnerability could allow an attacker with access to an encrypted project file to retrie","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-43853","Advantech","ADAM-3600","A vulnerability could allow an attacker to send a crafted message to trigger an assertion ","HIGH",8.2,"2026-10-20",0],["CVE-2026-43852","Advantech","ADAM-3600","A vulnerability could allow an authenticated attacker to write files to arbitrary location","HIGH",8.2,"2026-10-20",0],["CVE-2026-43851","Advantech","ADAM-3600","A path traversal vulnerability could allow an authenticated attacker to read arbitrary fil","HIGH",8.2,"2026-10-20",0],["CVE-2026-43850","Advantech","ADAM-3600","A command injection vulnerability could allow an authenticated attacker to achieve root-le","HIGH",8.6,"2026-10-20",0],["CVE-2026-43849","Advantech","ADAM-3600","A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-43848","Advantech","ADAM-3600","A vulnerability in the bulk port configuration functionality could allow an unauthenticate","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-43847","Advantech","ADAM-3600","A vulnerability in the proprietary protocol could allow an attacker to brute force the adm","HIGH",8.2,"2026-10-20",0],["CVE-2026-43846","Advantech","ADAM-3600","A stack-based buffer overflow vulnerability in a non-functional feature could allow an aut","HIGH",8.6,"2026-10-20",0],["CVE-2026-43845","Advantech","ADAM-3600","A vulnerability in the password reset mechanism could allow an attacker to bypass the auth","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-43844","Advantech","ADAM-3600","A vulnerability in the proprietary protocol could allow an attacker to bypass the authenti","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-43843","Advantech","ADAM-3600","An integer overflow vulnerability in the license manager service could allow an unauthenti","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-43842","Advantech","ADAM-3600","A NULL pointer dereference vulnerability in the license manager service could allow an una","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-43841","Advantech","ADAM-3600","A NULL pointer dereference vulnerability in the license manager service could allow an una","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113469","Stormshield","Stormshield Network Security","Improper Signature Verification of Active Update Files","HIGH",7.5,"2026-10-20",0],["CVE-2026-43840","Advantech","ADAM-3600","A NULL pointer dereference vulnerability in the license manager service could allow an una","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-43839","Advantech","ADAM-3600","A NULL pointer dereference vulnerability in the logs management functionality could allow ","HIGH",8.7,"2026-10-20",0],["CVE-2026-101201","qt","qt","QBinaryJson::fromBinaryData() integer overflow leading to OOB read","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-43838","Advantech","ADAM-3600","A stack-based buffer overflow vulnerability in the login functionality could allow an atta","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-92287","Apache Software Foundation","Apache Arrow C++","Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsCl","","","2026-10-20",0],["CVE-2026-43837","Advantech","ADAM-3600","A buffer overflow vulnerability in the password verification functionality could allow an ","HIGH",7.5,"2026-10-20",0],["CVE-2026-11960","FacturaScripts","FacturaScripts","Multiple vulnerabilities in FacturaScripts","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-11959","FacturaScripts","FacturaScripts","Multiple vulnerabilities in FacturaScripts","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113465","Stormshield","Stormshield Network Security","Possible DOM XSS in SNS Web Administration Portal","MEDIUM",6.6,"2026-10-20",0],["CVE-2026-43836","Advantech","ADAM-3600","A vulnerability could allow an attacker to forge a packet to execute arbitrary commands wi","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-43835","Advantech","ADAM-3600","A vulnerability in the firmware upgrade functionality could allow an authenticated attacke","HIGH",8.6,"2026-10-20",0],["CVE-2026-43834","Advantech","ADAM-3600","A stack-based buffer overflow vulnerability in the logs settings functionality could allow","HIGH",7.5,"2026-10-20",0],["CVE-2024-2323","WSO2","WSO2 Enterprise Integrator","Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-111090","Stormshield","Stormshield Network Security","Improper Signature Verification of Firmware Update Files","HIGH",7.8,"2026-10-20",0],["CVE-2026-112177","Red Hat","Red Hat Enterprise Linux 10","Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8","HIGH",7.3,"2026-10-20",0],["CVE-2026-113407","YS-infoware","BA-Workflow","YS-infoware｜BA-Workflow - SQL Injection","HIGH",8.7,"2026-10-20",0],["CVE-2026-113406","YS-infoware","BA-Workflow","YS-infoware｜BA-Workflow - SQL Injection","HIGH",8.7,"2026-10-20",0],["CVE-2026-113405","YS-infoware","BA-Workflow","YS-infoware｜BA-Workflow - SQL Injection","HIGH",8.7,"2026-10-20",0],["CVE-2026-110725","fast-uri","fast-uri","fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix ref","LOW",3.7,"2026-10-20",0],["CVE-2026-113403","ArmorX Global Technology","ArmorX Spam","ArmorX Global Technology｜ArmorX Spam - Command Injection","HIGH",7.1,"2026-10-20",0],["CVE-2026-110306","fast-uri","fast-uri","fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-110180","fast-uri","fast-uri","fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","MEDIUM",4.8,"2026-10-20",0],["CVE-2026-110095","fast-uri","fast-uri","fast-uri vulnerable to improper path equivalence in relative reference normalization","LOW",3.7,"2026-10-20",0],["CVE-2026-93878","Divigear","DiviGear Carousel","DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via u","MEDIUM",6.4,"2026-10-20",0],["CVE-2026-112148","LY Corporation","LIFF SDK","A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DO","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-113402","ArmorX Global Technology","ArmorX Spam","ArmorX Global Technology｜ArmorX Spam - Local File Inclusion","HIGH",7.1,"2026-10-20",0],["CVE-2026-113404","Uniong","WebITR","Uniong｜WebITR - Insecure Deserialization","HIGH",8.7,"2026-10-20",0],["CVE-2026-96903","","Easy Property Listings","Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJ","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-96902","","Easy Property Listings","Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via RE","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-93300","EventOn","EventON - Subscriber","EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter","HIGH",7.5,"2026-10-20",0],["CVE-2026-97627","Atsumi Electric Co., Ltd.","ADX5004","Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by A","HIGH",8.6,"2026-10-20",0],["CVE-2026-100737","Atsumi Electric Co., Ltd.","ADX5004","Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by A","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-113386","Roundcube","Webmail","Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command inject","HIGH",7.1,"2026-10-20",0],["CVE-2026-109831","GNU Project","UnRTF","UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file cra","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-113380","Signal","RingRTC","In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue ","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-86467","Apache Software Foundation","Apache Airflow Amazon provider","Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the atta","","","2026-10-20",0],["CVE-2026-12489","Zyxel","EX3501-T0 firmware","An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-75753","ASUS","Router","Missing Authentication for a Critical Function in certain ASUS routers allows an unauthori","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-17518","ASUS","Router","Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacen","HIGH",8.2,"2026-10-20",0],["CVE-2026-102438","ASUS","Armoury Crate","An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users","HIGH",8.5,"2026-10-20",0],["CVE-2026-105299","Cloudflare","https://github.com/cloudflare/pingora","Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL byp","HIGH",8.7,"2026-10-20",0],["CVE-2026-86976","Apple","iOS and iPadOS","An authorization issue was addressed with improved state management. This issue is fixed i","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86977","Apple","iOS and iPadOS","An authorization issue was addressed with improved network restrictions. This issue is fix","","","2026-10-20",0],["CVE-2026-86979","Apple","macOS","A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Ga","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86981","Apple","macOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86962","Apple","iOS and iPadOS","A double free issue was addressed with improved memory management. This issue is fixed in ","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86963","Apple","iOS and iPadOS","A denial-of-service issue was addressed with improved input validation. This issue is fixe","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-86975","Apple","iOS and iPadOS","An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in ","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-86957","Apple","iOS and iPadOS","An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in ","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-86959","Apple","iOS and iPadOS","An input validation issue was addressed with improved input validation. This issue is fixe","","","2026-10-20",0],["CVE-2026-86961","Apple","iOS and iPadOS","A race condition was addressed with additional validation. This issue is fixed in iOS 27 a","HIGH",7.8,"2026-10-20",0],["CVE-2026-86948","Apple","Xcode","This issue was addressed by enforcing library validation on the affected binaries. This is","","","2026-10-20",0],["CVE-2026-86949","Apple","Xcode","This issue was addressed by enforcing library validation on the affected binaries. This is","HIGH",8.8,"2026-10-20",0],["CVE-2026-86953","Apple","iOS and iPadOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","MEDIUM",4.6,"2026-10-20",0],["CVE-2026-86955","Apple","iOS and iPadOS","An authorization issue was addressed with improved state management. This issue is fixed i","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86933","Apple","macOS","A permissions issue was addressed with additional sandbox restrictions. This issue is fixe","LOW",3.3,"2026-10-20",0],["CVE-2026-86935","Apple","macOS","This issue was addressed by removing additional entitlements. This issue is fixed in macOS","","","2026-10-20",0],["CVE-2026-86940","Apple","macOS","This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Gol","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86944","Apple","iOS and iPadOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","","","2026-10-20",0],["CVE-2026-86922","Apple","Safari","A type confusion issue was addressed with improved state management. This issue is fixed i","HIGH",8.8,"2026-10-20",0],["CVE-2026-86928","Apple","macOS","A path handling issue was addressed with improved validation. This issue is fixed in macOS","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86932","Apple","macOS","An authorization issue was addressed with improved state management. This issue is fixed i","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86918","Apple","iOS and iPadOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-86919","Apple","iOS and iPadOS","A stack overflow was addressed with improved input validation. This issue is fixed in iOS ","HIGH",8.8,"2026-10-20",0],["CVE-2026-86921","Apple","iOS and iPadOS","A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.","MEDIUM",6.2,"2026-10-20",0],["CVE-2026-86913","Apple","iOS and iPadOS","A use after free issue was addressed with improved memory management. This issue is fixed ","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-86914","Apple","macOS","An information disclosure issue was addressed with improved state management. This issue i","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-86915","Apple","macOS","A race condition was addressed with improved locking. This issue is fixed in macOS Golden ","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-86907","Apple","macOS","An authorization issue was addressed with improved entitlement checks. This issue is fixed","MEDIUM",4.4,"2026-10-20",0],["CVE-2026-86872","Apple","Safari","A logic issue was addressed with improved state management. This issue is fixed in Safari ","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-86874","Apple","Xcode","An out-of-bounds read was addressed with improved input validation. This issue is fixed in","LOW",3.3,"2026-10-20",0],["CVE-2026-86875","Apple","Xcode","An input validation issue was addressed with improved input validation. This issue is fixe","MEDIUM",4.3,"2026-10-20",0],["CVE-2026-86871","Apple","macOS","An integer underflow was addressed with improved input validation. This issue is fixed in ","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-86868","Apple","macOS","An authentication issue was addressed with improved state management. This issue is fixed ","","","2026-10-20",0],["CVE-2026-84613","Apple","iOS and iPadOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","MEDIUM",6.5,"2026-10-20",0],["CVE-2026-84579","Apple","macOS","A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate","","","2026-10-20",0],["CVE-2026-84582","Apple","iOS and iPadOS","A privacy issue was addressed with improved access restrictions. This issue is fixed in iO","","","2026-10-20",0],["CVE-2026-84547","Apple","macOS","A memory corruption issue was addressed with improved input validation. This issue is fixe","LOW",3.5,"2026-10-20",0],["CVE-2026-84508","Apple","iOS and iPadOS","This issue was addressed with improved validation of the caller's access. This issue is fi","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-84490","Apple","iOS and iPadOS","This issue was addressed through improved state management. This issue is fixed in iOS 27 ","LOW",2,"2026-10-20",0],["CVE-2026-65396","Apple","macOS","A buffer overflow was addressed with improved size validation. This issue is fixed in macO","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-65379","Apple","macOS","The issue was addressed with improved handling of secure input state. This issue is fixed ","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-65372","Apple","macOS","A race condition was addressed with additional validation. This issue is fixed in macOS Go","MEDIUM",4.7,"2026-10-20",0],["CVE-2026-65356","Apple","macOS","An access issue was addressed with improved access controls. This issue is fixed in macOS ","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-28850","Apple","visionOS","An authorization issue was addressed with improved state management. This issue is fixed i","MEDIUM",5.5,"2026-10-20",0],["CVE-2026-28853","Apple","macOS","The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, m","HIGH",7.8,"2026-10-20",0],["CVE-2026-28854","Apple","macOS","The issue was addressed with additional app bundle integrity checks. This issue is fixed i","","","2026-10-20",0],["CVE-2026-105298","Cloudflare","https://github.com/cloudflare/pingora","Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based ","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-77938","letta-ai","letta","Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance","HIGH",7.1,"2026-10-20",0],["CVE-2026-77936","letta-ai","letta","Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Acc","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-77937","letta-ai","letta","Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header","HIGH",8.6,"2026-10-20",0],["CVE-2026-77935","coze-dev","coze-studio","Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers","HIGH",8.7,"2026-10-20",0],["CVE-2026-77933","eosphoros-ai","DB-GPT","DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-77934","coze-dev","coze-studio","Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner","HIGH",8.7,"2026-10-20",0],["CVE-2026-77932","eosphoros-ai","DB-GPT","DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-77930","EvoScientist","EvoScientist","EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-77926","apconw","Aix-DB","Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool","HIGH",8.7,"2026-10-20",0],["CVE-2026-75128","chatchat-space","Langchain-Chatchat","Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-109443","jd-opensource","JoySafeter","JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell","HIGH",8.7,"2026-10-20",0],["CVE-2026-109444","Tracer-Cloud","opensre","OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-109441","ginlix-ai","LangAlpha","LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-109442","cas-bigdatalab","piflow","piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell","CRITICAL",9.3,"2026-10-20",0],["CVE-2026-109440","ginlix-ai","LangAlpha","LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode","HIGH",8.7,"2026-10-20",0],["CVE-2026-109395","ning","compress-lzf","Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder","HIGH",8.8,"2026-10-20",0],["CVE-2026-105297","Cloudflare","https://github.com/cloudflare/pingora","Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurre","HIGH",7.5,"2026-10-20",0],["CVE-2025-60475","","","A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Pro","","","2026-10-20",0],["CVE-2025-60494","","","A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_prop","","","2026-10-20",0],["CVE-2025-60496","","","A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c","","","2026-10-20",0],["CVE-2026-95168","","","An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the ","HIGH",7.8,"2026-10-20",0],["CVE-2026-105453","IBM","Sterling Connect Direct for Unix","IBM Sterling Connect:Direct for Unix Improper Privilege Management","HIGH",8.4,"2026-10-20",0],["CVE-2026-107366","IBM","Langflow OSS","Langflow OSS Authorization Bypass Through User-Controlled Key","HIGH",8.3,"2026-10-20",0],["CVE-2026-107400","IBM","TRIRIGA Application Platform","Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication","HIGH",8.8,"2026-10-20",0],["CVE-2026-109126","IBM","Verify Identity Access","IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials","HIGH",8.8,"2026-10-20",0],["CVE-2026-8355","IBM","ContextForge MCP Gateway","IBM ContextForge MCP Gateway is affected by server-side request forgery","MEDIUM",5.4,"2026-10-20",0],["CVE-2026-112373","H3C","Magic NX15","H3C Magic NX15 usrlist sub_416874 stack-based overflow","HIGH",7.1,"2026-10-20",0],["CVE-2025-36061","IBM","Storage TS4500 Library","TS4500 Tape Library Denial of Service","MEDIUM",6.5,"2026-10-20",0],["CVE-2025-36069","IBM","Storage TS4500 Library","TS4500 Tape Library Insufficient Session Expiration","MEDIUM",5.5,"2026-10-20",0],["CVE-2025-36252","IBM","Storage TS4500 Library","TS4500 Tape Library Insufficient Session Expiration","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-19178","IBM","Storage TS4500 Library","TS4500 Tape Library Race Condition","MEDIUM",6.8,"2026-10-20",0],["CVE-2026-77684","zephyrproject","zephyr","Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent B","MEDIUM",5.7,"2026-10-20",0],["CVE-2026-19595","zephyrproject","zephyr","Zephyr RTIO syscall verifier validates output parameters for read instead of write access","MEDIUM",6.1,"2026-10-20",0],["CVE-2026-112372","H3C","Magic NX15","H3C Magic NX15 upload importprofile path traversal","MEDIUM",5.1,"2026-10-20",0],["CVE-2026-112371","H3C","Magic NX15","H3C Magic NX15 RPC esps write code injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-112991","MISP","misp-modules","MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()","MEDIUM",6.3,"2026-10-20",0],["CVE-2026-112370","H3C","Magic NX15","H3C Magic NX15 usrlist sub_416874 os command injection","CRITICAL",9.4,"2026-10-20",0],["CVE-2026-112901","python-pillow","Pillow","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112900","python-pillow","Pillow","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-112898","python-pillow","Pillow","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112897","python-pillow","Pillow","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","HIGH",8.7,"2026-10-20",0],["CVE-2026-112896","python-pillow","Pillow","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","HIGH",8.8,"2026-10-20",0],["CVE-2026-112895","python-pillow","Pillow","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for C","HIGH",8.7,"2026-10-20",0],["CVE-2026-112894","python-pillow","Pillow","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","HIGH",8.7,"2026-10-20",0],["CVE-2026-112893","python-pillow","Pillow","Pillow: Invalid free in FreeType glyph rendering when a stroker is active","HIGH",8.2,"2026-10-20",0],["CVE-2026-112361","","Dolibarr","Dolibarr CSP document.php protection mechanism","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112261","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: use-after-free in xcf loader via prop_selected_path","HIGH",7.8,"2026-10-20",0],["CVE-2026-112258","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels","HIGH",7.8,"2026-10-20",0],["CVE-2026-112257","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)","HIGH",7.8,"2026-10-20",0],["CVE-2026-112892","python-pillow","Pillow","Pillow: MSP RLE decoder expands a tiny file into unbounded memory","HIGH",8.7,"2026-10-20",0],["CVE-2026-112891","python-pillow","Pillow","Pillow: Quadratic GIF comment copying during save","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112406","python-pillow","Pillow","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","HIGH",8.7,"2026-10-20",0],["CVE-2026-112360","Netis","EAP930","Netis EAP930 CGI Endpoint debug return200 backdoor","HIGH",8.9,"2026-10-20",0],["CVE-2026-112405","python-pillow","Pillow","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","HIGH",8.7,"2026-10-20",0],["CVE-2026-112404","python-pillow","Pillow","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","HIGH",8.8,"2026-10-20",0],["CVE-2026-105815","TP-Link Systems Inc.","Tapo C210 v3.6","Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-L","HIGH",7.1,"2026-10-20",0],["CVE-2026-105814","TP-Link Systems Inc.","Tapo C210 v3.6","Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112403","python-pillow","Pillow","Pillow: Heap buffer overflow in ImagingJpegDecode","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-112402","python-pillow","Pillow","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","HIGH",8.7,"2026-10-20",0],["CVE-2026-112397","python-pillow","Pillow","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","HIGH",8.7,"2026-10-20",0],["CVE-2026-112392","python-pillow","Pillow","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","HIGH",8.2,"2026-10-20",0],["CVE-2026-112401","python-pillow","Pillow","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()","MEDIUM",6.9,"2026-10-20",0],["CVE-2026-112358","TiBillet","Lespass","TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery","LOW",2.1,"2026-10-20",0],["CVE-2026-112400","python-pillow","Pillow","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","HIGH",8.7,"2026-10-20",0],["CVE-2026-112399","python-pillow","Pillow","Pillow: APNG background disposal allocates full canvas before decompression bomb check","HIGH",8.7,"2026-10-20",0],["CVE-2026-112398","python-pillow","Pillow","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","CRITICAL",9.2,"2026-10-20",0],["CVE-2026-53995","mlflow","mlflow","MLflow 3.17.1 and prior Path Traversal via Trace ID API","HIGH",8.8,"2026-10-20",0],["CVE-2026-112396","python-pillow","Pillow","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer","MEDIUM",5.9,"2026-10-20",0],["CVE-2026-112302","kiwilan","php-archive","kiwilan php-archive Extraction ArchiveZip.php extract path traversal","MEDIUM",5.3,"2026-10-20",0],["CVE-2026-112395","python-pillow","Pillow","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-111946","","Plack-Middleware-ETag","Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode number","","","2026-10-19",0],["CVE-2026-112394","python-pillow","Pillow","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112393","python-pillow","Pillow","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","CRITICAL",9.2,"2026-10-19",0],["CVE-2026-112301","orbitale","imagemagick-php","orbitale imagemagick-php Command.php font os command injection","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112391","python-pillow","Pillow","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-76788","zephyrproject","zephyr","Stack out-of-bounds write in the OSDP Control Panel reply parser","HIGH",8.8,"2026-10-19",0],["CVE-2026-76787","zephyrproject","zephyr","NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-112390","python-pillow","Pillow","Pillow: Infinite loop in MIC n_frames when the embedded TIFF","HIGH",8.2,"2026-10-19",0],["CVE-2026-112300","DiffSK","configobj","DiffSK configobj __init__.py _sectionmarker redos","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112299","smrealms","smr","smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forge","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111766","markdown-it","markdown-it","markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","LOW",3.7,"2026-10-19",0],["CVE-2026-112297","ptbsare","anx-calibre-manager","ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request fo","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-71169","Dell","Application Store","Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assig","HIGH",7,"2026-10-19",0],["CVE-2026-82166","Dell","Application Store","Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for ","HIGH",8.8,"2026-10-19",0],["CVE-2026-71170","Dell","Application Store","Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element","HIGH",7.8,"2026-10-19",0],["CVE-2026-112254","agit8or1","clientst0r","agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112260","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing","HIGH",7.1,"2026-10-19",0],["CVE-2026-112782","getgrav","grav","Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service","HIGH",8.7,"2026-10-19",0],["CVE-2026-112781","getgrav","grav","Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives","HIGH",8.7,"2026-10-19",0],["CVE-2026-112780","getgrav","grav","Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112778","traefik","traefik","Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernete","MEDIUM",6.4,"2026-10-19",0],["CVE-2026-112779","getgrav","grav-plugin-api","Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112777","craftcms","cms","Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE","HIGH",8.7,"2026-10-19",0],["CVE-2026-112775","craftcms","cms","Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password","HIGH",8.7,"2026-10-19",0],["CVE-2026-112776","craftcms","cms","Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112774","craftcms","cms","Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout","HIGH",8.7,"2026-10-19",0],["CVE-2026-112772","craftcms","cms","Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection","HIGH",8.7,"2026-10-19",0],["CVE-2026-112773","craftcms","cms","Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection","HIGH",8.7,"2026-10-19",0],["CVE-2026-112771","craftcms","cms","Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters","HIGH",7.1,"2026-10-19",0],["CVE-2026-112769","parse-community","parse-server","Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission By","LOW",2.3,"2026-10-19",0],["CVE-2026-112770","craftcms","cms","Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable","HIGH",8.7,"2026-10-19",0],["CVE-2026-112768","parse-community","parse-server","Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User U","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112252","Wuxi Wubang Security Software","Wubang Five-in-One Safety Production Management Information System","Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information ","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112259","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import","MEDIUM",5.5,"2026-10-19",0],["CVE-2026-112251","antoinersx","clawhost","antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-109437","CognicellAI","Cognition","Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend","CRITICAL",9.2,"2026-10-19",0],["CVE-2026-112249","grandnode","grandnode2","grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site ","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-109434","Fenrir","Sleipnir Mobile for Android","Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-110688","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revali","","","2026-10-19",0],["CVE-2026-110687","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during ","","","2026-10-19",0],["CVE-2026-110686","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter re","","","2026-10-19",0],["CVE-2026-110685","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged valu","","","2026-10-19",0],["CVE-2026-110684","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overload","","","2026-10-19",0],["CVE-2026-110682","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the dec","","","2026-10-19",0],["CVE-2026-110681","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a","","","2026-10-19",0],["CVE-2026-110680","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied o","","","2026-10-19",0],["CVE-2026-110678","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering increm","","","2026-10-19",0],["CVE-2026-110677","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplica","","","2026-10-19",0],["CVE-2026-110676","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponen","","","2026-10-19",0],["CVE-2026-110675","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare ha","","","2026-10-19",0],["CVE-2026-110674","","Cpanel-JSON-XS","Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare key","","","2026-10-19",0],["CVE-2026-110673","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged va","","","2026-10-19",0],["CVE-2026-110672","","Cpanel-JSON-XS","Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected ","","","2026-10-19",0],["CVE-2026-112248","grandnode","grandnode2","grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path trav","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-11319","TickTick Limited","TickTick for Android","TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-55644","element-hq","element-x-ios","Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may gr","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-105810","TP-Link Systems Inc.","Tapo C320WS v2","Authenticated Local Stack Overflow in TP-Link Tapo C320WS","HIGH",8.5,"2026-10-19",0],["CVE-2023-38375","IBM","Cloud Pak System","IBM Cloud Pak System Cross-Site Scripting","MEDIUM",6.1,"2026-10-19",0],["CVE-2026-3161","IBM","Cloud Pak System","IBM Cloud Pak System Risky Cryptographic Algorithm","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-3295","IBM","Cloud Pak System","IBM Cloud Pak System Cross-Site Scripting","HIGH",7.4,"2026-10-19",0],["CVE-2026-4418","IBM","Cloud Pak System","IBM Cloud Pak System HTML Injection","MEDIUM",5.4,"2026-10-19",0],["CVE-2026-111759","markdown-it","markdown-it","markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","HIGH",7.5,"2026-10-19",0],["CVE-2026-111757","honojs","hono","Hono: `serveStatic` decodes the request path a second time, leading to bypass of middlewar","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111755","follow-redirects","follow-redirects","follow-redirects sensitiveHeaders regex escaping can expose credential headers","HIGH",8.2,"2026-10-19",0],["CVE-2026-112377","CCC-Attestation","attested-tls-poc","CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack","CRITICAL",9.1,"2026-10-19",0],["CVE-2026-1501","IBM","Concert","IBM Concert Software Improper Certificate Validation","LOW",3.7,"2026-10-19",0],["CVE-2026-1510","IBM","Concert","IBM Concert Software Improper Clearing of Heap Memory","MEDIUM",4.7,"2026-10-19",0],["CVE-2026-3303","IBM","Concert","IBM Concert Software Permissive Cross-domain Security Policy","LOW",3.7,"2026-10-19",0],["CVE-2026-3628","IBM","Concert","IBM Concert Software Information Disclosure","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-4405","IBM","Concert","IBM Concert Software Use of Web Browser Cache Containing Sensitive Information","MEDIUM",4,"2026-10-19",0],["CVE-2026-4413","IBM","Concert","IBM Concert Software Cross-Site Scripting","MEDIUM",6.1,"2026-10-19",0],["CVE-2026-6719","IBM","Concert","IBM Concert Software Use of Insufficiently Random Values","HIGH",7.5,"2026-10-19",0],["CVE-2026-112247","Wuxi Wubang Security Software","Five-in-One Safety Production Management Information System","Wuxi Wubang Security Software Five-in-One Safety Production Management Information System ","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-6930","IBM","Concert","IBM Concert Software Risky Cryptographic Algorithm","LOW",3.7,"2026-10-19",0],["CVE-2026-15661","IBM","Concert","IBM Concert Software Improper Output Neutralization for Logs","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111750","aio-libs","aiohttp","AIOHTTP: Pure-Python parser request smuggling","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-111749","aio-libs","aiohttp","AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","LOW",2.3,"2026-10-19",0],["CVE-2026-111748","aio-libs","aiohttp","AIOHTTP: Absolute-form request targets can spoof Request.scheme","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112195","","FusionPBX","FusionPBX Dialplan Editor dialplan.php os command injection","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-111066","aio-libs","aiohttp","AIOHTTP: File descriptor exhaustion in multipart requests","HIGH",8.2,"2026-10-19",0],["CVE-2024-4412","WSO2","WSO2 Enterprise Integrator","Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary O","LOW",2.7,"2026-10-19",0],["CVE-2026-111065","aio-libs","aiohttp","AIOHTTP: Connector pool exhaustion via Max-Age overflow","MEDIUM",6.9,"2026-10-19",0],["CVE-2025-13173","WSO2","WSO2 API Control Plane","Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Un","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-111064","aio-libs","aiohttp","aiohttp server lacks an initial request/header timeout","HIGH",8.2,"2026-10-19",0],["CVE-2025-13591","WSO2","WSO2 Identity Server","Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Accou","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112193","Webkul","Aureus ERP","Webkul Aureus ERP UserForm.php weak password","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-111063","aio-libs","aiohttp","AIOHTTP: Secure attribute not enforced for shared cookie","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-14511","IBM","MQ","IBM MQ Denial of Service","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-10572","IBM","MQ Operator","IBM MQ Buffer Overflow","HIGH",8.8,"2026-10-19",0],["CVE-2026-10574","IBM","MQ Operator","IBM MQ Buffer Overflow","HIGH",8.8,"2026-10-19",0],["CVE-2026-10743","IBM","MQ Operator","IBM MQ Race Condition","HIGH",8.8,"2026-10-19",0],["CVE-2026-11828","IBM","MQ Operator","IBM MQ Buffer Overflow","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-11829","IBM","MQ Operator","IBM MQ Buffer Overflow","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-11831","IBM","MQ Operator","IBM MQ Heap-based Buffer Overflow","MEDIUM",5.4,"2026-10-19",0],["CVE-2026-12148","IBM","MQ Operator","IBM MQ Deserialization of Untrusted Data","HIGH",7.5,"2026-10-19",0],["CVE-2026-12155","IBM","MQ Operator","IBM MQ Deserialization of Untrusted Data","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-12343","IBM","MQ Operator","IBM MQ Denial of Service","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-12350","IBM","MQ Operator","IBM MQ Deserialization of Untrusted Data","MEDIUM",6.5,"2026-10-19",0],["CVE-2025-10149","WSO2","WSO2 Identity Server as Key Manager","Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Tak","HIGH",8.2,"2026-10-19",0],["CVE-2026-12660","IBM","MQ Operator","IBM MQ Path Traversal","LOW",2.7,"2026-10-19",0],["CVE-2026-12665","IBM","MQ Operator","IBM MQ Buffer Overflow","HIGH",8.1,"2026-10-19",0],["CVE-2026-12669","IBM","MQ Operator","IBM MQ Out-of-bounds Read","LOW",3.1,"2026-10-19",0],["CVE-2026-12727","IBM","MQ Operator","IBM MQ Buffer Overflow","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-12670","IBM","MQ Operator","IBM MQ Denial of Service","MEDIUM",5.3,"2026-10-19",0],["CVE-2025-7203","WSO2","WSO2 Universal Gateway","Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2","MEDIUM",4.9,"2026-10-19",0],["CVE-2026-107188","Eptura","Archibus","Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Rem","CRITICAL",9.6,"2026-10-19",0],["CVE-2026-111862","RankMath","Rank Math SEO PRO","Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-107187","Eptura","Archibus","Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables","HIGH",8.5,"2026-10-19",0],["CVE-2026-107186","Eptura","Archibus","Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session","HIGH",8.6,"2026-10-19",0],["CVE-2026-111061","Eugeny","russh","russh agent server converts constraint records into unbounded never-rolled-back tasks","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-112190","Webkul","Aureus ERP","Webkul Aureus ERP composer.json insertion of sensitive information into debugging code","MEDIUM",6.9,"2026-10-19",0],["CVE-2025-7043","WSO2","WSO2 API Manager","Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Re","MEDIUM",5.4,"2026-10-19",0],["CVE-2025-6623","WSO2","WSO2 API Manager","Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-112159","","JumpServer","JumpServer Template Rendering os command injection","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-103038","StreamSoft","PingTools Network Utilities","PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host","HIGH",8.6,"2026-10-19",0],["CVE-2026-111059","mljar","mercury","Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as","MEDIUM",6.1,"2026-10-19",0],["CVE-2026-111058","mljar","mercury","Mercury: Unauthenticated Remote Code Execution via /api/kernels","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-111057","mljar","mercury","Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","CRITICAL",10,"2026-10-19",0],["CVE-2026-111056","FOSSBilling","FOSSBilling","FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112158","MikroTik","RouterOS","MikroTik RouterOS ipt_SAME.ko same_check integer overflow","HIGH",7.1,"2026-10-19",0],["CVE-2026-111053","FOSSBilling","FOSSBilling","FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/sys","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111046","FOSSBilling","FOSSBilling","FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensi","LOW",2.3,"2026-10-19",0],["CVE-2026-112368","MongoDB Inc.","PHP Driver","Unbounded Recursion in phongo_bson_visit_document/visit_array:","HIGH",8.2,"2026-10-19",0],["CVE-2026-112157","MemTensor","memmy-agent","MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption","LOW",2.3,"2026-10-19",0],["CVE-2026-111045","anshupriyan","cli-bridge","CLI Bridge: High-severity sandbox escape via dangling symlink","HIGH",7.5,"2026-10-19",0],["CVE-2026-12254","Netskope Inc.","Netskope Client","Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue","MEDIUM",6.4,"2026-10-19",0],["CVE-2026-107571","Progressive Robot Ltd","hMailServer","Incorrect Default Permissions in hMailServer","HIGH",7.8,"2026-10-19",0],["CVE-2026-107569","Progressive Robot Ltd","hMailServer","Unchecked Input for Loop Condition in hMailServer","HIGH",7.5,"2026-10-19",0],["CVE-2026-107566","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-107568","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-107567","Progressive Robot Ltd","hMailServer","Use of Less Trusted Source in hMailServer","HIGH",7.5,"2026-10-19",0],["CVE-2026-112153","vraj404","Criminal-Management-System","vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error s","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112366","micromatch","picomatch","Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns","HIGH",8.7,"2026-10-19",0],["CVE-2026-112310","docling-project","docling-core","docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112363","unclecode","crawl4ai","Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112309","airjp73","@rvf/set-get","@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods","HIGH",8.7,"2026-10-19",0],["CVE-2026-112307","andialbrecht","sqlparse","sqlparse through 0.6.0 PHP Code Injection via output_format='php'","HIGH",8.4,"2026-10-19",0],["CVE-2026-112308","crewAIInc","crewai-tools","crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool","HIGH",8.3,"2026-10-19",0],["CVE-2026-112306","nocobase","nocobase","NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields","HIGH",8.6,"2026-10-19",0],["CVE-2026-112305","semaphoreui","Semaphore UI","Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override","HIGH",8.7,"2026-10-19",0],["CVE-2026-112303","GDevelop","GDevelop","GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112304","Mindee","docTR","docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()","HIGH",7.7,"2026-10-19",0],["CVE-2026-112152","vraj404","Criminal-Management-System","vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-109433","Camunda","Camunda 7","Camunda Broken Access Control via Cockpit","MEDIUM",6,"2026-10-19",0],["CVE-2026-109432","Camunda","Camunda 7","Camunda Expression Injection via orQueries RCE","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-109431","Camunda","Camunda 7","Camunda Missing Authorization in Task Sub-Resources","HIGH",8.6,"2026-10-19",0],["CVE-2026-112151","vraj404","Criminal Management System","vraj404 Criminal Management System Submission Form home.php sql injection","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-86375","Dell","Application Installer,","Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of S","MEDIUM",6.2,"2026-10-19",0],["CVE-2026-112329","Automattic","Sensei LMS","Sensei LMS 4.26.4 Broken Access Control via save_new_message","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112150","vraj404","Criminal-Management-System","vraj404 Criminal-Management-System search.php sql injection","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112328","Automattic","Sensei LMS","Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112149","vraj404","Criminal-Management-System","vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112147","ai-genius-automations","octoally","ai-genius-automations octoally index.ts information disclosure","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112146","D-Link","E15","D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112295","sunkaifei","FlyCms","FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112296","sunkaifei","FlyCms","FlyCms through commit edfdf724 Default Super Administrator Credentials","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112294","sunkaifei","FlyCms","FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112292","operacle","checkcle","CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112293","BoxyHQ","saas-starter-kit","BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112291","Flarum","Extension Manager","Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task A","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112289","KoalixSwitzerland","koalixcrm","Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112290","MI6","Intelligence Community UI Kit canary web components","MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree","LOW",2.3,"2026-10-19",0],["CVE-2026-112288","krayin","laravel-crm","Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding","LOW",2.1,"2026-10-19",0],["CVE-2026-112287","krayin","laravel-crm","Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module","HIGH",7.1,"2026-10-19",0],["CVE-2026-112285","Thelia","Thelia","Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112286","krayin","laravel-crm","Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints","HIGH",7.1,"2026-10-19",0],["CVE-2026-112284","xqq","libaribcaption","libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-112282","VideoLAN","libbluray","VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-112283","VideoLAN","libbluray","libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-112281","nkoriyama","aribb24","libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112280","nkoriyama","aribb24","libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112278","rdesktop","rdesktop","rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache","HIGH",7.1,"2026-10-19",0],["CVE-2026-112279","rdesktop","rdesktop","rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2","HIGH",7.1,"2026-10-19",0],["CVE-2026-112277","rdesktop","rdesktop","rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane","HIGH",7.1,"2026-10-19",0],["CVE-2026-112275","Netpbm","Netpbm","Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112276","Netpbm","Netpbm","Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112274","libtins","libtins","libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112272","emersion","libdisplay-info","libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-112273","libtins","libtins","libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112271","emersion","libdisplay-info","libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-112270","sgl-project","sglang","SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx","HIGH",7.1,"2026-10-19",0],["CVE-2026-112268","sgl-project","sglang-router","sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112269","sgl-project","sglang","SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations","HIGH",7.1,"2026-10-19",0],["CVE-2026-112267","sgl-project","sglang","SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112265","langbot-app","LangBot","LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification","HIGH",8.3,"2026-10-19",0],["CVE-2026-112266","sgl-project","sglang","SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching","HIGH",8.2,"2026-10-19",0],["CVE-2026-112264","bentoml","BentoML","BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys","HIGH",8.5,"2026-10-19",0],["CVE-2026-112262","risingwavelabs","risingwave","RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors","HIGH",7.1,"2026-10-19",0],["CVE-2026-112263","alexpasmantier","television","Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting","HIGH",8.5,"2026-10-19",0],["CVE-2026-111939","frappe","helpdesk","Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-111938","frappe","crm","Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111936","aleksey-hoffman","Sigma File Manager","Sigma File Manager through 2.2.0 SSRF via Extension Download Commands","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111937","frappe","crm","Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111935","codexu","NoteGen","NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis","LOW",2.1,"2026-10-19",0],["CVE-2026-111915","purocean","Yank Note","Yank Note before 3.93.1 Path Traversal via /api/help Endpoint","HIGH",8.2,"2026-10-19",0],["CVE-2026-111925","Mopidy","Mopidy","Mopidy before 4.0.5 Path Traversal via File Backend library.lookup","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111899","TomBursch","kitchenowl","KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-111883","locustio","locust","Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112145","speaches-ai","speaches","speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDi","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112144","satya-vinay","Events-Management-System","satya-vinay Events-Management-System project.sql file access","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111828","Mamunur Rashid","Classified Listing","WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-112222","Surfer","Surfer","WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-19",0],["CVE-2026-111829","WP Mailster","WP Mailster","WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-110902","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulner","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-110008","@fastify/oauth2","@fastify/oauth2","@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback","MEDIUM",4.2,"2026-10-19",0],["CVE-2026-112143","satya-vinay","Events-Management-System","satya-vinay Events-Management-System missing authentication","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-8168","qt","qt","Denial-of-service vulnerability in the SVG parser and renderer impacts Qt","HIGH",7.1,"2026-10-19",0],["CVE-2026-112142","satya-vinay","Events-Management-System","satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111845","YITH","YITH WooCommerce Product Bundles","WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulner","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112141","satya-vinay","Events-Management-System","satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injecti","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111831","WP ManageNinja LLC","FluentForm","WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-110363","ThimPress","LearnPress","WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-19",0],["CVE-2026-111836","WP ManageNinja LLC","FluentCommunity","WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-111414","Crocoblock","JetElements For Elementor","WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-111410","E2Pdf.com","e2pdf","WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-112214","Red Hat","Red Hat Enterprise Linux 10","Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-103314","Red Hat","Red Hat Advanced Cluster Security for Kubernetes 4.11","Stackrox: stackrox: saml response replay allows multiple central authentication tokens","HIGH",7.4,"2026-10-19",0],["CVE-2026-111839","VideoWhisper.com","Broadcast Live Video","WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112199","YITH","YITH WooCommerce Wishlist","WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerab","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-112140","llSourcell","Doctor-Dignity","llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112139","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql ","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112210","Red Hat","Red Hat Enterprise Linux 10","Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service","MEDIUM",6,"2026-10-19",0],["CVE-2026-112138","diem-project","diem","diem-project diem dmCodeEditor actions.class.php join path traversal","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112108","ztxz16","fastllm","ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-88900","Apache Software Foundation","Apache Camel","Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup","HIGH",8.8,"2026-10-19",0],["CVE-2026-112107","ztxz16","fastllm","ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-91858","Apache Software Foundation","Apache Camel","Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-112106","TufayelLUS","TikTok-Video-Downloader-PHP","TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-88901","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d","HIGH",8.2,"2026-10-19",0],["CVE-2026-85317","Apache Software Foundation","Apache Camel","Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-85316","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-85315","Apache Software Foundation","Apache Camel","Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-85314","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-85313","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-85312","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Acti","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-85300","Apache Software Foundation","Apache Camel","Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File ","MEDIUM",5.5,"2026-10-19",0],["CVE-2026-85301","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omit","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-85296","Apache Software Foundation","Apache Camel","Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-85260","Apache Software Foundation","Apache Camel","Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default","MEDIUM",5.5,"2026-10-19",0],["CVE-2026-85257","Apache Software Foundation","Apache Camel","Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-85254","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name ","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-71253","Apache Software Foundation","Apache Johnzon","Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from unt","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-85251","Apache Software Foundation","Apache Camel","Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets","HIGH",7.5,"2026-10-19",0],["CVE-2026-85250","Apache Software Foundation","Apache Camel","Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum","HIGH",7.5,"2026-10-19",0],["CVE-2026-85249","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-85248","Apache Software Foundation","Apache Camel","Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signatur","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-85247","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a ","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-85246","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-85245","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Tar","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-85243","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Me","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-84181","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Sub","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-84180","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-84178","Apache Software Foundation","Apache Camel","Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in th","MEDIUM",6.1,"2026-10-19",0],["CVE-2026-112105","GlitterWare","Passy","GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-84176","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-83531","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie","HIGH",8.8,"2026-10-19",0],["CVE-2026-80344","Apache Software Foundation","Apache Camel","Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro","HIGH",8.2,"2026-10-19",0],["CVE-2026-80343","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path ","HIGH",8.2,"2026-10-19",0],["CVE-2026-80312","Apache Software Foundation","Apache Camel","Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors","HIGH",8.2,"2026-10-19",0],["CVE-2026-79986","Apache Software Foundation","Apache Camel","Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re","HIGH",7.4,"2026-10-19",0],["CVE-2026-79985","Apache Software Foundation","Apache Camel","Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i","HIGH",7.4,"2026-10-19",0],["CVE-2026-79984","Apache Software Foundation","Apache Camel","Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo","HIGH",7.4,"2026-10-19",0],["CVE-2026-112104","eremef","bandcamp-player","eremef bandcamp-player Remote Control Server database.ts missing authentication","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-79983","Apache Software Foundation","Apache Camel","Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i","HIGH",7.4,"2026-10-19",0],["CVE-2026-78165","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads","HIGH",8.8,"2026-10-19",0],["CVE-2026-78164","Apache Software Foundation","Apache Camel","Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid","HIGH",8.2,"2026-10-19",0],["CVE-2026-78163","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Requ","MEDIUM",5.9,"2026-10-19",0],["CVE-2026-78162","Apache Software Foundation","Apache Camel","Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom","CRITICAL",10,"2026-10-19",0],["CVE-2026-112103","f3-factory","fatfree-core","f3-factory fatfree-core HTTP Client web.php _curl certificate validation","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112102","AXA Group","NLP.js","AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code in","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-90910","Apache Software Foundation","Apache Answer","Apache Answer: Reaction API authorization bypass for restricted content","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-86589","Apache Software Foundation","Apache Answer","Apache Answer: User Center integration does not revoke first-login sessions after central ","","","2026-10-19",0],["CVE-2026-79633","Apache Software Foundation","Apache Answer","Apache Answer: Missing Authorization Allows Mutations of Non-Public Content","","","2026-10-19",0],["CVE-2026-79624","Apache Software Foundation","Apache Answer","Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocatio","","","2026-10-19",0],["CVE-2026-79620","Apache Software Foundation","Apache Answer","Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata","","","2026-10-19",0],["CVE-2026-79613","Apache Software Foundation","Apache Answer","Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles","","","2026-10-19",0],["CVE-2026-76994","Apache Software Foundation","Apache Answer","Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles","","","2026-10-19",0],["CVE-2026-71563","Apache Software Foundation","Apache Answer","Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-68482","Apache Software Foundation","Apache Answer","Apache Answer: Improper Authorization in Question Invite User Lookup","","","2026-10-19",0],["CVE-2026-67249","Apache Software Foundation","Apache Answer","Apache Answer: Email Code Purpose Confusion May Allow Account Takeover","","","2026-10-19",0],["CVE-2026-64945","Apache Software Foundation","Apache Answer","Apache Answer: Incorrect permission mapping allows users with only the unpin permission to","","","2026-10-19",0],["CVE-2026-112101","BlackBeltTechnology","pi-agent-dashboard","BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112192","MISP","MISP","MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-64944","Apache Software Foundation","Apache Answer","Apache Answer: Stored XSS via unsanitized HTML in imported question content","","","2026-10-19",0],["CVE-2026-64943","Apache Software Foundation","Apache Answer","Apache Answer: API keys logged in plaintext during authentication","HIGH",8.1,"2026-10-19",0],["CVE-2026-112188","MISP","MISP","MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio","HIGH",7.1,"2026-10-19",0],["CVE-2026-108837","Apache Software Foundation","Apache Kylin","Apache Kylin: Potential computed-column resource exhaustion","","","2026-10-19",0],["CVE-2026-108833","Apache Software Foundation","Apache Kylin","Apache Kylin: default startup profile miss security settings","","","2026-10-19",0],["CVE-2026-108823","Apache Software Foundation","Apache Kylin","Apache Kylin: Potential unauthenticated job metadata replacement","","","2026-10-19",0],["CVE-2026-108780","Apache Software Foundation","Apache Kylin","Apache Kylin: Potential JDBC source configuration validation issue","","","2026-10-19",0],["CVE-2026-108776","Apache Software Foundation","Apache Kylin","Apache Kylin: tables/names SparkSQL injection","","","2026-10-19",0],["CVE-2026-108771","Apache Software Foundation","Apache Kylin","Apache Kylin: unauthenticated broadcast API and polymorphic deserialization","","","2026-10-19",0],["CVE-2026-108766","Apache Software Foundation","Apache Kylin","Apache Kylin: missing JDBC-config authorization","","","2026-10-19",0],["CVE-2026-112184","MISP","MISP","MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-108764","Apache Software Foundation","Apache Kylin","Apache Kylin: job-driver UI proxy SSRF","","","2026-10-19",0],["CVE-2026-108762","Apache Software Foundation","Apache Kylin","Apache Kylin: delete metadata backup path-confinement bypass","","","2026-10-19",0],["CVE-2026-112183","MISP","MISP","MISP CSS Injection via Remote Tag Colour in Event Preview","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-112100","","DeepPavlov","DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-110887","HivePress","HivePress","WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability","CRITICAL",9.9,"2026-10-19",0],["CVE-2026-110898","WPDeveloper","Essential Addons for Elementor","WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerabil","MEDIUM",6.4,"2026-10-19",0],["CVE-2026-111398","PT Norther Lights Production","MapSVG","WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability","HIGH",7.7,"2026-10-19",0],["CVE-2026-111407","Themeum","Tutor LMS","WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-110379","Ays Pro","Quiz Maker","WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-19",0],["CVE-2026-111406","PT Norther Lights Production","MapSVG","WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-19",0],["CVE-2026-111408","ExpressTech","Quiz And Survey Master","WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-19",0],["CVE-2026-112098","","DeepPavlov","DeepPavlov Config Reference Resolver params.py resolve code injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112180","MISP","MISP","MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112179","MISP","MISP","MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112178","MISP","MISP","MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C","HIGH",7.1,"2026-10-19",0],["CVE-2026-112097","SourceCodester","Inventory System","SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross ","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-13695","Integratec","Integratec","SQL Injection in the Integratec Application","HIGH",8.8,"2026-10-19",0],["CVE-2026-104679","Yamaha Corporation","VOCALOID6 Editor","VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity r","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112096","SourceCodester","Inventory System","SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cr","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112161","Mobatek","MobaXterm","Lack of integrity checks in Mobatek’s MobaXterm","HIGH",8.5,"2026-10-19",0],["CVE-2026-112095","SourceCodester","Inventory System","SourceCodester Inventory System Product Management products_handler.php save cross site sc","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-111438","openGauss-server","openGauss-server","check_hba_replication 认证与访问控制绕过","MEDIUM",6.5,"2026-10-19",0],["CVE-2026-112094","michaelrsweet","mxml","michaelrsweet mxml mxml-file.c mxml_load_data use after free","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-111439","openGauss-server","openGauss-server","pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-112093","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system feedback.php cross site scripting","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112092","subhajitkhan","online-clinic-management-system","subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php ec","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112091","Dav-ee","dairy-management-system","Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112090","Dav-ee","dairy-management-system","Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94294","","App Builder","App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.ph","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94272","","Snap Finance","Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple A","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94230","","TrueBooker","TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbit","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94231","","TrueBooker","TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creati","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94229","","TrueBooker","TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-91831","","Subscribe to Comments","Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting","LOW",3.8,"2026-10-19",0],["CVE-2026-94228","","TrueBooker","TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite v","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-74922","","Document Gallery","Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber ","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-86791","","iPOSpays Payment Gateway for WooCommerce","iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Fo","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-74921","","Document Gallery","Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-106010","","BDM Digital Payment Gateway","BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-110034","","Salon Booking System","Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code","LOW",3.7,"2026-10-19",0],["CVE-2026-103311","","Coinbase Commerce Payment Gateway for WooCommerce","Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signa","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112089","Dav-ee","dairy-management-system","Dav-ee dairy-management-system delete.php mysqli_query sql injection","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-16460","Red Hat","Red Hat Enterprise Linux 10","Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signatur","HIGH",7.4,"2026-10-19",0],["CVE-2026-112088","Dav-ee","dairy-management-system","Dav-ee dairy-management-system add.php mysqli_query sql injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-76740","Hewlett Packard Enterprise","HPE Compute Scale-up Server 3200 platform","HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280","HIGH",7.2,"2026-10-19",0],["CVE-2026-112087","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System confirm.php sql injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112086","","ESPnet","ESPnet Inference Model inference_model.py build_model deserialization","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-94273","","Snap Finance","Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_com","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-106014","","Gateway for Vantiv on WC","Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment C","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-106933","","Blaze Demo Importer","Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload","MEDIUM",6.8,"2026-10-19",0],["CVE-2026-89286","","FormFlow for GoHighLevel (GHL)","FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-91046","","ElementsReady Addons for Elementor","ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Mi","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-91047","","ElementsReady Addons for Elementor","ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass ","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-106028","","ActiveTrail for WooCommerce","ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-76739","Hewlett Packard Enterprise","HPE Compute Scale-up Server 3200 platform","HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC ","MEDIUM",4.3,"2026-10-19",0],["CVE-2026-112083","sgl-project","SGLang","sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remot","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112082","sgl-project","SGLang","sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler","HIGH",8.7,"2026-10-19",0],["CVE-2026-112081","hankcs","HanLP","hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-108120","koozali","SME Server","path traversal inKoozali - SME Server","HIGH",7.7,"2026-10-19",0],["CVE-2026-108121","Koozali","SME Server","Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Servi","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112080","LlamaChinese","Llama-Chinese","LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_m","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112079","hankcs","HanLP","hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112078","RVC-Project","Retrieval-based-Voice-Conversion-WebUI","RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112077","radareorg","radare2","radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechan","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112076","alexta69","MeTube","alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-111440","openGauss-server","openGauss-connector-jdbc","JDBC LogFactory 任意类加载/构造导致潜在 RCE","HIGH",7,"2026-10-19",0],["CVE-2026-112075","unslothai","unsloth","unslothai unsloth sentence_transformer.py externally-controlled input to select classes or","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112074","Tencent","ncnn","Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112073","Tencent","ncnn","Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112045","","donetick","donetick History Deletion model.go CanDeleteHistory improper authorization","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112044","dotnet","eShop","dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-111441","openGauss-server","openGauss-server","HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写","HIGH",8.1,"2026-10-19",0],["CVE-2026-112043","calcom","cal.com","calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-103091","Google","SAM","Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-102503","Google","SAM","Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)","CRITICAL",9.3,"2026-10-19",0],["CVE-2026-112042","diem-project","diem","diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112041","diem-project","diem","diem-project diem dmString.php random weak prng","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112040","diem-project","diem","diem-project diem Sign-In BasedmUserActions.class.php redirect","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112039","diem-project","diem","diem-project diem Administrative Console actions.class.php append cross site scripting","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-112038","diem-project","diem","diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting","MEDIUM",4.8,"2026-10-19",0],["CVE-2026-112037","diem-project","diem","diem-project diem Google Analytics Client gapi.class.php certificate validation","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-108984","GeoVision Inc.","GV-ASManager","GV-ASManager Web Server Buffer Overflow Vulnerability","HIGH",7.5,"2026-10-19",0],["CVE-2026-108983","GeoVision Inc.","GV-ASManager","GV-ASManager Web Server Command Injection Vulnerability","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-112036","Artifex","MuPDF","Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112035","aircheng-org","iWebShop-5","aircheng-org iWebShop-5 simple.php send_message_mobile password recovery","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112034","aircheng-org","iWebShop-5","aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112033","aircheng-org","iWebShop-5","aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forg","MEDIUM",5.3,"2026-10-19",0],["CVE-2025-52290","","","A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg ve","HIGH",7.5,"2026-10-19",0],["CVE-2025-55654","","","A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GP","MEDIUM",5.5,"2026-10-19",0],["CVE-2025-55667","","","A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Bo","MEDIUM",5.5,"2026-10-19",0],["CVE-2025-60480","","","A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c","MEDIUM",5.5,"2026-10-19",0],["CVE-2025-60482","","","A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GP","","","2026-10-19",0],["CVE-2026-107081","","","SQL injection via identifier injection in the tableName and tableFields POST parameters of","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-107082","","","Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff us","HIGH",8.8,"2026-10-19",0],["CVE-2026-107083","","","SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQ","CRITICAL",9.8,"2026-10-19",0],["CVE-2026-107084","","","Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forger","","","2026-10-19",0],["CVE-2026-38671","","","Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (S","MEDIUM",6.1,"2026-10-19",0],["CVE-2026-112032","aircheng-org","iWebShop-5","aircheng-org iWebShop-5 util.php search sql injection","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112031","Chamilo","LMS","Chamilo LMS Ticket TicketManager.php addProject cross site scripting","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112030","diem-project","diem","diem-project diem dmDataLoad.php default password","MEDIUM",5.3,"2026-10-19",0],["CVE-2026-112112","nic","BIRD","An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an es","LOW",2.3,"2026-10-19",0],["CVE-2026-112029","diem-project","diem","diem-project diem SHA1 PluginDmUser.class.php weak password hash","LOW",2,"2026-10-19",0],["CVE-2026-112028","light0011","cms","light0011 cms Vote VoteController.class.php logic error","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112111","Bootstrap Shortcodes project","Bootstrap Shortcodes","The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via","MEDIUM",5.1,"2026-10-19",0],["CVE-2026-112027","light0011","cms","light0011 cms Uploadify check-exists.php file_exists file information disclosure","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-112026","light0011","cms","light0011 cms UserModel.class.php sha1 weak password hash","MEDIUM",6.3,"2026-10-19",0],["CVE-2026-112025","light0011","cms","light0011 cms Captcha Validation UserController.class.php access control","MEDIUM",6.9,"2026-10-19",0],["CVE-2026-97859","Gitea","Gitea","Gitea API disclosure of private user social graph, keys and stars","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-97204","Gitea","Gitea","Gitea label deletion across repository and organization IDs","LOW",3.1,"2026-10-18",0],["CVE-2026-110494","Gitea","Gitea","Gitea release attachment re-linking of issue attachments","MEDIUM",6.3,"2026-10-18",0],["CVE-2026-110324","Gitea","Gitea","Gitea private profile information disclosure through POST request","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-110311","Gitea","Gitea","Gitea draft release creation disclosing attachment metadata","MEDIUM",4.3,"2026-10-18",0],["CVE-2026-109844","Gitea","Gitea","Gitea watched repositories API disclosure after access revocation","MEDIUM",4.3,"2026-10-18",0],["CVE-2026-107686","Gitea","Gitea","Gitea reactions accepted on locked issues and comments","MEDIUM",4.3,"2026-10-18",0],["CVE-2026-107618","Gitea","Gitea","Gitea cross-site request forgery on repository topics","","","2026-10-18",0],["CVE-2026-105964","Gitea","Gitea","Gitea Actions artifact v4 API unbounded request body","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-105661","Gitea","Gitea","Gitea panic on the repositories route of individual users","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-109553","Gitea","Gitea","Gitea SSH certificate principal impersonation of other users","HIGH",7.5,"2026-10-18",0],["CVE-2026-104627","Gitea","Gitea","Gitea OpenID account linking without session binding","MEDIUM",5.4,"2026-10-18",0],["CVE-2024-4457","WSO2","WSO2 Enterprise Integrator","Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows A","CRITICAL",9.1,"2026-10-18",0],["CVE-2026-111993","Soarkey","StudentManagement","Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage","MEDIUM",4.8,"2026-10-18",0],["CVE-2026-111992","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-98868","Linux","Linux","dm-pcache: reject a kset that overruns its segment","","","2026-10-18",0],["CVE-2026-98867","Linux","Linux","dm-pcache: bound the logical key offset from persistent memory","","","2026-10-18",0],["CVE-2026-98866","Linux","Linux","sched/cache: Introduce task_struct->sched_cache_grp to fix UAF","","","2026-10-18",0],["CVE-2026-98865","Linux","Linux","sched_ext: Don't run ops.dequeue() with a DSQ lock held","","","2026-10-18",0],["CVE-2026-98864","Linux","Linux","sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task","","","2026-10-18",0],["CVE-2026-98863","Linux","Linux","KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","","","2026-10-18",0],["CVE-2026-98862","Linux","Linux","audit: fix exe mark UAF in kill_rules()","","","2026-10-18",0],["CVE-2026-98861","Linux","Linux","fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()","","","2026-10-18",0],["CVE-2026-98860","Linux","Linux","HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request","","","2026-10-18",0],["CVE-2026-98859","Linux","Linux","HID: multitouch: stop the release timer from being rearmed on remove","","","2026-10-18",0],["CVE-2026-98858","Linux","Linux","io_uring: fix task_work add use-after-free with SQPOLL","","","2026-10-18",0],["CVE-2026-98857","Linux","Linux","ipvs: bound LBLCR and LBLC cache growth","","","2026-10-18",0],["CVE-2026-98856","Linux","Linux","kprobes: Skip disarmed probes when checking optkprobe overlap","","","2026-10-18",0],["CVE-2026-98855","Linux","Linux","of/overlay: put property on deadprops only after changeset add succeeds","","","2026-10-18",0],["CVE-2026-98854","Linux","Linux","of/overlay: only treat a positive changeset id as registered","","","2026-10-18",0],["CVE-2026-98853","Linux","Linux","net: gso: limit recursive IP-in-IP segmentation","","","2026-10-18",0],["CVE-2026-98852","Linux","Linux","net: extend IPv6 exthdr detection of tunneled packets","","","2026-10-18",0],["CVE-2026-98850","Linux","Linux","net/packet: prevent TX_RING byte count overflow","","","2026-10-18",0],["CVE-2026-98851","Linux","Linux","netfilter: nft_flow_offload: drop flowtable reference on init error path","","","2026-10-18",0],["CVE-2026-98849","Linux","Linux","pfcp: fix socket lifetime on netdevice registration failure","","","2026-10-18",0],["CVE-2026-98848","Linux","Linux","rtc: ac100: Assign .num before accessing .hws","","","2026-10-18",0],["CVE-2026-98847","Linux","Linux","rtc: spear: initialize IRQ state before requesting alarm IRQ","","","2026-10-18",0],["CVE-2026-98846","Linux","Linux","sctp: check RCV_SHUTDOWN after the sendmsg connect wait","","","2026-10-18",0],["CVE-2026-98845","Linux","Linux","tpm: Disable TPM on null key name mismatch","","","2026-10-18",0],["CVE-2026-98844","Linux","Linux","netfs: clear post-EOF pagecache when extending a file via write","","","2026-10-18",0],["CVE-2026-98843","Linux","Linux","netfs: zero gaps in read-gaps folio to avoid writing back stale data","","","2026-10-18",0],["CVE-2026-98842","Linux","Linux","module: fix lost error code from codetag_load_module()","","","2026-10-18",0],["CVE-2026-98841","Linux","Linux","virt: vmgenid: set driver_data before registering notification handlers","","","2026-10-18",0],["CVE-2026-98840","Linux","Linux","vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF","","","2026-10-18",0],["CVE-2026-98839","Linux","Linux","vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","","","2026-10-18",0],["CVE-2026-98838","Linux","Linux","vt: skip screen update for DEC alignment test on backgroup consoles","","","2026-10-18",0],["CVE-2026-98837","Linux","Linux","ALSA: caiaq: unregister the input device when probe fails","","","2026-10-18",0],["CVE-2026-98836","Linux","Linux","ALSA: line6: reject oversized playback packets","","","2026-10-18",0],["CVE-2026-98835","Linux","Linux","iio: accel: kionix-kx022a: Fix array boundary check","","","2026-10-18",0],["CVE-2026-98834","Linux","Linux","mtd: core: avoid double-free of OTP NVMEM device","","","2026-10-18",0],["CVE-2026-98833","Linux","Linux","mtd: core: call _get_device() with the master MTD","","","2026-10-18",0],["CVE-2026-98832","Linux","Linux","blk-cgroup: save IRQ state in blkg_tryget_closest()","","","2026-10-18",0],["CVE-2026-98831","Linux","Linux","of/overlay: don't leak fragment references when changeset init fails","","","2026-10-18",0],["CVE-2026-98830","Linux","Linux","wifi: wfx: validate MIB read length before copying to caller","","","2026-10-18",0],["CVE-2026-98829","Linux","Linux","wifi: mac80211: drop oversized fragments to avoid extra_len overflow","","","2026-10-18",0],["CVE-2026-98828","Linux","Linux","wifi: ath9k: reject short WMI command responses","","","2026-10-18",0],["CVE-2026-98827","Linux","Linux","wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","","","2026-10-18",0],["CVE-2026-98826","Linux","Linux","rtc: ac100: Fix clock provider use-after-free on probe failure","","","2026-10-18",0],["CVE-2026-98825","Linux","Linux","rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()","","","2026-10-18",0],["CVE-2026-98824","Linux","Linux","wifi: mac80211: validate TX status rate metadata","","","2026-10-18",0],["CVE-2026-98823","Linux","Linux","wifi: cfg80211: preserve hidden-group beacon IE ownership","","","2026-10-18",0],["CVE-2026-98822","Linux","Linux","wifi: mac80211: prevent AP VLAN tx from other interfaces","","","2026-10-18",0],["CVE-2026-98821","Linux","Linux","block: reject polled dio with user integrity metadata","","","2026-10-18",0],["CVE-2026-98820","Linux","Linux","blk-mq: set RQF_USE_SCHED when the operation is known","","","2026-10-18",0],["CVE-2026-98819","Linux","Linux","Bluetooth: btintel: validate DDC record lengths","","","2026-10-18",0],["CVE-2026-98818","Linux","Linux","mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","","","2026-10-18",0],["CVE-2026-98817","Linux","Linux","ASoC: SDCA: Add better pm_runtime error handling in func probe","","","2026-10-18",0],["CVE-2026-98816","Linux","Linux","bpf: Fix overflow of jump offset in constant blinding","","","2026-10-18",0],["CVE-2026-98815","Linux","Linux","nvme: fix cdev lifetime","","","2026-10-18",0],["CVE-2026-98814","Linux","Linux","nvme: fix command effects log lifetime for multipath heads","","","2026-10-18",0],["CVE-2026-98813","Linux","Linux","bpf: Hold map BTF for the memory allocator destructor record","","","2026-10-18",0],["CVE-2026-98812","Linux","Linux","net/mctp: publish the mctp_dev only after it is initialised","","","2026-10-18",0],["CVE-2026-98811","Linux","Linux","net/sched: cls_api: reclaim an empty proto on the error path","","","2026-10-18",0],["CVE-2026-98810","Linux","Linux","wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","","","2026-10-18",0],["CVE-2026-98808","Linux","Linux","net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","","","2026-10-18",0],["CVE-2026-98809","Linux","Linux","Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister","","","2026-10-18",0],["CVE-2026-98807","Linux","Linux","net/mlx5: Fix slab-out-of-bounds when handling team device events","","","2026-10-18",0],["CVE-2026-98806","Linux","Linux","octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","","","2026-10-18",0],["CVE-2026-98804","Linux","Linux","net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()","","","2026-10-18",0],["CVE-2026-98805","Linux","Linux","tipc: prevent GCM nonce reuse on peer key changes","","","2026-10-18",0],["CVE-2026-98803","Linux","Linux","net: stmmac: fix rx Scatter-Gather support","","","2026-10-18",0],["CVE-2026-98802","Linux","Linux","seg6: ensure packet data is writable before modifying SRH and IPv6 DA","","","2026-10-18",0],["CVE-2026-98801","Linux","Linux","net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","","","2026-10-18",0],["CVE-2026-98800","Linux","Linux","bpf: Wait for an RCU tasks grace period before freeing trampoline progs","","","2026-10-18",0],["CVE-2026-98799","Linux","Linux","bpf: Skip detached progs in trampoline images that are still in use","","","2026-10-18",0],["CVE-2026-98798","Linux","Linux","net: bcmgenet: fix NULL dereference in set_coalesce before first open","","","2026-10-18",0],["CVE-2026-98797","Linux","Linux","net: cap skb->queue_mapping when the tx queue is picked","","","2026-10-18",0],["CVE-2026-98796","Linux","Linux","net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","","","2026-10-18",0],["CVE-2026-98795","Linux","Linux","net: sparx5: skip ptp deinit if init was skipped","","","2026-10-18",0],["CVE-2026-98794","Linux","Linux","ipvs: filter some flags received in the backup server","","","2026-10-18",0],["CVE-2026-98793","Linux","Linux","netfilter: bpf: reject invalid NAT manipulation types","","","2026-10-18",0],["CVE-2026-98792","Linux","Linux","netfilter: flowtable: generalize pending status bit","","","2026-10-18",0],["CVE-2026-98791","Linux","Linux","net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference","","","2026-10-18",0],["CVE-2026-98790","Linux","Linux","perf: Fix race between perf_event_exit_task() and perf_pending_task()","","","2026-10-18",0],["CVE-2026-98789","Linux","Linux","bpf: Fix objects stuck in free_by_rcu_ttrace","","","2026-10-18",0],["CVE-2026-98788","Linux","Linux","futex: Fix private hash use-after-free on resize","","","2026-10-18",0],["CVE-2026-98787","Linux","Linux","bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()","","","2026-10-18",0],["CVE-2026-98785","Linux","Linux","drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend","","","2026-10-18",0],["CVE-2026-98786","Linux","Linux","drm/amd/display: guard dc_sink dereferences in MST mode validation","","","2026-10-18",0],["CVE-2026-98784","Linux","Linux","drm/amdgpu/gfx6: fix firmware leak on teardown","","","2026-10-18",0],["CVE-2026-98783","Linux","Linux","drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device","","","2026-10-18",0],["CVE-2026-98782","Linux","Linux","drm/mediatek: Fix ovl adaptor platform device leak","","","2026-10-18",0],["CVE-2026-98781","Linux","Linux","drm/mediatek: Fix pdev reference leak in mtk_drm_bind()","","","2026-10-18",0],["CVE-2026-98780","Linux","Linux","drm/amdgpu: fix IP instance memory leak on kobject add failure","","","2026-10-18",0],["CVE-2026-98779","Linux","Linux","drm/amdgpu: fix ACP MFD device leak on init failure","","","2026-10-18",0],["CVE-2026-98778","Linux","Linux","binder: fix is_failure flag for superseded transaction cleanup","","","2026-10-18",0],["CVE-2026-98777","Linux","Linux","binder: fix leaked fd fixups on TF_UPDATE_TXN supersede","","","2026-10-18",0],["CVE-2026-98776","Linux","Linux","binderfs: fix UAF write in binder_add_device","","","2026-10-18",0],["CVE-2026-98775","Linux","Linux","nitro_enclaves: fix use-after-free on SLOT_ALLOC failure","","","2026-10-18",0],["CVE-2026-98773","Linux","Linux","USB: cdc-acm: skip URB restart in port_shutdown if disconnected","","","2026-10-18",0],["CVE-2026-98774","Linux","Linux","rust_binder: cancel deferred work items in thread exit","","","2026-10-18",0],["CVE-2026-98772","Linux","Linux","USB: serial: fix port tear down use-after-free","","","2026-10-18",0],["CVE-2026-98771","Linux","Linux","usb: storage: sierra_ms: reject short SWoC info transfers","","","2026-10-18",0],["CVE-2026-98770","Linux","Linux","usb: gadget: midi2: Fix the jack descriptor array sizes","","","2026-10-18",0],["CVE-2026-98769","Linux","Linux","usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd","","","2026-10-18",0],["CVE-2026-98768","Linux","Linux","usb: typec: anx7411 - stop the IRQ before destroying the workqueue","","","2026-10-18",0],["CVE-2026-98767","Linux","Linux","usb: dwc3: gadget: fix IRQ storm on invalid event buffer count","","","2026-10-18",0],["CVE-2026-98766","Linux","Linux","usb: gadget: aspeed-vhub: cancel wake work on device removal","","","2026-10-18",0],["CVE-2026-98765","Linux","Linux","USB: gadget: dummy-hcd: Fix wait for outstanding request completions","","","2026-10-18",0],["CVE-2026-98764","Linux","Linux","usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC","","","2026-10-18",0],["CVE-2026-98763","Linux","Linux","usb: core: clear both ep_in and ep_out for non-ep0 control endpoints","","","2026-10-18",0],["CVE-2026-98762","Linux","Linux","USB: dwc2: shut down wakeup timer before freeing HCD state","","","2026-10-18",0],["CVE-2026-98761","Linux","Linux","usb: typec: tcpm: recover after failure to start the frs ams","","","2026-10-18",0],["CVE-2026-98760","Linux","Linux","usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()","","","2026-10-18",0],["CVE-2026-98759","Linux","Linux","usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()","","","2026-10-18",0],["CVE-2026-98758","Linux","Linux","usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","","","2026-10-18",0],["CVE-2026-98757","Linux","Linux","usb: cdns3: fix use-after-free in cdns3_gadget_exit()","","","2026-10-18",0],["CVE-2026-98756","Linux","Linux","usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","","","2026-10-18",0],["CVE-2026-98755","Linux","Linux","tty: vcc: zero-initialize control packet in vcc_send_ctl()","","","2026-10-18",0],["CVE-2026-98754","Linux","Linux","tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup","","","2026-10-18",0],["CVE-2026-98753","Linux","Linux","tty: tty_port: restore TTY_IO_ERROR on activation failure","","","2026-10-18",0],["CVE-2026-98751","Linux","Linux","tty: abort break signalling on hangup","","","2026-10-18",0],["CVE-2026-98752","Linux","Linux","tty: port: fix tty_port_tty_vhangup() race","","","2026-10-18",0],["CVE-2026-98750","Linux","Linux","tty: fix saved termios reset race","","","2026-10-18",0],["CVE-2026-98749","Linux","Linux","tty: serial: max3100: shut down timer before freeing port","","","2026-10-18",0],["CVE-2026-98748","Linux","Linux","serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()","","","2026-10-18",0],["CVE-2026-98747","Linux","Linux","serial: core: fix NULL pointer dereference in serial_core_unregister_port()","","","2026-10-18",0],["CVE-2026-98746","Linux","Linux","serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()","","","2026-10-18",0],["CVE-2026-98745","Linux","Linux","arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems","","","2026-10-18",0],["CVE-2026-98744","Linux","Linux","ASoC: codecs: max98363: fix uninitialized stream_config->type","","","2026-10-18",0],["CVE-2026-98743","Linux","Linux","ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type","","","2026-10-18",0],["CVE-2026-98742","Linux","Linux","ALSA: seq: Serialize compat port-info ioctls","","","2026-10-18",0],["CVE-2026-98741","Linux","Linux","ALSA: ua101: reject mismatched capture/playback packet sizes","","","2026-10-18",0],["CVE-2026-98740","Linux","Linux","EDAC/altera: Drop __init from ECC setup paths for re-probe safety","","","2026-10-18",0],["CVE-2026-98739","Linux","Linux","Bluetooth: RFCOMM: Fix initial port reference race","","","2026-10-18",0],["CVE-2026-98738","Linux","Linux","Bluetooth: Serialize SMP remote OOB data access","","","2026-10-18",0],["CVE-2026-98736","Linux","Linux","Bluetooth: hci_conn: Lock parent access during enhanced SCO setup","","","2026-10-18",0],["CVE-2026-98737","Linux","Linux","Bluetooth: hci_sync: Fix inquiry cache use-after-free","","","2026-10-18",0],["CVE-2026-98735","Linux","Linux","Bluetooth: hci_core: Serialize ACL scheduling with channel deletion","","","2026-10-18",0],["CVE-2026-98734","Linux","Linux","Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","","","2026-10-18",0],["CVE-2026-98733","Linux","Linux","Bluetooth: hci_core: Serialize fragmented ISO packet queueing","","","2026-10-18",0],["CVE-2026-98732","Linux","Linux","Bluetooth: btintel: fix buffer over-read in btintel_hw_error()","","","2026-10-18",0],["CVE-2026-98731","Linux","Linux","Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()","","","2026-10-18",0],["CVE-2026-98730","Linux","Linux","Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()","","","2026-10-18",0],["CVE-2026-98729","Linux","Linux","x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h","","","2026-10-18",0],["CVE-2026-98728","Linux","Linux","tpm: fix off-by-four bounds check in tpm2_get_random()","","","2026-10-18",0],["CVE-2026-98727","Linux","Linux","nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known","","","2026-10-18",0],["CVE-2026-98726","Linux","Linux","nvme-multipath: fix underflow in ANA log bounds checks","","","2026-10-18",0],["CVE-2026-98725","Linux","Linux","nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","","","2026-10-18",0],["CVE-2026-98724","Linux","Linux","nvmet: pci-epf: reject too-short SGL segments","","","2026-10-18",0],["CVE-2026-98723","Linux","Linux","nvmet: copy the hostid into the ctrl before creating PR pc_refs","","","2026-10-18",0],["CVE-2026-98722","Linux","Linux","mtd: block2mtd: Fix divide error when erase_size is zero","","","2026-10-18",0],["CVE-2026-98721","Linux","Linux","mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ","","","2026-10-18",0],["CVE-2026-98720","Linux","Linux","KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","","","2026-10-18",0],["CVE-2026-98719","Linux","Linux","KVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it","","","2026-10-18",0],["CVE-2026-98718","Linux","Linux","KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state","","","2026-10-18",0],["CVE-2026-98717","Linux","Linux","KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy","","","2026-10-18",0],["CVE-2026-98716","Linux","Linux","KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted","","","2026-10-18",0],["CVE-2026-98714","Linux","Linux","KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","","","2026-10-18",0],["CVE-2026-98715","Linux","Linux","KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","","","2026-10-18",0],["CVE-2026-98713","Linux","Linux","KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT","","","2026-10-18",0],["CVE-2026-98711","Linux","Linux","wifi: cw1200: fix TX padding OOB read leaking heap data to device","","","2026-10-18",0],["CVE-2026-98712","Linux","Linux","KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq","","","2026-10-18",0],["CVE-2026-98710","Linux","Linux","wifi: iwlegacy: 3945: free EEPROM data on remove","","","2026-10-18",0],["CVE-2026-98709","Linux","Linux","wifi: mac80211: count only matching reservations in reserved switch","","","2026-10-18",0],["CVE-2026-98708","Linux","Linux","wifi: mac80211: keep paired old chanctx alive","","","2026-10-18",0],["CVE-2026-98707","Linux","Linux","wifi: mac80211: shut down RX BA session timer on teardown","","","2026-10-18",0],["CVE-2026-98706","Linux","Linux","wifi: mac80211: drain PS delivery work during station teardown","","","2026-10-18",0],["CVE-2026-98705","Linux","Linux","wifi: mac80211: account proxy paths against the mesh path limit","","","2026-10-18",0],["CVE-2026-98704","Linux","Linux","wifi: mac80211: keep fallback association elements alive","","","2026-10-18",0],["CVE-2026-98703","Linux","Linux","wifi: mac80211: minstrel_ht: validate fixed rate index","","","2026-10-18",0],["CVE-2026-98702","Linux","Linux","wifi: mac80211: reject invalid 320 MHz CSA bandwidth","","","2026-10-18",0],["CVE-2026-98701","Linux","Linux","wifi: mac80211: release mesh path quota on failed additions","","","2026-10-18",0],["CVE-2026-98700","Linux","Linux","wifi: mac80211: set info->band for 802.3 encap offload frames","","","2026-10-18",0],["CVE-2026-98699","Linux","Linux","wifi: mac80211: fix mesh fast xmit path deletion UAF","","","2026-10-18",0],["CVE-2026-98698","Linux","Linux","wifi: mac80211: handle empty FILS association request payload","","","2026-10-18",0],["CVE-2026-98697","Linux","Linux","USB: serial: fix dynamic id driver deregistration race","","","2026-10-18",0],["CVE-2026-98696","Linux","Linux","USB: serial: fix driver deregistration order","","","2026-10-18",0],["CVE-2026-98695","Linux","Linux","USB: serial: fix ioctl hangup race","","","2026-10-18",0],["CVE-2026-98694","Linux","Linux","thunderbolt: Fix KASAN reported use-after-free when request is canceled","","","2026-10-18",0],["CVE-2026-98693","Linux","Linux","thunderbolt: Hold a router reference for each allocated HopID","","","2026-10-18",0],["CVE-2026-98692","Linux","Linux","thunderbolt: Make the DP tunnel activation callback mandatory","","","2026-10-18",0],["CVE-2026-98691","Linux","Linux","thunderbolt: Tear down inactive DP tunnels when the domain is stopped","","","2026-10-18",0],["CVE-2026-98690","Linux","Linux","thunderbolt: Fix domain reference leak when DPRX read is canceled","","","2026-10-18",0],["CVE-2026-98689","Linux","Linux","thunderbolt: Don't access a DP tunnel after its DPRX read was canceled","","","2026-10-18",0],["CVE-2026-98688","Linux","Linux","thunderbolt: Fix NULL dereference in tb_remove_work()","","","2026-10-18",0],["CVE-2026-98687","Linux","Linux","thunderbolt: Reject oversized XDomain properties responses","","","2026-10-18",0],["CVE-2026-98686","Linux","Linux","smb: client: discard post-EOF pagecache when extending a file via zero range","","","2026-10-18",0],["CVE-2026-98685","Linux","Linux","smb: client: discard post-EOF pagecache when extending a file via clone range","","","2026-10-18",0],["CVE-2026-98684","Linux","Linux","smb: client: flush and commit data before querying allocated ranges","","","2026-10-18",0],["CVE-2026-98683","Linux","Linux","smb: client: flush dirty data before zeroing a range","","","2026-10-18",0],["CVE-2026-98682","Linux","Linux","smb: client: drain and invalidate before server-side copy/clone","","","2026-10-18",0],["CVE-2026-98681","Linux","Linux","smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races","","","2026-10-18",0],["CVE-2026-98680","Linux","Linux","iio: accel: kionix-kx022a: Prevent memory leak and fix state","","","2026-10-18",0],["CVE-2026-98679","Linux","Linux","iio: accel: kxcjk-1013: reject duplicate event disable","","","2026-10-18",0],["CVE-2026-98678","Linux","Linux","iio: adc: ad4030: fix invalid oversampling_ratio validation","","","2026-10-18",0],["CVE-2026-98677","Linux","Linux","iio: adc: ad_sigma_delta: fix use-after-free on unbind","","","2026-10-18",0],["CVE-2026-98676","Linux","Linux","iio: adc: ade9000: fix NULL pointer dereference in clkout registration","","","2026-10-18",0],["CVE-2026-98675","Linux","Linux","iio: adc: ade9000: handle Phase C dip events in IRQ1 handler","","","2026-10-18",0],["CVE-2026-98674","Linux","Linux","iio: adc: adi-axi-adc: Initialize state mutex","","","2026-10-18",0],["CVE-2026-98673","Linux","Linux","iio: adc: pac1934: check ACPI label duplication","","","2026-10-18",0],["CVE-2026-98672","Linux","Linux","iio: adc: stm32-adc: fix possible division by zero in processed channel","","","2026-10-18",0],["CVE-2026-98671","Linux","Linux","iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure","","","2026-10-18",0],["CVE-2026-98670","Linux","Linux","iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind","","","2026-10-18",0],["CVE-2026-98669","Linux","Linux","iio: buffer: serialize buffer teardown with mode claims","","","2026-10-18",0],["CVE-2026-98668","Linux","Linux","iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.","","","2026-10-18",0],["CVE-2026-98667","Linux","Linux","iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data","","","2026-10-18",0],["CVE-2026-98666","Linux","Linux","iio: gyro: adis16136: fix unprotected debugfs reads","","","2026-10-18",0],["CVE-2026-98665","Linux","Linux","iio: health: max30102: fix NULL dereference in interrupt handler","","","2026-10-18",0],["CVE-2026-98664","Linux","Linux","iio: imu: adis16400: fix unprotected debugfs reads","","","2026-10-18",0],["CVE-2026-98663","Linux","Linux","iio: imu: adis16480: fix unprotected debugfs reads","","","2026-10-18",0],["CVE-2026-98662","Linux","Linux","iio: light: gp2ap020a00f: drain irq_work after free_irq","","","2026-10-18",0],["CVE-2026-98661","Linux","Linux","iio: light: rohm-bu27034: Fix infinite delay on error","","","2026-10-18",0],["CVE-2026-98660","Linux","Linux","iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup","","","2026-10-18",0],["CVE-2026-98659","Linux","Linux","iio: pressure: rohm-bm1390: Return error when read fails","","","2026-10-18",0],["CVE-2026-98658","Linux","Linux","iio: proximity: aw96103: validate firmware data length","","","2026-10-18",0],["CVE-2026-98657","Linux","Linux","iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure","","","2026-10-18",0],["CVE-2026-98656","Linux","Linux","iio: trigger: cancel reenable_work before freeing trigger","","","2026-10-18",0],["CVE-2026-98655","Linux","Linux","perf: Require kernel access for text poke events","","","2026-10-18",0],["CVE-2026-98653","Linux","Linux","KVM: s390: Fix _gaccess_shadow_fault()","","","2026-10-18",0],["CVE-2026-98652","Linux","Linux","KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","","","2026-10-18",0],["CVE-2026-98650","Linux","Linux","KVM: s390: Fix potential races in dat skey functions","","","2026-10-18",0],["CVE-2026-98651","Linux","Linux","KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()","","","2026-10-18",0],["CVE-2026-98649","Linux","Linux","KVM: s390: Fix race in _destroy_pages_crste()","","","2026-10-18",0],["CVE-2026-98648","Linux","Linux","s390/uv: Prevent potential out-of-bounds read","","","2026-10-18",0],["CVE-2026-98647","Linux","Linux","bpf: Fix divide-by-zero in btf_struct_walk()","","","2026-10-18",0],["CVE-2026-98646","Linux","Linux","tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context","","","2026-10-18",0],["CVE-2026-98645","Linux","Linux","HID: winwing: fix use-after-free in force feedback teardown","","","2026-10-18",0],["CVE-2026-98644","Linux","Linux","bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()","","","2026-10-18",0],["CVE-2026-98643","Linux","Linux","bpf: Fix out-of-bounds read of rtt_min in sock_ops","","","2026-10-18",0],["CVE-2026-98642","Linux","Linux","bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","","","2026-10-18",0],["CVE-2026-98641","Linux","Linux","bpf, arm64: set up the frame pointer for the exception callback","","","2026-10-18",0],["CVE-2026-98640","Linux","Linux","HID: amd_sfh: Validate PCI BAR size before mapping","","","2026-10-18",0],["CVE-2026-98639","Linux","Linux","KVM: riscv: Fix NACL hfence entry update order","","","2026-10-18",0],["CVE-2026-98638","Linux","Linux","KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()","","","2026-10-18",0],["CVE-2026-98637","Linux","Linux","KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure","","","2026-10-18",0],["CVE-2026-98636","Linux","Linux","squashfs: Add dictionary size range check to prevent shift-out-of-bounds","","","2026-10-18",0],["CVE-2026-98635","Linux","Linux","scsi: block: Fix zones_cond out-of-bounds write on zone report","","","2026-10-18",0],["CVE-2026-98634","Linux","Linux","scsi: sd_zbc: Reject disks with too many zones","","","2026-10-18",0],["CVE-2026-98633","Linux","Linux","Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()","","","2026-10-18",0],["CVE-2026-98632","Linux","Linux","Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel","","","2026-10-18",0],["CVE-2026-98631","Linux","Linux","xsk: Use a 32-bit compare in xsk_map_gen_lookup","","","2026-10-18",0],["CVE-2026-98630","Linux","Linux","eth: fbnic: Fix payload page pool error cleanup","","","2026-10-18",0],["CVE-2026-98629","Linux","Linux","net/sched: cls_u32: fix manual hash table handle IDR aliasing","","","2026-10-18",0],["CVE-2026-98628","Linux","Linux","bpf: Make post-verification instruction rewrites killable","","","2026-10-18",0],["CVE-2026-98627","Linux","Linux","bpf: Preserve packet pointer class displacement in regsafe()","","","2026-10-18",0],["CVE-2026-98626","Linux","Linux","bpf: Restrict CO-RE poisoning to relocatable instructions","","","2026-10-18",0],["CVE-2026-98625","Linux","Linux","netfilter: flowtable: publish HW_DEAD after worker is done","","","2026-10-18",0],["CVE-2026-98624","Linux","Linux","netfilter: nfnetlink_queue: hold nfnl mutex in event notifier","","","2026-10-18",0],["CVE-2026-98623","Linux","Linux","drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update","","","2026-10-18",0],["CVE-2026-98622","Linux","Linux","net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure","","","2026-10-18",0],["CVE-2026-98621","Linux","Linux","net: gue: reject invalid REMCSUM offsets","","","2026-10-18",0],["CVE-2026-98620","Linux","Linux","net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","","","2026-10-18",0],["CVE-2026-98619","Linux","Linux","net: ethtool: keep rtnl_lock for the ioctl self test","","","2026-10-18",0],["CVE-2026-98618","Linux","Linux","eth: fbnic: Handle maximum standalone channels","","","2026-10-18",0],["CVE-2026-98617","Linux","Linux","eth: fbnic: use the Rx queue napi pointer to find the napi vector","","","2026-10-18",0],["CVE-2026-98616","Linux","Linux","eth: fbnic: reset num_napi when the napi vectors are freed","","","2026-10-18",0],["CVE-2026-98615","Linux","Linux","eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox","","","2026-10-18",0],["CVE-2026-98614","Linux","Linux","sctp: avoid livelock while updating retransmit path","","","2026-10-18",0],["CVE-2026-98613","Linux","Linux","bpf: Bound ownership depth through local kptrs and graph roots","","","2026-10-18",0],["CVE-2026-98612","Linux","Linux","net: usb: catc: bound the RX packet length in catc_rx_done()","","","2026-10-18",0],["CVE-2026-98611","Linux","Linux","bpf: Check params size before reading reserved fields","","","2026-10-18",0],["CVE-2026-98610","Linux","Linux","net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget","","","2026-10-18",0],["CVE-2026-98609","Linux","Linux","drm/virtio: fix object leak when drm_gem_handle_create() fails","","","2026-10-18",0],["CVE-2026-98608","Linux","Linux","drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()","","","2026-10-18",0],["CVE-2026-98607","Linux","Linux","drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()","","","2026-10-18",0],["CVE-2026-98606","Linux","Linux","drm/virtio: release the GEM object on virtio_gpu_vram_create() errors","","","2026-10-18",0],["CVE-2026-98605","Linux","Linux","drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach","","","2026-10-18",0],["CVE-2026-98604","Linux","Linux","ovpn: replace bind when learning local endpoint","","","2026-10-18",0],["CVE-2026-98603","Linux","Linux","ovpn: replace bind when clearing stale local source","","","2026-10-18",0],["CVE-2026-98602","Linux","Linux","Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough","","","2026-10-18",0],["CVE-2026-98601","Linux","Linux","Bluetooth: btintel_pcie: validate device-supplied DMA indices","","","2026-10-18",0],["CVE-2026-98600","Linux","Linux","Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()","","","2026-10-18",0],["CVE-2026-98598","Linux","Linux","ipv6: Prevent rt6_insert_exception() for dying fib6_info.","","","2026-10-18",0],["CVE-2026-98599","Linux","Linux","bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","","","2026-10-18",0],["CVE-2026-98597","Linux","Linux","net: usb: sr9700: include receive overhead in the length check","","","2026-10-18",0],["CVE-2026-98596","Linux","Linux","ipv6: Fix dst leak for uncached routes.","","","2026-10-18",0],["CVE-2026-98595","Linux","Linux","udp: remove a disconnected socket from the 4-tuple hash table","","","2026-10-18",0],["CVE-2026-98594","Linux","Linux","tg3: clean up PHYLIB resources on probe failure","","","2026-10-18",0],["CVE-2026-98593","Linux","Linux","s390/debug: Fix NULL pointer dereference in debug_info_copy()","","","2026-10-18",0],["CVE-2026-98592","Linux","Linux","net: spacemit: clear TX descriptor on fragment mapping failure","","","2026-10-18",0],["CVE-2026-98591","Linux","Linux","bpf: Fix bounds check for skb-backed dynptrs","","","2026-10-18",0],["CVE-2026-98590","Linux","Linux","bpf: Fix bpf_sock context code generation","","","2026-10-18",0],["CVE-2026-98589","Linux","Linux","bpf: Reject pkt arguments in mutating subprogs","","","2026-10-18",0],["CVE-2026-98587","Linux","Linux","firewire: cdev: fix back-transition for iso_resource_auto client resource","","","2026-10-18",0],["CVE-2026-98588","Linux","Linux","bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc","","","2026-10-18",0],["CVE-2026-98586","Linux","Linux","sctp: hold asoc or transport before mod_timer() in timer handlers","","","2026-10-18",0],["CVE-2026-98585","Linux","Linux","eth: fbnic: Avoid rounding zero ring sizes","","","2026-10-18",0],["CVE-2026-98584","Linux","Linux","net/sched: fix potential stack infoleak in em_text_dump()","","","2026-10-18",0],["CVE-2026-98583","Linux","Linux","nfc: nfcmrvl: validate helper command length before pull","","","2026-10-18",0],["CVE-2026-98582","Linux","Linux","nfc: st21nfca: validate received frame size","","","2026-10-18",0],["CVE-2026-98581","Linux","Linux","nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()","","","2026-10-18",0],["CVE-2026-98580","Linux","Linux","nfc: llcp: Fix race condition in accept_queue lifecycle","","","2026-10-18",0],["CVE-2026-98579","Linux","Linux","nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure","","","2026-10-18",0],["CVE-2026-98578","Linux","Linux","nfc: st21nfca: validate ISO15693 inventory length","","","2026-10-18",0],["CVE-2026-98577","Linux","Linux","nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()","","","2026-10-18",0],["CVE-2026-98576","Linux","Linux","nfc: llcp: fix slab-out-of-bounds reads when logging service names","","","2026-10-18",0],["CVE-2026-98575","Linux","Linux","nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()","","","2026-10-18",0],["CVE-2026-98574","Linux","Linux","net: bcmgenet: stop Tx NAPI before disabling the queues","","","2026-10-18",0],["CVE-2026-98572","Linux","Linux","bpf: Fix immediate JMP JEQ/JNE on MIPS32","","","2026-10-18",0],["CVE-2026-98573","Linux","Linux","net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()","","","2026-10-18",0],["CVE-2026-98571","Linux","Linux","net: stmmac: clear stale buf->page after recycling on skb build failure","","","2026-10-18",0],["CVE-2026-98570","Linux","Linux","net: ipv6: keep room for the mac header in dst_dev_overhead()","","","2026-10-18",0],["CVE-2026-98569","Linux","Linux","ip_gre: Reject enabling collect metadata through changelink","","","2026-10-18",0],["CVE-2026-98568","Linux","Linux","vxlan: use one headroom snapshot for neighbour replies","","","2026-10-18",0],["CVE-2026-98567","Linux","Linux","net: xps: reject an out of range traffic class","","","2026-10-18",0],["CVE-2026-98566","Linux","Linux","drm/imagination: clamp freelist reconstruction requests","","","2026-10-18",0],["CVE-2026-98564","Linux","Linux","net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq","","","2026-10-18",0],["CVE-2026-98565","Linux","Linux","net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","","","2026-10-18",0],["CVE-2026-98563","Linux","Linux","net: phylink: record the PHY only once bringup cannot fail","","","2026-10-18",0],["CVE-2026-98562","Linux","Linux","net: libwx: fix races in Tx timestamp handling","","","2026-10-18",0],["CVE-2026-98561","Linux","Linux","nfp: hold IPsec RX state under the XArray lock","","","2026-10-18",0],["CVE-2026-98560","Linux","Linux","net/rds: size a connection's path set by the transport it ends up with","","","2026-10-18",0],["CVE-2026-98559","Linux","Linux","net/smc: fix UAF on lgr list traversal in smcr_port_err()","","","2026-10-18",0],["CVE-2026-98558","Linux","Linux","net: flush skb_defer_nodes in dev_cpu_dead()","","","2026-10-18",0],["CVE-2026-98557","Linux","Linux","gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO","","","2026-10-18",0],["CVE-2026-98556","Linux","Linux","gve: DQO: reject TSO packets with an out of range MSS","","","2026-10-18",0],["CVE-2026-98555","Linux","Linux","llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","HIGH",7.5,"2026-10-18",0],["CVE-2026-98554","Linux","Linux","vlan: ensure sufficient headroom in vlan_dev_hard_header()","","","2026-10-18",0],["CVE-2026-98553","Linux","Linux","autofs: fix sbi->pipe file reference leak in autofs_kill_sb()","","","2026-10-18",0],["CVE-2026-98551","Linux","Linux","perf/core: Fill branch entries with a single assignment","","","2026-10-18",0],["CVE-2026-98552","Linux","Linux","perf/core: Fix a refcount leak in attach_perf_ctx_data()","","","2026-10-18",0],["CVE-2026-98550","Linux","Linux","tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow","HIGH",7.5,"2026-10-18",0],["CVE-2026-98549","Linux","Linux","tcp: prevent collapsing skbs across boundary in rtx queue","CRITICAL",9.1,"2026-10-18",0],["CVE-2026-98548","Linux","Linux","sctp: discard the rest of the packet on a stale-cookie error","CRITICAL",9.8,"2026-10-18",0],["CVE-2026-98547","Linux","Linux","af_packet: fix integer overflow in prb_calc_retire_blk_tmo()","","","2026-10-18",0],["CVE-2026-98546","Linux","Linux","arm64/boot: Disable trapping of PMZR_EL0 writes to EL2","","","2026-10-18",0],["CVE-2026-98545","Linux","Linux","ata: libata-scsi: bound the ATA passthru sense descriptor writes","","","2026-10-18",0],["CVE-2026-98544","Linux","Linux","bna: prevent IOC timer rearm during teardown","","","2026-10-18",0],["CVE-2026-98542","Linux","Linux","cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus confl","","","2026-10-18",0],["CVE-2026-98543","Linux","Linux","bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir","HIGH",7.3,"2026-10-18",0],["CVE-2026-98541","Linux","Linux","fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT","","","2026-10-18",0],["CVE-2026-98540","Linux","Linux","fprobe: Terminate the fgraph_data list when the reservation is not filled","","","2026-10-18",0],["CVE-2026-98539","Linux","Linux","fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in d","","","2026-10-18",0],["CVE-2026-98537","Linux","Linux","workqueue: Fix NULL current_pwq deref in flush dependency check","","","2026-10-18",0],["CVE-2026-98538","Linux","Linux","writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes","","","2026-10-18",0],["CVE-2026-98536","Linux","Linux","writeback: report a Tasks-RCU quiescent state per cgwb drain pass","","","2026-10-18",0],["CVE-2026-98535","Linux","Linux","fsl/fman: Fix clk reference leak in read_dts_node()","","","2026-10-18",0],["CVE-2026-98534","Linux","Linux","ipe: fix use-after-free when auditing a newly loaded policy","","","2026-10-18",0],["CVE-2026-98533","Linux","Linux","ipe: protect the dm-verity root hash with RCU","","","2026-10-18",0],["CVE-2026-98532","Linux","Linux","ipv6: do not let ipv6_find_hdr() return an offset past the packet end","HIGH",8.1,"2026-10-18",0],["CVE-2026-98531","Linux","Linux","ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST","","","2026-10-18",0],["CVE-2026-98530","Linux","Linux","kprobes: Fix permanent hang when flushing the kprobe optimizer","","","2026-10-18",0],["CVE-2026-98529","Linux","Linux","gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()","","","2026-10-18",0],["CVE-2026-98528","Linux","Linux","gpio: cdev: fix kernel stack leak to user-space in error path","","","2026-10-18",0],["CVE-2026-98527","Linux","Linux","gpio: zynq: fix runtime PM leak on request error path","","","2026-10-18",0],["CVE-2026-98526","Linux","Linux","llc: reserve device headroom for allocated frames","","","2026-10-18",0],["CVE-2026-98525","Linux","Linux","mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","","","2026-10-18",0],["CVE-2026-98524","Linux","Linux","rds: ib: Clear the sg list when mapping an MR fails","HIGH",7.8,"2026-10-18",0],["CVE-2026-98523","Linux","Linux","drm/client: fix restore of partially initialized client","","","2026-10-18",0],["CVE-2026-98522","Linux","Linux","drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()","","","2026-10-18",0],["CVE-2026-98520","Linux","Linux","drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping","HIGH",7.8,"2026-10-18",0],["CVE-2026-98521","Linux","Linux","drm/i915: fix incorrect RCU teardown order","","","2026-10-18",0],["CVE-2026-98519","Linux","Linux","drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()","","","2026-10-18",0],["CVE-2026-98518","Linux","Linux","drm/nouveau/dmem: pin VRAM for the whole registered range","HIGH",7,"2026-10-18",0],["CVE-2026-98517","Linux","Linux","drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM","HIGH",7.8,"2026-10-18",0],["CVE-2026-98516","Linux","Linux","drm/nouveau: Fix bridge reference leak in nv1a_ram_new()","","","2026-10-18",0],["CVE-2026-98515","Linux","Linux","drm/nouveau: fix double-free in nvif_vmm_dtor","HIGH",7.8,"2026-10-18",0],["CVE-2026-98514","Linux","Linux","drm/nouveau: Fix gem reference leak in validate_init()","","","2026-10-18",0],["CVE-2026-98513","Linux","Linux","drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()","","","2026-10-18",0],["CVE-2026-98512","Linux","Linux","drm/nouveau: RCU-free the scheduler-containing nouveau_sched","HIGH",7.1,"2026-10-18",0],["CVE-2026-98511","Linux","Linux","drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()","","","2026-10-18",0],["CVE-2026-98510","Linux","Linux","drm/xe/vm: nuke PTs only after unlinking contested VMAs","HIGH",7.8,"2026-10-18",0],["CVE-2026-98509","Linux","Linux","drm/virtio: fix memory leak of fence event on execbuffer failure","","","2026-10-18",0],["CVE-2026-98508","Linux","Linux","drm/virtio: fix NULL pointer dereference on fence allocation failure","","","2026-10-18",0],["CVE-2026-98507","Linux","Linux","mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","HIGH",7.8,"2026-10-18",0],["CVE-2026-98506","Linux","Linux","mm/hugetlb: do not dissolve gigantic pages without runtime support","","","2026-10-18",0],["CVE-2026-98505","Linux","Linux","mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","","","2026-10-18",0],["CVE-2026-98504","Linux","Linux","PCI: of_property: Omit bus properties without a subordinate bus","","","2026-10-18",0],["CVE-2026-98503","Linux","Linux","packet: use ubuf_info completion for TX_RING packets","","","2026-10-18",0],["CVE-2026-98502","Linux","Linux","HID: alps: unregister DualPoint Stick input device on remove","","","2026-10-18",0],["CVE-2026-98501","Linux","Linux","HID: alps: fix use-after-free on input2 registration failure","HIGH",7.1,"2026-10-18",0],["CVE-2026-98500","Linux","Linux","HID: hid-oxp: use cancel_delayed_work_sync() in remove","","","2026-10-18",0],["CVE-2026-98499","Linux","Linux","HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()","HIGH",8.1,"2026-10-18",0],["CVE-2026-98498","Linux","Linux","net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()","","","2026-10-18",0],["CVE-2026-98497","Linux","Linux","net/mlx5e: fix swapped IPv6 IPsec policy masks","HIGH",7.5,"2026-10-18",0],["CVE-2026-98496","Linux","Linux","net: airoha: npu: cancel wdt_work after releasing the WDT IRQ","","","2026-10-18",0],["CVE-2026-98495","Linux","Linux","net: arp: terminate device name before lookup","","","2026-10-18",0],["CVE-2026-98494","Linux","Linux","net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read","","","2026-10-18",0],["CVE-2026-98493","Linux","Linux","net: ipconfig: bound DHCP option construction","","","2026-10-18",0],["CVE-2026-98492","Linux","Linux","net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths","","","2026-10-18",0],["CVE-2026-98491","Linux","Linux","net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry","HIGH",7.8,"2026-10-18",0],["CVE-2026-98490","Linux","Linux","net: openvswitch: conntrack: fix helper UAF due to extensions realloc","CRITICAL",9.8,"2026-10-18",0],["CVE-2026-98489","Linux","Linux","net: atl1c: fix soft lockup on out-of-range tpd_cons read","","","2026-10-18",0],["CVE-2026-98488","Linux","Linux","net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read","","","2026-10-18",0],["CVE-2026-98487","Linux","Linux","net: bridge: mdb: restart port group walk after deletion","HIGH",7.8,"2026-10-18",0],["CVE-2026-98486","Linux","Linux","net: ena: fix MMIO read buffer leak on probe failure","","","2026-10-18",0],["CVE-2026-98485","Linux","Linux","netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read","HIGH",7.1,"2026-10-18",0],["CVE-2026-98484","Linux","Linux","netfilter: nf_tables: skip expired catchall elements on insert and delete","","","2026-10-18",0],["CVE-2026-98483","Linux","Linux","nfc: fix use-after-free in nfc_get_local_general_bytes","","","2026-10-18",0],["CVE-2026-98482","Linux","Linux","nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()","","","2026-10-18",0],["CVE-2026-98481","Linux","Linux","nfc: port100: reject frames whose declared length exceeds the received data","","","2026-10-18",0],["CVE-2026-98480","Linux","Linux","nfc: trf7970a: power down on startup RX gain failure","","","2026-10-18",0],["CVE-2026-98479","Linux","Linux","scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","HIGH",7.5,"2026-10-18",0],["CVE-2026-98478","Linux","Linux","scsi: ufs: core: Keep internal commands dispatchable during error handling","","","2026-10-18",0],["CVE-2026-98477","Linux","Linux","perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()","","","2026-10-18",0],["CVE-2026-98476","Linux","Linux","s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()","","","2026-10-18",0],["CVE-2026-98475","Linux","Linux","s390/cmf: Fix virtual vs physical address confusion","","","2026-10-18",0],["CVE-2026-98474","Linux","Linux","s390/pci: Fix missing device lock in zpci_report_status()","","","2026-10-18",0],["CVE-2026-98473","Linux","Linux","s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","","","2026-10-18",0],["CVE-2026-98472","Linux","Linux","KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV","","","2026-10-18",0],["CVE-2026-98471","Linux","Linux","KVM: SEV: Do cache maintenance on the source VM during intra-host migration","HIGH",7.1,"2026-10-18",0],["CVE-2026-98469","Linux","Linux","KVM: arm64: Fix AArch32 DBGBXVR<n> handling","HIGH",7.1,"2026-10-18",0],["CVE-2026-98470","Linux","Linux","KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode","","","2026-10-18",0],["CVE-2026-98468","Linux","Linux","KVM: arm64: Fix spurious warning for benign stage 2 teardown race","","","2026-10-18",0],["CVE-2026-98467","Linux","Linux","KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race","","","2026-10-18",0],["CVE-2026-98466","Linux","Linux","KVM: arm64: Transfer the hyp stack pages out of the host stage-2","HIGH",8.2,"2026-10-18",0],["CVE-2026-98465","Linux","Linux","RISC-V: KVM: Serialize IMSIC attributes with vCPU migration","HIGH",7,"2026-10-18",0],["CVE-2026-98464","Linux","Linux","RISC-V: KVM: Synchronize hrtimer callback during teardown","CRITICAL",9.3,"2026-10-18",0],["CVE-2026-98463","Linux","Linux","sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags","","","2026-10-18",0],["CVE-2026-98462","Linux","Linux","Bluetooth: hci_conn: fix CIS hold ownership on reuse","","","2026-10-18",0],["CVE-2026-98461","Linux","Linux","Bluetooth: hci_sock: validate event length before filtering","","","2026-10-18",0],["CVE-2026-98460","Linux","Linux","Bluetooth: hci_sock: reject out-of-range OCF values","","","2026-10-18",0],["CVE-2026-98459","Linux","Linux","Bluetooth: ISO: balance the parent hold in hci_bind_bis()","","","2026-10-18",0],["CVE-2026-98458","Linux","Linux","Bluetooth: ISO: release unused CIS holds after channel attach","","","2026-10-18",0],["CVE-2026-98457","Linux","Linux","Bluetooth: L2CAP: validate frame length before control and FCS access","","","2026-10-18",0],["CVE-2026-98456","Linux","Linux","Bluetooth: mgmt: fix race in read_unconf_index_list()","HIGH",7,"2026-10-18",0],["CVE-2026-98454","Linux","Linux","smb: client: fix create context out-of-bounds reads","HIGH",8.1,"2026-10-18",0],["CVE-2026-98455","Linux","Linux","Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO","","","2026-10-18",0],["CVE-2026-98453","Linux","Linux","smb: client: close handle after create-context parsing failure","","","2026-10-18",0],["CVE-2026-98452","Linux","Linux","smb: client: clean up failed cached directory opens","","","2026-10-18",0],["CVE-2026-98451","Linux","Linux","smb: client: use finish_no_open() for non-regular inodes","HIGH",8.8,"2026-10-18",0],["CVE-2026-98450","Linux","Linux","smb: client: close completed creates on compound wait errors","","","2026-10-18",0],["CVE-2026-98449","Linux","Linux","smb: client: delete compound mids on send failure before unlock","","","2026-10-18",0],["CVE-2026-98448","Linux","Linux","xfs: release orphanage dir inode if chown fails","","","2026-10-18",0],["CVE-2026-98447","Linux","Linux","xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots","","","2026-10-18",0],["CVE-2026-98446","Linux","Linux","xfs: don't let hidden_space go negative in xfs_metafile_resv_init","","","2026-10-18",0],["CVE-2026-98445","Linux","Linux","xfs: don't let memory failures leak blocks and kill repairs","","","2026-10-18",0],["CVE-2026-98444","Linux","Linux","xfs: drop dquot flush lock when we can't find a buffer to flush","","","2026-10-18",0],["CVE-2026-98443","Linux","Linux","xfs: fix cursor and pointer handling when recovering iunlink buckets","HIGH",7.8,"2026-10-18",0],["CVE-2026-98442","Linux","Linux","net/sched: act_ct: fix helper UAF due to extensions realloc","HIGH",7.8,"2026-10-18",0],["CVE-2026-98441","Linux","Linux","net/sched: act_ct: avoid modifying shared unconfirmed ct entry","HIGH",7.8,"2026-10-18",0],["CVE-2026-98440","Linux","Linux","KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction","HIGH",7,"2026-10-18",0],["CVE-2026-111991","WongKinYiu","yolov9","WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-98439","Linux","Linux","smb/server: cancel async requests when closing connection","","","2026-10-18",0],["CVE-2026-98438","Linux","Linux","mptcp: options: fix uninit-value in mptcp_write_data_fin","","","2026-10-18",0],["CVE-2026-98437","Linux","Linux","media: qcom: iris: fix runtime PM reference leaks","","","2026-10-18",0],["CVE-2026-98436","Linux","Linux","accel/amdxdna: Disable device buffer exporting","HIGH",7.8,"2026-10-18",0],["CVE-2026-98435","Linux","Linux","EDAC/altera: Use parent device for devres in altr_portb_setup()","","","2026-10-18",0],["CVE-2026-111990","kishan0725","Hospital Management System","kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_quer","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-98434","Linux","Linux","sysctl: Check range in proc_dointvec_ms_jiffies_minmax","","","2026-10-18",0],["CVE-2026-98433","Linux","Linux","KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure","","","2026-10-18",0],["CVE-2026-110024","@fastify/jwt","@fastify/jwt","@fastify/jwt vulnerable to missing token expiration when per-call options drop global defa","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-111988","dyad-sh","dyad","dyad-sh dyad OAuth Callback cross-site request forgery","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111987","AUTOMATIC1111","stable-diffusion-webui","AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadat","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111986","AUTOMATIC1111","stable-diffusion-webui","AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str cod","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-112062","lwIP","lwIP","lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler","MEDIUM",6,"2026-10-18",0],["CVE-2026-112063","strophe","libstrophe","libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi","MEDIUM",6,"2026-10-18",0],["CVE-2026-112061","RTMPDump","librtmp","librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-112060","RTMPDump","librtmp","librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode","MEDIUM",6.1,"2026-10-18",0],["CVE-2026-112059","libLAS","libLAS","libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112057","VideoLAN","libdvdnav","libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112058","VideoLAN","libdvdnav","libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112056","wvWare","wv","wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112055","wvWare","wv","wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112054","Schroedinger","schroedinger","Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112053","Schroedinger","schroedinger","Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_defaul","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112051","xorbitsai","inference","Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration","HIGH",8.3,"2026-10-18",0],["CVE-2026-112052","SpatiaLite","libspatialite","libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112050","gitify-app","gitify","Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation","LOW",2.3,"2026-10-18",0],["CVE-2026-112049","Vita3K","Vita3K","Vita3K before build 4187 Path Traversal via VPK Package Installation","MEDIUM",6.7,"2026-10-18",0],["CVE-2026-112047","OneUptime","oneuptime","OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-112048","SpatiaLite","libspatialite","libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112046","OW2","ASM","OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-111985","AUTOMATIC1111","stable-diffusion-webui","AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_s","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111984","AUTOMATIC1111","stable-diffusion-webui","AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cr","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-112021","grunfink","snac2","snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()","HIGH",8.7,"2026-10-18",0],["CVE-2026-112019","jkuhlmann","cgltf","cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112020","lvandeve","lodepng","LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112018","jkuhlmann","cgltf","cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()","HIGH",7.3,"2026-10-18",0],["CVE-2026-112016","Netcore","NR256CN","Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112017","jeecgboot","JeecgBoot","JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass","HIGH",7.1,"2026-10-18",0],["CVE-2026-112015","omnigent-ai","omnigent","Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd","HIGH",7.7,"2026-10-18",0],["CVE-2026-112014","netease-youdao","LobsterAI","LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112012","True Audio","libtta","libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count","MEDIUM",4.8,"2026-10-18",0],["CVE-2026-112013","True Audio","libtta","libtta through 2.3 Divide by Zero via tta_decoder_init_get_info","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112011","True Audio","libtta","libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table","MEDIUM",5.8,"2026-10-18",0],["CVE-2026-112010","icculus","smpeg","smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112008","libmng","libmng","libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112009","icculus","smpeg","smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-112007","schismtracker","Schism Tracker","Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-112005","clidey","whodb","WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor","CRITICAL",9.2,"2026-10-18",0],["CVE-2026-112006","OpenTelemetry","opentelemetry-exporter-otlp-proto-http","OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certific","HIGH",8.3,"2026-10-18",0],["CVE-2026-112004","teableio","teable","Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint","LOW",2.3,"2026-10-18",0],["CVE-2026-112002","ProjectSend","ProjectSend","ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password","HIGH",7.6,"2026-10-18",0],["CVE-2026-112003","ProjectSend","ProjectSend","ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete","MEDIUM",6,"2026-10-18",0],["CVE-2026-112001","ProjectSend","ProjectSend","ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities","HIGH",8.6,"2026-10-18",0],["CVE-2026-111999","vanus-labs","vanus","Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver","HIGH",8.7,"2026-10-18",0],["CVE-2026-112000","vanus-labs","vanus","Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs","HIGH",7.2,"2026-10-18",0],["CVE-2026-111998","vanus-labs","vanus","Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway","CRITICAL",9.3,"2026-10-18",0],["CVE-2026-78497","","JQ-Lite","JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular exp","HIGH",8.4,"2026-10-18",0],["CVE-2026-107436","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-18",0],["CVE-2026-110373","Hamid Alinia","Login with phone number","WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability","HIGH",8.1,"2026-10-18",0],["CVE-2026-110880","Kit","Kit (formerly ConvertKit)","WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-110886","QuantumCloud","Conversational Forms for ChatBot","WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerab","CRITICAL",9.8,"2026-10-18",0],["CVE-2026-110895","DevItems","Support Genix","WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability","HIGH",8.5,"2026-10-18",0],["CVE-2026-109894","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-18",0],["CVE-2026-109895","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-18",0],["CVE-2026-110383","WP E-Signature","Electronic Signature Add-on for Fluent Forms","WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct O","HIGH",7.5,"2026-10-18",0],["CVE-2026-110883","VideoWhisper.com","2Way VideoCalls and Random Chat","WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerab","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-108485","ThemeGrill","eStore","WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-18",0],["CVE-2026-110372","Brainstorm Force","OttoKit","WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-18",0],["CVE-2026-110382","NSquared","Simply Schedule Appointments","WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vu","HIGH",7.1,"2026-10-18",0],["CVE-2026-110897","IdeaBox Creations","PowerPack Lite for Beaver Builder","WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) v","HIGH",7.1,"2026-10-18",0],["CVE-2026-110365","WPExperts","Advanced File Manager","WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-110885","HivePress","HivePress","WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-111942","hrisikeshpal","Blood_Bank_Management_System","hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-96534","","Modern Events Calendar Lite","Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export","HIGH",7.7,"2026-10-18",0],["CVE-2026-110069","","Modern Events Calendar Lite","Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event","MEDIUM",4.3,"2026-10-18",0],["CVE-2026-110070","","Modern Events Calendar Lite","Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR","MEDIUM",6.5,"2026-10-18",0],["CVE-2026-110976","","AI Engine","AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media","MEDIUM",4.9,"2026-10-18",0],["CVE-2026-110981","","WP Photo Album Plus","WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter","HIGH",7.1,"2026-10-18",0],["CVE-2026-111041","","AI Engine","AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and appr","MEDIUM",4.9,"2026-10-18",0],["CVE-2026-110026","","Tasty Recipes Lite","Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deleti","MEDIUM",4.9,"2026-10-18",0],["CVE-2026-110031","","Salon Booking System","Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator","HIGH",7.2,"2026-10-18",0],["CVE-2026-110032","","Salon Booking System","Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Ed","MEDIUM",5.5,"2026-10-18",0],["CVE-2026-110033","","Salon Booking System","Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_u","MEDIUM",6.8,"2026-10-18",0],["CVE-2026-110035","","Salon Booking System","Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Ro","MEDIUM",4.3,"2026-10-18",0],["CVE-2026-109937","","Otter Blocks","Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block","MEDIUM",5.4,"2026-10-18",0],["CVE-2026-87844","","PickPlugins Product Designer for WooCommerce","Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111877","dext34-morgan","Books4Cash","dext34-morgan Books4Cash search.php cross site scripting","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111876","alexpasmantier","television","alexpasmantier television entry.rs output command injection","MEDIUM",4.8,"2026-10-18",0],["CVE-2026-111875","David-Crty","Databasement","David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization","MEDIUM",5.1,"2026-10-18",0],["CVE-2026-111874","","OpenCATS","OpenCATS Career Portal CareersUI.php processLogin excessive authentication","MEDIUM",6.3,"2026-10-18",0],["CVE-2026-111873","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injec","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111872","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System database.php getreport sql injection","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111871","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System subjectsdb.php sql injection","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111870","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111869","makeplane","plane","makeplane API Endpoint reliance on untrusted inputs in a security decision","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111868","datastax","pulsar-jms","datastax pulsar-jms PulsarObjectMessage.java decode deserialization","MEDIUM",5.3,"2026-10-18",0],["CVE-2026-111997","beaugunderson","ip-address","ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic comple","MEDIUM",6.3,"2026-10-18",0],["CVE-2026-111866","nemoTyrant","manong","nemoTyrant manong func.php arr2sql sql injection","MEDIUM",6.9,"2026-10-18",0],["CVE-2026-111865","THU-MIG","yoloe","THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection","MEDIUM",4.8,"2026-10-17",0],["CVE-2026-110882","Cozy Vision Technologies Pvt. Ltd.","SMS Alert Order Notifications","WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerabil","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-111934","coder","coder","Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header","MEDIUM",6.3,"2026-10-17",0],["CVE-2026-111933","coder","coder","Coder before 2.34.2 User Enumeration via Login Placeholder Hash","MEDIUM",6.3,"2026-10-17",0],["CVE-2026-111931","coder","coder","Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111932","coder","coder","Coder before 2.34.2 Stored HTML Injection via Appearance Settings","MEDIUM",4.8,"2026-10-17",0],["CVE-2026-111930","coder","coder","Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111928","coder","coder","Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111929","coder","coder","Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC","MEDIUM",6,"2026-10-17",0],["CVE-2026-111927","coder","coder","Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match","HIGH",8.7,"2026-10-17",0],["CVE-2026-111926","coder","coder","Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest","MEDIUM",4.8,"2026-10-17",0],["CVE-2026-111924","fleetdm","fleet","Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression","HIGH",8.7,"2026-10-17",0],["CVE-2026-111923","fleetdm","fleet","Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing","HIGH",8.7,"2026-10-17",0],["CVE-2026-111921","go-vikunja","vikunja","Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111922","go-vikunja","vikunja","Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins","HIGH",7.2,"2026-10-17",0],["CVE-2026-111920","go-vikunja","vikunja","Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111918","go-vikunja","vikunja","Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111919","go-vikunja","vikunja","Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks","HIGH",7.1,"2026-10-17",0],["CVE-2026-111917","go-vikunja","vikunja","Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation","HIGH",7.1,"2026-10-17",0],["CVE-2026-111914","Admidio","admidio","Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php","HIGH",7.1,"2026-10-17",0],["CVE-2026-111916","Admidio","admidio","Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed","MEDIUM",6.9,"2026-10-17",0],["CVE-2026-111913","Admidio","admidio","Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111912","Admidio","admidio","Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update","HIGH",7.1,"2026-10-17",0],["CVE-2026-111910","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachmen","HIGH",7.1,"2026-10-17",0],["CVE-2026-111911","thorsten","phpMyFAQ","phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection","CRITICAL",9.3,"2026-10-17",0],["CVE-2026-111909","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API","HIGH",7.2,"2026-10-17",0],["CVE-2026-111907","thorsten","phpMyFAQ","phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database","HIGH",7.1,"2026-10-17",0],["CVE-2026-111908","thorsten","phpMyFAQ","phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST ","HIGH",8.7,"2026-10-17",0],["CVE-2026-111906","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch A","HIGH",7.1,"2026-10-17",0],["CVE-2026-111904","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API","MEDIUM",6.9,"2026-10-17",0],["CVE-2026-111905","thorsten","phpMyFAQ","phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /","HIGH",7,"2026-10-17",0],["CVE-2026-111903","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass","MEDIUM",5.1,"2026-10-17",0],["CVE-2026-111901","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination","HIGH",8.7,"2026-10-17",0],["CVE-2026-111902","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments A","MEDIUM",6.9,"2026-10-17",0],["CVE-2026-111900","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure vi","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111898","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Link","HIGH",7.7,"2026-10-17",0],["CVE-2026-111896","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass","MEDIUM",5.1,"2026-10-17",0],["CVE-2026-111897","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration E","HIGH",7.1,"2026-10-17",0],["CVE-2026-111895","thorsten","phpMyFAQ","phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID pref","HIGH",7.6,"2026-10-17",0],["CVE-2026-111893","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restriction","HIGH",8.5,"2026-10-17",0],["CVE-2026-111894","thorsten","phpMyFAQ","phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: ","MEDIUM",5.1,"2026-10-17",0],["CVE-2026-111891","thorsten","phpMyFAQ","phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions A","HIGH",7,"2026-10-17",0],["CVE-2026-111892","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints","MEDIUM",6.9,"2026-10-17",0],["CVE-2026-111890","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights","HIGH",7,"2026-10-17",0],["CVE-2026-111888","thorsten","phpMyFAQ","phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API","MEDIUM",5.1,"2026-10-17",0],["CVE-2026-111889","thorsten","phpMyFAQ","phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Ad","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-111887","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comm","MEDIUM",6.9,"2026-10-17",0],["CVE-2026-111885","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API","HIGH",7,"2026-10-17",0],["CVE-2026-111886","thorsten","phpMyFAQ","phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint","HIGH",7.1,"2026-10-17",0],["CVE-2026-111884","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up o","HIGH",8.7,"2026-10-17",0],["CVE-2026-111881","FreeRDP","FreeRDP","FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard","HIGH",7.2,"2026-10-17",0],["CVE-2026-111882","thorsten","phpMyFAQ","phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SS","HIGH",8.6,"2026-10-17",0],["CVE-2026-111880","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset","HIGH",8.3,"2026-10-17",0],["CVE-2024-58398","coder","coder","Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter","MEDIUM",5.3,"2026-10-17",0],["CVE-2025-71435","coder","coder","Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token","LOW",2.3,"2026-10-17",0],["CVE-2026-109701","PAYCOMET","PAYCOMET for WooCommerce","WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabili","HIGH",7.1,"2026-10-17",0],["CVE-2026-110889","Gantry","Gantry 5 Framework","WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-17",0],["CVE-2026-100316","davidanderson","European VAT Compliance Assistant for WooCommerce","European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cros","HIGH",7.2,"2026-10-17",0],["CVE-2026-109983","wssoffice21","YMC Filter","YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via ","MEDIUM",6.4,"2026-10-17",0],["CVE-2026-110253","boldgrid","weForms – Easy Drag & Drop Contact Form Builder For WordPress","weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter","MEDIUM",5.4,"2026-10-17",0],["CVE-2026-111110","stiofansisland","Payment forms, Buy now buttons, and Invoicing System | GetPaid","Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated","HIGH",7.2,"2026-10-17",0],["CVE-2026-110384","Heateor Support","Fancy Comments WordPress","WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabi","HIGH",7.1,"2026-10-17",0],["CVE-2026-97314","","ThirstyAffiliates","ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclos","MEDIUM",6.5,"2026-10-17",0],["CVE-2026-110527","","WP User Manager","WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Pa","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-81343","","ACF Frontend Admin by DynamiApps","Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update vi","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-81344","","ACF Frontend Admin by DynamiApps","Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection","MEDIUM",6.6,"2026-10-17",0],["CVE-2026-103376","","PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay ","MEDIUM",5.3,"2026-10-17",0],["CVE-2026-104122","","Ukr-To-Lat","Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name","MEDIUM",6.8,"2026-10-17",0],["CVE-2026-106470","","WP Data Access","WP Data Access < 5.5.88 - Subscriber+ SSRF","MEDIUM",5,"2026-10-17",0],["CVE-2026-92432","","Patreon WordPress","Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-104246","","Contact Form 7 Signature Addon","Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Tra","MEDIUM",5.9,"2026-10-17",0],["CVE-2026-91074","","BSK PDF Manager","BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute","MEDIUM",6.8,"2026-10-17",0],["CVE-2026-92431","","Patreon WordPress","Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration","LOW",3.7,"2026-10-17",0],["CVE-2026-92433","","Patreon WordPress","Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF","MEDIUM",6.5,"2026-10-17",0],["CVE-2026-92798","wpeverest","User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode ","HIGH",8.1,"2026-10-17",0],["CVE-2026-103899","daigo75","EU VAT Assistant for WooCommerce","EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scri","HIGH",7.2,"2026-10-17",0],["CVE-2026-107744","thimpress","LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address ","MEDIUM",6.5,"2026-10-17",0],["CVE-2026-109989","themifyme","Themify Popup","Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_wi","MEDIUM",6.4,"2026-10-17",0],["CVE-2026-108123","murgroland","WP Booking System – Booking Calendar","WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Informat","HIGH",7.5,"2026-10-17",0],["CVE-2026-111726","themifyme","Themify Builder","Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'v","MEDIUM",6.4,"2026-10-17",0],["CVE-2026-92978","wpeverest","User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_actio","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-104736","thimpress","LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-109369","murgroland","WP Booking System – Booking Calendar","WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privil","MEDIUM",6.8,"2026-10-17",0],["CVE-2026-96660","wpeverest","User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via ","HIGH",7.2,"2026-10-17",0],["CVE-2026-107752","uscnanbu","Welcart e-Commerce","Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_o","MEDIUM",4.9,"2026-10-17",0],["CVE-2026-109368","murgroland","WP Booking System – Booking Calendar","WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensit","MEDIUM",6.5,"2026-10-17",0],["CVE-2026-92715","themeum","Tutor LMS – eLearning and online course solution","Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-109985","wpdevteam","xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN","xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated ","MEDIUM",6.4,"2026-10-17",0],["CVE-2026-110268","wpazleen","Post Export Import with Media","Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal vi","MEDIUM",4.9,"2026-10-17",0],["CVE-2026-111602","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via","LOW",3.7,"2026-10-17",0],["CVE-2026-109208","thimpress","LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'ord","HIGH",7.2,"2026-10-17",0],["CVE-2026-110653","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condi","CRITICAL",9.1,"2026-10-17",0],["CVE-2026-111601","hippooo","Hippoo Mobile App for WooCommerce","Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id","MEDIUM",6.1,"2026-10-17",0],["CVE-2026-104734","themeum","Kirki – Freeform Page Builder, Website Builder & Customizer","Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization o","HIGH",7.2,"2026-10-17",0],["CVE-2026-107762","themeum","Kirki – Freeform Page Builder, Website Builder & Customizer","Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information","HIGH",7.5,"2026-10-17",0],["CVE-2026-107763","hostspa","Fastcache by Host.it","Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbit","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-111855","Tektronix","3 Series MDO","An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal ","HIGH",7.5,"2026-10-17",0],["CVE-2026-111854","Tektronix","3 Series MDO","An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal ","HIGH",8.1,"2026-10-17",0],["CVE-2026-111853","Tektronix","3 Series MDO","An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command inj","HIGH",8.8,"2026-10-17",0],["CVE-2026-111823","Mage","mage-ai","Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-89096","Red Hat","Red Hat Enterprise Linux 10","Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd","MEDIUM",5.9,"2026-10-17",0],["CVE-2026-89088","Red Hat","Red Hat Enterprise Linux 10","Parted: parted: denial of service via heap buffer overflow during fat16 resize","MEDIUM",5.5,"2026-10-17",0],["CVE-2026-89085","Red Hat","Red Hat Enterprise Linux 10","Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image","MEDIUM",6.6,"2026-10-17",0],["CVE-2026-110759","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-110758","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field und","HIGH",7.5,"2026-10-17",0],["CVE-2026-110757","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used ","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-110756","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending wh","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-110755","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed","HIGH",7.5,"2026-10-17",0],["CVE-2026-110754","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails t","MEDIUM",6.5,"2026-10-17",0],["CVE-2026-110753","","Text-CSV_XS","Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns","CRITICAL",9.8,"2026-10-17",0],["CVE-2026-110752","","Text-CSV_XS","Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry","HIGH",7.5,"2026-10-17",0],["CVE-2026-111802","Red Hat","Red Hat Enterprise Linux 10","Nautilus: nautilus: arbitrary file deletion via trash symlink","MEDIUM",6.6,"2026-10-17",0],["CVE-2026-17591","Red Hat","Red Hat Hardened Images","Libarchive: libarchive: use-after-free via aliased mac metadata copy","LOW",3.6,"2026-10-17",0],["CVE-2026-111044","LizardByte","Sunshine","Disabled Sunshine clients can bypass revocation with a derived client certificate","HIGH",7.6,"2026-10-17",0],["CVE-2026-62438","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: paa integer overflow out-of-bounds read","MEDIUM",6.1,"2026-10-17",0],["CVE-2026-62439","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow ","HIGH",7,"2026-10-17",0],["CVE-2026-108372","huangruiteng","loopx","LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown","HIGH",7.1,"2026-10-17",0],["CVE-2026-49410","tinyhumansai","openhuman","OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation","HIGH",8.1,"2026-10-17",0],["CVE-2026-96627","getarcaneapp","arcane","Arcane: Delegated users:update permission allows admin account takeover via password reset","HIGH",8.8,"2026-10-17",0],["CVE-2026-68498","FasterXML","jackson-core","jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonPars","HIGH",7.5,"2026-10-17",0],["CVE-2026-96628","getarcaneapp","arcane","Arcane: Environment access token bypasses the admin-required authorization gate on `/api/d","MEDIUM",4.3,"2026-10-17",0],["CVE-2026-96626","getarcaneapp","arcane","Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host","HIGH",8.5,"2026-10-17",0],["CVE-2026-96542","Electronic Arts","EA Javelin Anticheat (EA Javelin Anticheat Installer)","EA Javelin Anticheat Installer Local Privilege Escalation","MEDIUM",5,"2026-10-17",0],["CVE-2026-64862","frappe","hrms","Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access i","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-55796","frappe","hrms","Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-108373","frappe","erpnext","ERPNext: Unauthorised access to financial data due to missing validation","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-108374","frappe","erpnext","ERPNext: Unauthorised status modification due to missing validation","HIGH",7.7,"2026-10-16",0],["CVE-2026-102834","bytedeco","javacv","JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS","HIGH",7.5,"2026-10-16",0],["CVE-2026-108743","Apache Software Foundation","Apache Kylin","Apache Kylin: spark job OS command injection","HIGH",8.8,"2026-10-16",0],["CVE-2026-96620","anthropics","claude-agent-sdk-python","Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-30971","ZoneMinder","zoneminder","ZoneMinder: Authenticated RCE via command injection in monitor Device Path","HIGH",8.8,"2026-10-16",0],["CVE-2026-108709","Apache Software Foundation","Apache Kylin","Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-69080","Apache Software Foundation","Apache Kylin","Apache Kylin: Broken Access Control in QuerySQLBlacklistController","HIGH",7.5,"2026-10-16",0],["CVE-2026-102608","ZoneMinder","zoneminder","ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event expor","CRITICAL",9,"2026-10-16",0],["CVE-2026-69077","Apache Software Foundation","Apache Kylin","Apache Kylin: JobController allows unauthorized cross-project manipulation","HIGH",7.5,"2026-10-16",0],["CVE-2026-69076","Apache Software Foundation","Apache Kylin","Apache Kylin: Unauthorized cross-project job discard","HIGH",7.5,"2026-10-16",0],["CVE-2026-68573","Apache Software Foundation","Apache Kylin","Apache Kylin: Unauthenticated Metastore Cleanup","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-68572","Apache Software Foundation","Apache Kylin","Apache Kylin: Unauthorized SQL execution to Spark SQL env","HIGH",7.5,"2026-10-16",0],["CVE-2026-102607","ZoneMinder","zoneminder","ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature","HIGH",8.8,"2026-10-16",0],["CVE-2026-59970","TandoorRecipes","recipes","Tandoor Recipes: Blind SSRF via AI provider URL (api_base)","HIGH",7.7,"2026-10-16",0],["CVE-2026-61726","TandoorRecipes","recipes","Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify anot","HIGH",8.1,"2026-10-16",0],["CVE-2026-59966","TandoorRecipes","recipes","Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automati","MEDIUM",5.7,"2026-10-16",0],["CVE-2026-59963","TandoorRecipes","recipes","Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility","HIGH",7.1,"2026-10-16",0],["CVE-2026-17068","IBM","i","IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network ","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-17073","IBM","i","IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network ","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-17275","IBM","i","IBM i is Affected by an Improper Validation Vulnerability","LOW",3.7,"2026-10-16",0],["CVE-2026-17488","IBM","i","IBM i is Affected By An Improper Authentication Vulnerability in SST / DST","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-17491","IBM","i","IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-102917","IBM","i","IBM i is Affected By An Improper Privilege Management Vulnerability","HIGH",7.8,"2026-10-16",0],["CVE-2026-111793","Openwave Messaging (Ireland) Limited","Webtop Media Transcoder","Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrict","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-85977","Red Hat","Red Hat Hardened Images","Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-85231","Red Hat","Red Hat Enterprise Linux 10","Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-107674","IBM","i","IBM i is Affected by a Denial of Service in Digital Certificate Manager","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-109838","IBM","Db2 Genius Hub","IBM Db2 Genius Hub Improper verification of cryptographic signature","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-89098","Red Hat","Red Hat Enterprise Linux 10","Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd","MEDIUM",5.5,"2026-10-16",0],["CVE-2026-111722","LingGuoAI","LingGuo-Drama","LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API","HIGH",8.6,"2026-10-16",0],["CVE-2026-111723","LingGuoAI","LingGuo-Drama","LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API","HIGH",8.7,"2026-10-16",0],["CVE-2026-111721","jingsewu","open-wes","Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111720","lhccong","fish-island-backend","fish-island-backend through commit 7c61b78 SSRF via /api/web/parse","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111718","kuafuai","aipexbase","AipexBase through commit 690adb9 SQL Injection via /api/data/invoke","HIGH",7.1,"2026-10-16",0],["CVE-2026-111719","roncoo","roncoo-pay","Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query","HIGH",8.2,"2026-10-16",0],["CVE-2026-111717","nduckmink","arkon","Arkon through 0.9.2 Missing Authorization via Skills Versions API","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111715","nduckmink","arkon","Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111716","nduckmink","arkon","Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111714","AmauriC","tarteaucitron.js","tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge","LOW",2.3,"2026-10-16",0],["CVE-2026-111712","Netcore","NR256CN","Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111713","AmauriC","tarteaucitron.js","tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111711","Netcore","NR256CN","Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111710","Netcore","NR256CN","Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS","HIGH",8.7,"2026-10-16",0],["CVE-2026-111708","canove","whaticket-community","WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111709","canove","whaticket-community","WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:tick","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111707","vastxie","99AI","99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111705","fushengqian","fuint","Fuint through commit 57ec018 IDOR via bookId in myBookDetail","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111706","vastxie","99AI","99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel","HIGH",8.7,"2026-10-16",0],["CVE-2026-111704","LangChat","langchat","LangChat through commit 2a6285a Missing Authentication on REST API Controllers","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111702","sugarforever","chat-ollama","ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases","HIGH",8.7,"2026-10-16",0],["CVE-2026-111703","guchengwuyue","yshop-crm","yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-81452","Dell","Alienware Command Center (AWCC)","Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privile","HIGH",7,"2026-10-16",0],["CVE-2026-111701","OtterMind","Nubase","OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API","HIGH",8.3,"2026-10-16",0],["CVE-2026-111699","niefy","wx-api","Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111700","WebVella","WebVella-ERP","WebVella ERP through 1.8.8 SQL Injection via EQL Query API","HIGH",7.1,"2026-10-16",0],["CVE-2026-111698","roinli","HUIZHI-ChargeOS-cloud","HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge","HIGH",7.1,"2026-10-16",0],["CVE-2026-111697","roinli","HUIZHI-ChargeOS-cloud","HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs","HIGH",7.1,"2026-10-16",0],["CVE-2026-111695","shaiwz","data-platform-open","Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API","HIGH",7.1,"2026-10-16",0],["CVE-2026-111696","shaiwz","data-platform-open","data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords","HIGH",7.1,"2026-10-16",0],["CVE-2026-111694","qiantongtech","qKnow","qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111692","databufflabs","databuff","DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111693","databufflabs","databuff","DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111691","wimoor-erp","wimoor","WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-111689","Exrick","xboot","XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111690","suyuan32","simple-admin-core","Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111688","Exrick","xboot","Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111686","Thecosy","IceCMS","IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum","HIGH",8.7,"2026-10-16",0],["CVE-2026-111687","rachelos","we-mp-rss","WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111685","Thecosy","IceCMS","IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum","HIGH",8.7,"2026-10-16",0],["CVE-2026-111684","absmach","magistrala","Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service","HIGH",7.2,"2026-10-16",0],["CVE-2026-111682","smartloli","EFAK","EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys","HIGH",7.1,"2026-10-16",0],["CVE-2026-111683","allegro","ralph","Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111681","smartloli","EFAK","EFAK through 5.1.0 Privilege Escalation via /api/users REST API","HIGH",8.7,"2026-10-16",0],["CVE-2026-111679","EKKOLearnAI","ekko-studio","Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111680","APIParkLab","APIPark","APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter","HIGH",7.2,"2026-10-16",0],["CVE-2026-111678","Adri van Os","antiword","Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-111677","Adri van Os","antiword","Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-111675","xiaochong0302","course-tencent-cloud","Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-111676","faveosuite","faveo-helpdesk","Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111674","Hello-hao","Tbed","Tbed through 20240319 Missing Authorization via setImgFileName Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111672","data-infra","cube-studio","Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111673","Thecosy","IceCMS","IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111671","data-infra","cube-studio","Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints","HIGH",7.1,"2026-10-16",0],["CVE-2026-111669","izhaorui","Zr.Admin.NET","ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY","HIGH",7.1,"2026-10-16",0],["CVE-2026-111670","clickvisual","clickvisual","ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111668","beizhu-1209","AIHelms","AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111667","getrebuild","rebuild","REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111665","PiranhaCMS","Piranha CMS","Piranha CMS through 12.2 Missing Authorization in Manager Language API","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111666","steedos","steedos-platform","Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports AP","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111664","safing","portmaster","Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-u","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-111662","chaskiq","chaskiq","Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111663","chaskiq","chaskiq","Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-111661","wayn111","waynboot-mall","waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111659","wayn111","waynboot-mall","Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111660","wayn111","waynboot-mall","waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111658","SiteServer","SSCMS","SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111656","zhimaAi","chatwiki","ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111657","beikeshop","beikeshop","BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111655","zoujingli","think-plugs-admin","ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111653","53AI","53AIHub","53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111654","kerwincui","FastBee","FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111652","3xxx","engineercms","Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111651","risesoft-y9","Digital-Infrastructure","Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadCont","HIGH",7.1,"2026-10-16",0],["CVE-2026-111649","rocboss","paopao-ce","Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint","HIGH",7.1,"2026-10-16",0],["CVE-2026-111650","HoshinoSuzumi","chronoframe","ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API","HIGH",8.8,"2026-10-16",0],["CVE-2026-111648","build-admin","buildadmin","BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111646","javahuang","SurveyKing","SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview","HIGH",8.2,"2026-10-16",0],["CVE-2026-111647","PickMall","lilishop","PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111645","zmister2016","MrDoc","MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111643","l429609201","misaka_danmu_server","Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111644","l429609201","misaka_danmu_server","Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111642","fastapiadmin","FastapiAdmin","FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation","HIGH",8.7,"2026-10-16",0],["CVE-2026-111641","fastapiadmin","FastapiAdmin","FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111639","mlogclub","bbs-go","bbs-go through 4.4.6 Account Takeover via Google One Tap Login","HIGH",8.6,"2026-10-16",0],["CVE-2026-111640","kuaifan","dootask","DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111638","moul","sshportal","sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys","HIGH",8.3,"2026-10-16",0],["CVE-2026-111636","OpenBMB","StaffDeck","OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-111637","Blair2004","NexoPOS","NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111635","helicalinsight","helicalinsight","Helical Insight through 7.0.0 Path Traversal via /getExternalResource","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111633","SeriaWei","ZKEACMS","ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key","HIGH",8.8,"2026-10-16",0],["CVE-2026-111634","helicalinsight","helicalinsight","Helical Insight through 7.0.0 SQL Injection via /executeDatasource","HIGH",8.6,"2026-10-16",0],["CVE-2026-111632","aureuserp","aureuserp","Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111630","colinin","abp-next-admin","abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111631","10up","Distributor","Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111629","IoTSharp","IoTSharp","IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111627","hestiacp","hestiacp","HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation","HIGH",8.6,"2026-10-16",0],["CVE-2026-111628","10up","Distributor","10up Distributor before 2.3.2 PHP Object Injection via set_meta()","LOW",2.3,"2026-10-16",0],["CVE-2026-111626","Webreaper","Damselfly","Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111624","umbraco","Umbraco-CMS","Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111625","10up","Distributor","10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111623","joey-zhou","xiaozhi-esp32-server-java","Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issua","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111621","TDuckCloud","tduck-survey-form","TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111622","a466350665","smart-sso","smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri","HIGH",7.6,"2026-10-16",0],["CVE-2026-111620","O2OA","O2OA","O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint","MEDIUM",6,"2026-10-16",0],["CVE-2026-111619","zyx0814","FilePress","FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php","HIGH",7.1,"2026-10-16",0],["CVE-2026-111617","MGdaasLab","WHartTest","WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111618","coaidev","CoAI","CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111616","Oqtane","Oqtane Framework","Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111614","devlive-community","DataCap","DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials","HIGH",7.1,"2026-10-16",0],["CVE-2026-111615","gz-yami","mall4cloud","Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint","HIGH",7.1,"2026-10-16",0],["CVE-2026-111613","alldatacenter","alldata","AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test","HIGH",8.7,"2026-10-16",0],["CVE-2026-111611","roncoo","roncoo-education","roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111612","qaiu","netdisk-fast-download","netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth","HIGH",8.7,"2026-10-16",0],["CVE-2026-111610","b3log","Solo","B3log Solo through 4.4.0 Missing Authorization in ArticleConsole","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111608","jeequan","jeepay","Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}","LOW",2.3,"2026-10-16",0],["CVE-2026-111609","PKP","Open Journal Systems","PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscri","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111607","jeequan","jeepay","Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs","HIGH",7.1,"2026-10-16",0],["CVE-2026-111606","hcengineering","Huly Platform","Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC","HIGH",8.6,"2026-10-16",0],["CVE-2026-111604","elunez","eladmin","eladmin through 2.7 Broken Access Control via /api/users Update and Delete","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111605","dromara","Jpom","Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController","HIGH",8.6,"2026-10-16",0],["CVE-2026-111603","PlayEdu","PlayEdu","PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111392","sgl-project","sglang","SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-109839","IBM","Db2 Genius Hub","IBM Db2 Genius Hub Missing Cryptographic Step","LOW",3.1,"2026-10-16",0],["CVE-2026-102552","FreeRTOS","FreeRTOS-Plus-TCP","Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS re","HIGH",8.2,"2026-10-16",0],["CVE-2026-102551","FreeRTOS","FreeRTOS-Plus-TCP","Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-80092","Microsoft","microsoft-identity-web","Microsoft Identity Web Elevation of Privilege Vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-109461","Microsoft","Microsoft Identity Client for NodeJS","Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability","MEDIUM",5.9,"2026-10-16",0],["CVE-2026-109588","FreeRTOS","FreeRTOS-Kernel","Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-109587","FreeRTOS","FreeRTOS-Kernel","Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-59962","TandoorRecipes","recipes","Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-59967","TandoorRecipes","recipes","Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-49868","RIOT-OS","RIOT","RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underfl","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-102693","RIOT-OS","RIOT","RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID","CRITICAL",9.6,"2026-10-16",0],["CVE-2026-102692","RIOT-OS","RIOT","RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memo","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-62362","PBH-BTN","PeerBanHelper","PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis end","MEDIUM",4.9,"2026-10-16",0],["CVE-2026-86047","MariaDB","server","MariaDB: Insufficient quoting in mariadb-dump and SHOW commands","HIGH",7.7,"2026-10-16",0],["CVE-2026-85745","MariaDB","server","MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-85748","MariaDB","server","MariaDB: Use-after-free with a large number of SYS_REFCURSOR's","CRITICAL",9.9,"2026-10-16",0],["CVE-2026-85746","MariaDB","server","MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","CRITICAL",9.9,"2026-10-16",0],["CVE-2026-92262","MariaDB","server","MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.","CRITICAL",9.9,"2026-10-16",0],["CVE-2026-97380","MariaDB","server","MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges","HIGH",8.8,"2026-10-16",0],["CVE-2026-85985","MariaDB","server","MariaDB: Unauthorized file access via CONNECT engine UDFs","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-86009","Mailu","Mailu","Mailu: Domain managers can allow themselves to spoof on other hosted domains they should n","HIGH",8.2,"2026-10-16",0],["CVE-2026-86008","Mailu","Mailu","Mailu domain managers can take over higher-privileged accounts","HIGH",7.2,"2026-10-16",0],["CVE-2026-57169","Finsys","dockhand","Dockhand: Unauthenticated container exec via WebSocket upgrade","CRITICAL",9.6,"2026-10-16",0],["CVE-2026-77474","Dicklesworthstone","destructive_command_guard","dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg a","HIGH",7.1,"2026-10-16",0],["CVE-2026-44977","Countly","countly-server","countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin","CRITICAL",9,"2026-10-16",0],["CVE-2026-41582","Countly","countly-server","countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Lead","HIGH",7.5,"2026-10-16",0],["CVE-2026-42270","Countly","countly-server","countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception","HIGH",7.5,"2026-10-16",0],["CVE-2026-42269","Countly","countly-server","countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directo","HIGH",8.1,"2026-10-16",0],["CVE-2026-102923","CodeWithCJ","SparkyFitness","SparkyFitness: SSRF via unvalidated custom_url in AI service settings","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-92263","CodeWithCJ","SparkyFitness","SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename i","HIGH",7.2,"2026-10-16",0],["CVE-2026-68906","mz-automation","libiec61850","libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsin","HIGH",8.7,"2026-10-16",0],["CVE-2026-68907","mz-automation","libiec61850","libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset ","HIGH",8.2,"2026-10-16",0],["CVE-2026-68908","mz-automation","libiec61850","libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in ","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-57446","mz-automation","libiec61850","libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handl","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-48741","mz-automation","libiec61850","libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to ","HIGH",7.5,"2026-10-16",0],["CVE-2026-48503","mz-automation","libiec61850","libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPos","HIGH",7.5,"2026-10-16",0],["CVE-2026-111581","Red Hat","Red Hat Enterprise Linux 10","Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks","LOW",3.3,"2026-10-16",0],["CVE-2026-102941","gomarkdown","markdown","gomarkdown/markdown IsSafeURL panics on short URLs","HIGH",7.5,"2026-10-16",0],["CVE-2026-77630","pupnp","pupnp","pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing","HIGH",7.5,"2026-10-16",0],["CVE-2026-96425","UBports","lomiri-download-manager","Incorrect Permission Assignment for Critical Resource in lomiri-download-manager","MEDIUM",5.5,"2026-10-16",0],["CVE-2026-96424","UBports","lomiri-download-manager","Incorrect Permission Assignment for Critical Resource in lomiri-download-manager","HIGH",7.8,"2026-10-16",0],["CVE-2026-57488","pupnp","pupnp","pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling","HIGH",7.1,"2026-10-16",0],["CVE-2026-57487","pupnp","pupnp","libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered","HIGH",7.5,"2026-10-16",0],["CVE-2026-57486","pupnp","pupnp","pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes","HIGH",7.5,"2026-10-16",0],["CVE-2026-55862","pupnp","pupnp","pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-57447","discourse","discourse-doc-categories","Discourse Doc Categories: Doc category index refresh leaks private topic titles","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-55543","helge17","tuxguitar","TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file","HIGH",8.5,"2026-10-16",0],["CVE-2026-55836","open-zaak","open-zaak","Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import ","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-54657","open-zaak","open-zaak","Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter r","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-95859","libp2p","rust-libp2p","libp2p-rust: Gossipsub GRAFT topics unbounded growth","HIGH",8.7,"2026-10-16",0],["CVE-2026-111728","5rahim","Seanime","Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-107777","Thermo Fisher","Torrent Suite Software","Thermo Fisher Torrent Suite Software Path Traversal","HIGH",7.1,"2026-10-16",0],["CVE-2026-105667","J4Care","dcm4chee-arc-light","J4Care dcm4che Missing Authentication for Critical Function","HIGH",8.7,"2026-10-16",0],["CVE-2026-105279","J4Care","dcm4chee-arc-light","J4Care dcm4che Missing Authentication for Critical Function","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-101021","J4Care","dcm4chee-arc-light","J4Care dcm4che Inefficient Algorithmic Complexity","HIGH",8.7,"2026-10-16",0],["CVE-2026-105273","J4Care","dcm4chee-arc-light","J4Care dcm4che Loop with Unreachable Exit Condition","HIGH",8.7,"2026-10-16",0],["CVE-2026-107621","J4Care","dcm4chee-arc-light","J4Care dcm4che Loop with Unreachable Exit Condition","HIGH",8.7,"2026-10-16",0],["CVE-2026-97851","J4Care","dcm4chee-arc-light","J4Care dcm4che Missing Authorization","HIGH",8.8,"2026-10-16",0],["CVE-2026-105664","Guangzhou Juan IoT Technology Co., Ltd.","EseeCloud App","Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-97858","Guangzhou Juan IoT Technology Co., Ltd.","EseeCloud App","Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-107617","Guangzhou Juan IoT Technology Co., Ltd.","EseeCloud App","Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-110805","Devolutions","Server","Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 an","LOW",2.6,"2026-10-16",0],["CVE-2026-110804","Devolutions","Server","Improperly controlled modification of JIT elevation settings in PAM checkout in Devolution","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-110806","Devolutions","Server","Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-110287","Devolutions","Server","Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and ear","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-18516","Arcadia Technology, LLC","Crafty Controller","Improper Encoding or Escaping of Output in Crafty Controller","CRITICAL",9.6,"2026-10-16",0],["CVE-2026-90821","Arcadia Technology, LLC","Crafty Controller","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Cr","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-97470","themefic","Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental","Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Con","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-111413","aThemeArt","aThemeArt Theme Helper","WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulne","HIGH",8.8,"2026-10-16",0],["CVE-2026-110896","WP Chill","Passster","WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-107564","gocsaf Development Community","csaf_provider","gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption","HIGH",8.7,"2026-10-16",0],["CVE-2026-111400","IdeaBox Creations","PowerPack Addons for Elementor","WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vuln","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-111396","Liquid Web / StellarWP","Advanced Post Manager","WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability","HIGH",7.1,"2026-10-16",0],["CVE-2026-111409","YITH","YITH PayPal Express Checkout for WooCommerce","WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Co","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-110903","Liquid Web / StellarWP","The Events Calendar","WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-110900","Liquid Web / StellarWP","BookIt","WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-110901","WPMU DEV","SmartCrawl","WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerabi","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-110380","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111405","PT Norther Lights Production","MapSVG","WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-111399","PT Norther Lights Production","MapSVG","WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability","HIGH",8.5,"2026-10-16",0],["CVE-2026-111397","PT Norther Lights Production","MapSVG","WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111555","Red Hat","Red Hat Enterprise Linux 10","Luksmeta: missing slot-range validation permits out-of-gap device i/o","MEDIUM",6,"2026-10-16",0],["CVE-2026-105958","Red Hat","Red Hat Enterprise Linux 6","Spice-server: spice: heap oob read/write via unchecked migration data offsets","HIGH",7.5,"2026-10-16",0],["CVE-2026-68571","Apache Software Foundation","Apache Kylin","Apache Kylin: JDBC URL Whitelist Verification Bypass","HIGH",8.8,"2026-10-16",0],["CVE-2026-64959","Apache Software Foundation","Apache Kylin","Apache Kylin: Missing authentication on certain cache API endpoints","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-64610","Apache Software Foundation","Apache Kylin","Apache Kylin: Redis unsafe Java deserialization","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-63619","Apache Software Foundation","Apache Kylin","Apache Kylin: Missing authorization and path-confinement on system meta dump","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-63618","Apache Software Foundation","Apache Kylin","Apache Kylin: Low-Privilege Config Exposure","HIGH",7.5,"2026-10-16",0],["CVE-2026-105959","Red Hat","Red Hat Enterprise Linux 6","Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati","HIGH",7.5,"2026-10-16",0],["CVE-2026-111391","sgl-project","sglang","SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-111390","erupts","erupt","Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API","MEDIUM",6,"2026-10-16",0],["CVE-2026-107648","switcorp","WP Sessions Time Monitoring Full Automatic","WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Sc","HIGH",7.2,"2026-10-16",0],["CVE-2026-110029","","Squeeze","Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-109930","","MAIO","MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-109119","ikus-soft","rdiffweb","Missing Authorization in rdiffweb","HIGH",8.8,"2026-10-16",0],["CVE-2026-109118","ikus-soft","rdiffweb","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb","MEDIUM",4.6,"2026-10-16",0],["CVE-2026-14452","Checkmk GmbH","Checkmk","Open redirect and XSS via reset_url parameter","HIGH",8.6,"2026-10-16",0],["CVE-2026-106030","Nord Security","NordVPN","Missing Authorization in NordVPN for Windows","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-107649","liedekef","Events Made Easy","Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[locati","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-110703","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'pos","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-96768","softaculous","GoSMTP Pro","GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ","HIGH",7.2,"2026-10-16",0],["CVE-2026-101300","Wegow Technologies","Wegow","Server-Side Request Forgery in Wegow PDF export","HIGH",7.1,"2026-10-16",0],["CVE-2026-15575","SFM Software Technologies Inc.","Costifier","Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-15219","SFM Software Technologies Inc.","Costifier","IDOR in SFM Software's Costifier","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-111472","TSG","Profleet","SQL injection in TSG Profleet","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-104003","properfraction","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Rest","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-104726","jeroenpeters1986","Name Directory","Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'd","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-109224","surecart","SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'templa","HIGH",7.2,"2026-10-16",0],["CVE-2026-92766","appsbd","Vitepos – Point of Sale (POS) for WooCommerce","Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter","HIGH",7.5,"2026-10-16",0],["CVE-2026-93681","themeum","Tutor LMS – eLearning and online course solution","Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_n","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-111311","samuelgallegos","DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More","DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload ","HIGH",8.8,"2026-10-16",0],["CVE-2026-14177","IKAS Technology Inc.","ikas E-Commerce Infrastructure","User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructu","HIGH",7.5,"2026-10-16",0],["CVE-2026-100108","maxfoundry","Social Share Buttons","Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-96870","brainstormforce","SureDash – Community, Courses & Member Dashboard","SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-100106","damian-gora","FiboSearch – Ajax Search for WooCommerce","FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purcha","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-75903","manuelgalan","Vulnity Security","Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exp","HIGH",8.1,"2026-10-16",0],["CVE-2026-87111","WPEverest","User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin","User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Refe","HIGH",7.2,"2026-10-16",0],["CVE-2026-18799","Mattermost","Mattermost","Mattermost Server fails to restrict Slack import account binding, allowing team admins to ","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-16251","Mattermost","Mattermost","Mattermost local image proxy allows server memory exhaustion via unbounded image response ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-18256","Mattermost","Mattermost","Private team metadata disclosure via the team search API","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-18223","Mattermost","Mattermost","Mattermost invitation tokens not bound to invited email address allowing unauthorized team","MEDIUM",5,"2026-10-16",0],["CVE-2026-19076","Mattermost","Mattermost","Mattermost fails to reject OAuth application sessions in account type switch, allowing acc","MEDIUM",4.4,"2026-10-16",0],["CVE-2026-18560","Mattermost","Mattermost","Improper order of authorisations in Mattermost GetFile API leads to an authenticated user ","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-16453","Mattermost","Mattermost","Mattermost SAML RelayState forgery allows unauthorized team membership","HIGH",7.1,"2026-10-16",0],["CVE-2026-19600","Mattermost","Mattermost","Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth ","MEDIUM",4.5,"2026-10-16",0],["CVE-2026-19621","Mattermost","Mattermost","Mattermost leaks interactive-message integration secrets to non-admin users via post-delet","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-19603","Mattermost","Mattermost","Private channel ID disclosure via user status endpoints","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-18795","Mattermost","Mattermost","Missing server side validation allowed user to quarantine a DM and GM post","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-94169","Theme-one","The Grid","WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability","CRITICAL",10,"2026-10-16",0],["CVE-2026-94388","halfdata","Green Popups","WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-96339","Houzez.co","Houzez","WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-16",0],["CVE-2026-97296","Rocketgenius, Inc","Gravity Forms","WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability","HIGH",8.1,"2026-10-16",0],["CVE-2026-19867","Mattermost","Mattermost","Uncapped mention keys in user notification properties allow CPU exhaustion during post pro","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-19601","Mattermost","Mattermost","Disclosure of AD/LDAP bind password via Test Connection","MEDIUM",4.9,"2026-10-16",0],["CVE-2026-18551","Mattermost","Mattermost","Mattermost guest account privilege escalation via member roles API","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-19541","Mattermost","Mattermost","Outgoing OAuth connection client secret exposure during connection validation","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-110366","Gemini Labs","Site Reviews","WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-104715","Red Hat","Red Hat Enterprise Linux 10","Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by","HIGH",7.8,"2026-10-16",0],["CVE-2026-15222","wpeverest","User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode ","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-92115","opajaap","WP Photo Album Plus","WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' ","HIGH",8.8,"2026-10-16",0],["CVE-2026-109401","smub","WP Mail Logging","WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure ","LOW",2.7,"2026-10-16",0],["CVE-2026-97640","smub","WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)","WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via S","HIGH",7.2,"2026-10-16",0],["CVE-2026-104730","sunshinephotocart","Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers","Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-109193","hivepress","HivePress – Business Directory, Listings & Classified Ads Plugin","HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribut","HIGH",7.2,"2026-10-16",0],["CVE-2026-110252","etruel","WPeMatico RSS Feed Fetcher","WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Fe","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-109382","bilalnaseer","WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents","WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-19798","tusharimran","WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters","WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Ma","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-104755","aresit","WP Compress – Instant Performance & Speed Optimization","WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value'","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-107768","cozmoslabs","TranslatePress – Translate Multilingual sites with AI Translation","TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor h","HIGH",7.2,"2026-10-16",0],["CVE-2026-109388","hivepress","HivePress – Business Directory, Listings & Classified Ads Plugin","HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-110290","ajay","WebberZone Top 10 — Popular Posts","WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-92553","yaycommerce","YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports","YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filena","HIGH",8.8,"2026-10-16",0],["CVE-2026-111069","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twi","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-107770","tigroumeow","Photo Engine (Media Organizer & Lightroom)","Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthentic","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-110664","codename065","Premium Packages – Sell Digital Products Securely","Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Or","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-110701","codepeople","CP Multi View Events Calendar","CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via ","HIGH",7.2,"2026-10-16",0],["CVE-2026-111178","murgroland","WP Booking System – Booking Calendar","WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' ","MEDIUM",4.9,"2026-10-16",0],["CVE-2026-107646","realmag777","HUSKY – Products Filter for WooCommerce Professional","HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localize","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-110039","","Smush","Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite","LOW",2.7,"2026-10-16",0],["CVE-2026-110135","","OTP Login & Register Woocommerce","OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ","HIGH",7.4,"2026-10-16",0],["CVE-2026-110179","","affiliate-toolkit","affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-110191","","Product Delivery Date for WooCommerce","Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disc","LOW",2.7,"2026-10-16",0],["CVE-2026-109982","","MB Custom Post Types & Custom Taxonomies","MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via ","MEDIUM",4.2,"2026-10-16",0],["CVE-2026-110012","","Salon Booking System","Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upco","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-110013","","Salon Booking System","Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Acc","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-110014","","Salon Booking System","Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-110015","","Salon Booking System","Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF","HIGH",8.8,"2026-10-16",0],["CVE-2026-103696","","Mobile builder","Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-105973","","Visual Form Builder","Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Autho","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-105974","","Visual Form Builder","Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-74923","","Document Gallery","Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_genera","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-92427","","Coinsnap Bitcoin Crowdfunding","Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhoo","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-91830","","Subscribe to Comments","Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-91833","","WX Subscribe  微信支付付费订阅","WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-100186","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name","HIGH",7.2,"2026-10-16",0],["CVE-2026-104932","johnny5","Search Regex","Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Seriali","HIGH",8,"2026-10-16",0],["CVE-2026-85659","ontraport","PilotPress","PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeov","HIGH",8.8,"2026-10-16",0],["CVE-2026-88963","themeum","Tutor LMS – eLearning and online course solution","Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting ","MEDIUM",6.1,"2026-10-16",0],["CVE-2026-107764","gpriday","SiteOrigin CSS","SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Commen","HIGH",7.2,"2026-10-16",0],["CVE-2026-109414","appsbd","Vitepos – Point of Sale (POS) for WooCommerce","Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-109513","wpdevteam","NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter ","HIGH",7.2,"2026-10-16",0],["CVE-2026-103768","elextensions","ELEX WordPress HelpDesk & Customer Ticketing System","ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary F","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-111122","gpriday","SiteOrigin CSS","SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Commen","HIGH",7.2,"2026-10-16",0],["CVE-2026-89051","johndarrel","Hide My WP Ghost – Security & Firewall","Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Conte","HIGH",7.2,"2026-10-16",0],["CVE-2026-103896","10web","10Web Booster – Website speed optimization, Cache & Page Speed optimizer","10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-s","HIGH",7.5,"2026-10-16",0],["CVE-2026-109232","wordpresschef","Salon Booking System – Appointment Booking for Salons, Barbershops & Spas","Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom C","HIGH",7.2,"2026-10-16",0],["CVE-2026-109447","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter v","HIGH",8.1,"2026-10-16",0],["CVE-2026-104001","rilwis","Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated","Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biogra","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-95809","optiuser","Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights","Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'coun","HIGH",7.2,"2026-10-16",0],["CVE-2026-12272","daext","Lightweight Cookie Notice – Cookie Banner for Cookie Consent","Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURI","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-89079","jfarthing84","Theme My Login","Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Param","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-93767","tainacan","Tainacan","Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-104000","croixhaug","Simply Schedule Appointments","Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting vi","HIGH",7.2,"2026-10-16",0],["CVE-2026-95686","optiuser","Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights","Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targ","HIGH",7.2,"2026-10-16",0],["CVE-2026-103480","themefic","Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental","Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Sho","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-103999","themefic","Ultra Addons for Contact Form 7","Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting vi","HIGH",7.2,"2026-10-16",0],["CVE-2026-107748","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vi","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-100158","elvinhaci","SQL Chart Builder","SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via S","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-110017","fullworks","Quick PayPal Payments: Payment Button & Form","Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Store","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-96570","magazine3","Schema & Structured Data for WP & AMP","Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scriptin","HIGH",7.2,"2026-10-16",0],["CVE-2026-111458","adulau","ssldump","ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-107659","wpchill","Modula Image Gallery – Photo Grid & Video Gallery","Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Inform","HIGH",7.5,"2026-10-16",0],["CVE-2026-109221","trainingbusinesspros","Groundhogg — CRM, Newsletters, and Marketing Automation","Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CS","HIGH",8.1,"2026-10-16",0],["CVE-2026-103481","mpol","Gwolle Guestbook","Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter","MEDIUM",6.1,"2026-10-16",0],["CVE-2026-104798","joedolson","My Calendar – Accessible Event Manager","My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflect","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-110019","niklaslindemann","Bulk Page Generator – LPagery","Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitr","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-107746","teamfunnelkit","FunnelKit – Funnel Builder Plugin for WooCommerce Checkout","FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Dis","HIGH",7.5,"2026-10-16",0],["CVE-2026-110590","klarnaplugin","Klarna for WooCommerce","Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Info","HIGH",7.5,"2026-10-16",0],["CVE-2026-111114","posimyththemes","Nexter Extension – Security, Performance, Code Snippets & Site Toolkit","Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-vi","HIGH",7.5,"2026-10-16",0],["CVE-2026-103911","wpmudev","Forminator Forms – Contact Form, Payment Form & Custom Form Builder","Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-109998","kitae-park","Mang Board","Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter ","HIGH",7.2,"2026-10-16",0],["CVE-2026-109191","extendthemes","Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy","Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin P","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-109400","instawp","InstaWP Connect – 1-click WP Staging & Migration","InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-","HIGH",7.5,"2026-10-16",0],["CVE-2026-109515","properfraction","MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mapping","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-103525","wpmanageninja","FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler","FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthent","HIGH",7.5,"2026-10-16",0],["CVE-2026-110721","wpdevteam","NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Inject","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-103895","cyberlord92","miniOrange OTP Login, Verification and SMS Notifications","miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authen","HIGH",8.1,"2026-10-16",0],["CVE-2026-109512","kitae-park","Mang Board","Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-111106","getwpfunnels","Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance","Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-101335","wpmudev","Forminator Forms – Contact Form, Payment Form & Custom Form Builder","Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-109219","kitae-park","Mang Board","Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-96562","wpmudev","Broken Link Checker","Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-111451","Wheels","Wheels CLI","Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values ","HIGH",7.8,"2026-10-16",0],["CVE-2026-111450","Wheels","Wheels","Wheels through 4.1.1 derives its default production error-email address from the Host head","MEDIUM",5.9,"2026-10-16",0],["CVE-2026-111449","Wheels","Wheels","Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=t","MEDIUM",5.9,"2026-10-16",0],["CVE-2026-111448","Wheels","Wheels","Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on","LOW",3.7,"2026-10-16",0],["CVE-2026-111447","Wheels","Wheels","Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without","HIGH",8.1,"2026-10-16",0],["CVE-2026-107758","extendthemes","Colibri Page Builder","Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments","HIGH",7.2,"2026-10-16",0],["CVE-2026-109207","themeisle","RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS m","HIGH",7.2,"2026-10-16",0],["CVE-2026-89280","dokaninc","Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy","Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct ","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-104745","wpcodefactory","Customer Email Verification for WooCommerce","Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalatio","HIGH",8.1,"2026-10-16",0],["CVE-2026-104769","asadkn","Debloat – Remove Unused CSS, Optimize JS","Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @impor","MEDIUM",5.9,"2026-10-16",0],["CVE-2026-97339","complianz","Complianz GDPR/CCPA Cookie Consent Banner","Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scr","HIGH",7.2,"2026-10-16",0],["CVE-2026-103518","wpmanageninja","FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler","FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection ","MEDIUM",4.9,"2026-10-16",0],["CVE-2026-109990","gijo","Flying Scripts: Delay JavaScript to Improve Site Speed & Performance","Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenti","HIGH",7.2,"2026-10-16",0],["CVE-2026-93953","softaculous","Backuply – Backup, Restore, Migrate and Clone","Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to ","HIGH",8,"2026-10-16",0],["CVE-2026-77829","goratech","Cooked – Recipe Management","Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-ti","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-93535","wppool","Dark Mode – Improve Accessibility with AI Powered Dark Theme","WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated ","MEDIUM",6.4,"2026-10-16",0],["CVE-2026-111446","Wheels","Wheels","Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remo","HIGH",8.6,"2026-10-16",0],["CVE-2026-111445","Wheels","Wheels","Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-","HIGH",8.1,"2026-10-16",0],["CVE-2026-111444","Wheels","Wheels","Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-111443","Wheels","Wheels","Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-111442","BackdropCMS","Backdrop","Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently vali","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-109813","Moxa","AIG-302 Series","Shared Hard-coded Root CA Private Key","HIGH",8.6,"2026-10-16",0],["CVE-2026-109812","Moxa","AIG-302 Series","Missing Authorization on Secret Endpoints","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-100159","ays-pro","Popup Box – Create Countdown, Coupon, Video, Contact Form Popups","Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-105228","Deltaww","ISPSoft","ISPSoft Out-of-Bounds Read Vulnerability","HIGH",7,"2026-10-16",0],["CVE-2026-105227","Deltaww","ISPSoft","ISPSoft Out-of-Bounds Read Vulnerability","HIGH",7,"2026-10-16",0],["CVE-2026-111389","frappe","hrms","Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation","HIGH",8.3,"2026-10-16",0],["CVE-2026-111388","frappe","frappe","Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111387","nezhahq","nezha","Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint","HIGH",7.1,"2026-10-16",0],["CVE-2026-111385","nezhahq","nezha","Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111386","nezhahq","nezha","Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111384","nezhahq","nezha","Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket","HIGH",7.1,"2026-10-16",0],["CVE-2026-111383","nezhahq","nezha","Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket","HIGH",7.1,"2026-10-16",0],["CVE-2026-111382","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine","HIGH",8.7,"2026-10-16",0],["CVE-2026-111381","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser","HIGH",7,"2026-10-16",0],["CVE-2026-111380","FreeRDP","FreeRDP","FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends","HIGH",8.7,"2026-10-16",0],["CVE-2026-111379","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3","HIGH",7,"2026-10-16",0],["CVE-2026-111378","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser","HIGH",8.7,"2026-10-16",0],["CVE-2026-111377","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly","HIGH",7.1,"2026-10-16",0],["CVE-2026-111376","FreeRDP","FreeRDP","FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE","LOW",2.3,"2026-10-16",0],["CVE-2026-111375","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111374","FreeRDP","FreeRDP","FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest","MEDIUM",6,"2026-10-16",0],["CVE-2026-111373","FreeRDP","FreeRDP","FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111237","Ultralytics","FastSAM","Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_","MEDIUM",4.8,"2026-10-16",0],["CVE-2026-111212","ImprintLab","Medical-SAM-Adapter","ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelm","LOW",2.4,"2026-10-16",0],["CVE-2026-111210","","bitcoinj","bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forger","MEDIUM",6.9,"2026-10-16",0],["CVE-2025-52097","","","Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an a","","","2026-10-16",0],["CVE-2025-55640","","","A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box","","","2026-10-16",0],["CVE-2025-55653","","","GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfra","MEDIUM",5.5,"2026-10-16",0],["CVE-2025-66969","","","Integer overflow in OpenModSim (<=1.11.0), leading to denial of service","HIGH",7.5,"2026-10-16",0],["CVE-2026-106705","","","ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the ro","HIGH",8.8,"2026-10-16",0],["CVE-2026-26846","","","Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a re","CRITICAL",9.8,"2026-10-16",0],["CVE-2026-46471","","","An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 ","MEDIUM",5.5,"2026-10-16",0],["CVE-2026-46472","","","An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 ","HIGH",7.5,"2026-10-16",0],["CVE-2026-88755","","","Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP ser","HIGH",7.8,"2026-10-16",0],["CVE-2026-95182","","","An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to exe","CRITICAL",10,"2026-10-16",0],["CVE-2026-95183","","","An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allow","HIGH",8.8,"2026-10-16",0],["CVE-2026-84823","Red Hat","Red Hat Enterprise Linux 8","Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configurat","HIGH",7.1,"2026-10-16",0],["CVE-2026-92777","Lenovo","Idea Tab Pro (TB373FU)","A potential vulnerability was reported in some Lenovo Tablets that could allow a user with","MEDIUM",5.4,"2026-10-16",0],["CVE-2026-92629","Lenovo","Baiying PC Client","A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client,","HIGH",7,"2026-10-16",0],["CVE-2026-89062","Lenovo","Energy Management Driver","A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-89057","Lenovo","Idea Tab Pro (TB373FU)","A potential authentication bypass vulnerability was reported in some Lenovo tablets that c","HIGH",7,"2026-10-16",0],["CVE-2026-75941","Lenovo","Legion Zone Application","A potential vulnerability was reported in the Lenovo Legion Zone application, distributed ","HIGH",8.6,"2026-10-16",0],["CVE-2026-16755","Lenovo","Smart Camera C33","A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively","MEDIUM",6,"2026-10-16",0],["CVE-2026-16754","Lenovo","Smart Camera C33","A potential improper certificate validation vulnerability was reported in Lenovo Smart Cam","MEDIUM",5.9,"2026-10-16",0],["CVE-2026-110914","Google","Chrome","Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote atta","HIGH",8.8,"2026-10-16",0],["CVE-2026-110915","Google","Chrome","Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote att","HIGH",8.8,"2026-10-16",0],["CVE-2026-110916","Google","Chrome","Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a rem","CRITICAL",9.6,"2026-10-16",0],["CVE-2026-110917","Google","Chrome","Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-110918","Google","Chrome","Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacke","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-110920","Google","Chrome","Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker ","HIGH",8.8,"2026-10-16",0],["CVE-2026-110921","Google","Chrome","Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to ","HIGH",8.8,"2026-10-16",0],["CVE-2026-110913","Google","Chrome","Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker","HIGH",8.8,"2026-10-16",0],["CVE-2026-110919","Google","Chrome","Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to ","HIGH",8.8,"2026-10-16",0],["CVE-2026-110922","Google","Chrome","Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attac","HIGH",8.8,"2026-10-16",0],["CVE-2026-111369","classroomio","ClassroomIO","ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes","HIGH",7.1,"2026-10-16",0],["CVE-2026-111368","classroomio","ClassroomIO","ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes","MEDIUM",6.1,"2026-10-16",0],["CVE-2026-111367","aaPanel","BillionMail","BillionMail through 4.9 Forgeable JWTs via Default Signing Key","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111365","cool-team-official","cool-admin-midway","cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints","HIGH",7,"2026-10-16",0],["CVE-2026-111366","cool-team-official","cool-admin-midway","cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints","HIGH",8.6,"2026-10-16",0],["CVE-2026-111364","mindoc-org","MinDoc","MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch","HIGH",7.1,"2026-10-16",0],["CVE-2026-111359","crmeb","CRMEB","CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift","HIGH",7.1,"2026-10-16",0],["CVE-2026-111363","dataelement","bisheng","BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox","HIGH",7.1,"2026-10-16",0],["CVE-2026-111358","mettle","sendportal-core","SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber For","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111356","magicblack","MacCMS","MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-111355","zhontai","Admin.Core","zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID End","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111353","Peppermint-Lab","peppermint","Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload End","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111354","crmeb","crmeb_java","crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints","LOW",2.3,"2026-10-16",0],["CVE-2026-111352","ThinkCMF","ThinkCMF","ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API","HIGH",8.7,"2026-10-16",0],["CVE-2026-111351","metasfresh","metasfresh","metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API","LOW",2.3,"2026-10-16",0],["CVE-2026-111349","puemos","Craftplan","Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111350","papermark","Papermark","Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API","LOW",2.3,"2026-10-16",0],["CVE-2026-111348","likeshop","likeshop","Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111347","opsre","go-ldap-admin","go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd","HIGH",8.2,"2026-10-16",0],["CVE-2026-111345","polonel","trudesk","Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111346","easysoft","zentaopms","ZenTao PMS through 22.6 Authorization Bypass via action::editComment","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111344","apitable","apitable","APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111332","AtalayaLabs","OxiCloud","OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie","MEDIUM",6.3,"2026-10-16",0],["CVE-2026-111343","pig-mesh","pig","pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111331","Dokploy","Dokploy","Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111329","juggleim","JuggleIM","JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111330","juggleim","JuggleIM","JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1","HIGH",8.2,"2026-10-16",0],["CVE-2026-111324","lejianwen","rustdesk-api","rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111322","coleam00","Archon","Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111323","samugit83","RedAmon","RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111321","TaskingAI","TaskingAI","TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions","MEDIUM",5.3,"2026-10-16",0],["CVE-2026-111320","ValueCell-ai","ValueCell","ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111312","OpenHealthForAll","OpenHealth","OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route","CRITICAL",9.2,"2026-10-16",0],["CVE-2026-111313","DaKheera47","JobOps","JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch","HIGH",7.1,"2026-10-16",0],["CVE-2026-111284","Webkul","Aureus ERP","Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal","MEDIUM",5.1,"2026-10-16",0],["CVE-2026-111282","driftregion","iso14229","iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer","HIGH",8.8,"2026-10-16",0],["CVE-2026-111283","BMC Helix","BMC Helix Network Management","BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configu","CRITICAL",9.5,"2026-10-16",0],["CVE-2026-111281","Jooan","JA-A12","Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials","CRITICAL",9.3,"2026-10-16",0],["CVE-2026-111280","davenardella","snap7","snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea","HIGH",8.3,"2026-10-16",0],["CVE-2026-111278","nivocart","nivocart","NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111279","dragonflydb","dragonfly","Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRAN","HIGH",8.7,"2026-10-16",0],["CVE-2026-111277","nivocart","nivocart","NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download","HIGH",8.7,"2026-10-16",0],["CVE-2026-111275","NIFTI-Imaging","nifti_clib","nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111274","selmf","unarr","unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-111272","LibRaw","LibRaw","LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-111273","selmf","unarr","unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111271","Konstanty Bialkowski","libmodplug","libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2","MEDIUM",6.8,"2026-10-16",0],["CVE-2026-111270","Konstanty Bialkowski","libmodplug","libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM","MEDIUM",6.9,"2026-10-16",0],["CVE-2024-58397","enzo1982","mp4v2","MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-111269","libical","libical","libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string","MEDIUM",6.9,"2026-10-16",0],["CVE-2026-94135","Apache Software Foundation","Apache Airflow SFTP provider","Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default","MEDIUM",4.3,"2026-10-16",0],["CVE-2026-96806","Apache Software Foundation","Apache Airflow Keycloak provider","Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the se","MEDIUM",5.8,"2026-10-16",0],["CVE-2026-94134","Apache Software Foundation","Apache Airflow SSH provider","Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key veri","CRITICAL",9.1,"2026-10-16",0],["CVE-2026-92228","Apache Software Foundation","Apache Airflow Keycloak provider","Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role ","MEDIUM",6.5,"2026-10-16",0],["CVE-2026-109468","Microsoft","Microsoft Visual Studio 2022 version 17.14","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-108454","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108455","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108452","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108453","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108450","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108451","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108449","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108446","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108447","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108448","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-108445","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108443","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108444","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108441","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108442","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108439","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108440","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108437","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108438","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108435","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108436","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108433","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Security Feature Bypass Vulnerability","HIGH",7.8,"2026-10-15",0],["CVE-2026-108434","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108431","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108432","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108428","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108429","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108430","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108427","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-108426","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-111357","Ivanti","Connect Secure","Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts ","HIGH",7,"2026-10-15",0],["CVE-2026-105040","EnergizeLab","NestJS auth service","EnergizeLab Eilik User-ID Mass Assignment Account Takeover","HIGH",8.8,"2026-10-15",0],["CVE-2026-105039","EnergizeLab","station-middleware","EnergizeLab Station Middleware Admin APIs Missing Role Checks","CRITICAL",9.6,"2026-10-15",0],["CVE-2026-105038","EnergizeLab","FastAPI AI inference server","EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-105037","EnergizeLab","station-middleware","EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read","CRITICAL",9.9,"2026-10-15",0],["CVE-2026-105036","EnergizeLab","Robot firmware (mode 104000)","EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks","HIGH",7.5,"2026-10-15",0],["CVE-2026-105035","EnergizeLab","FirmwareUpdater","EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key","HIGH",7.8,"2026-10-15",0],["CVE-2026-105034","EnergizeLab","NestJS auth service","EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers","HIGH",8.2,"2026-10-15",0],["CVE-2026-105033","EnergizeLab","AI Station firmware (RK3562)","EnergizeLab AI Station Default Root Credentials with SSH Enabled","HIGH",8.8,"2026-10-15",0],["CVE-2026-105032","EnergizeLab","FastAPI AI inference server","EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-102764","BeyondTrust","Remote Support","Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support","CRITICAL",9.3,"2026-10-15",1],["CVE-2026-104198","ZoneMinder","zoneminder","ZoneMinder failed token handling bypasses web authentication","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-108126","Temporal Technologies, Inc.","temporal-proxy","temporal-proxy payload decryption is not bound to the request namespace","MEDIUM",6,"2026-10-15",0],["CVE-2026-45165","Palo Alto Networks","Idira Secrets Manager (Self-Hosted)","Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API","HIGH",8.6,"2026-10-15",0],["CVE-2026-111172","stalniy","@casl/ability","@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath","MEDIUM",6,"2026-10-15",0],["CVE-2026-111170","kedro-org","kedro-datasets","kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name","HIGH",7.1,"2026-10-15",0],["CVE-2026-111171","ethereum","web3.py","Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-111168","abhinavxd","libredesk","LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-111169","suitenumerique","docs","La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation","LOW",2.3,"2026-10-15",0],["CVE-2026-111167","GNU","LibreDWG","GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111166","sezero","libmikmod","libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111164","UADE","uade","UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111165","sezero","libmikmod","libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111163","Mindwerks","WildMIDI","WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111161","Wohlstand","libADLMIDI","libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111162","Mindwerks","WildMIDI","WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111160","ModelTC","LightLLM","LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization","HIGH",8.7,"2026-10-15",0],["CVE-2026-111159","libyal","libewf","libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111157","SoX","sox","SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111158","EarthScope","libmseed","EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111156","sezero","libtimidity","libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111155","sezero","libtimidity","libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111154","sezero","libtimidity","libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111153","libgme","game-music-emu","Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111151","aous72","OpenJPH","OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111152","libgme","game-music-emu","Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111150","ValleyBell","libvgm","ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111148","libsidplayfp","libsidplayfp","libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111149","danoli3","FreeImage","FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111147","libyal","libesedb","Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_val","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111145","Yeraze","ytnef","ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111146","Yeraze","ytnef","ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111144","ansilove","libansilove","libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111143","ansilove","libansilove","Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111141","gdraheim","zziplib","zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing","MEDIUM",5.7,"2026-10-15",0],["CVE-2026-111142","gdraheim","zziplib","Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111140","libyal","libregf","libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111138","NetSurf","libnsbmp","NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111139","NetSurf","libnsbmp","NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111137","amartin755","libsmi","libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111135","libyal","libfwsi","libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111136","swami","libinstpatch","libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111134","libyal","libfwsi","libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_da","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111132","GNOME","libgxps","GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111133","libyal","libfsapfs","libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_da","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111131","libxmp","libxmp","libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111129","assimp","assimp","Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111130","OpenSlide","openslide","OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111128","assimp","assimp","Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-111127","catdoc","catdoc","catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111125","HEASARC","cfitsio","CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111126","catdoc","catdoc","catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111124","HEASARC","cfitsio","CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111123","FluidSynth","fluidsynth","FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-110877","adplug","adplug","AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-110878","aureuserp","aureuserp","Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-110876","adplug","adplug","AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files","MEDIUM",6.8,"2026-10-15",0],["CVE-2026-110874","Dolibarr","dolibarr","Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()","HIGH",7.5,"2026-10-15",0],["CVE-2026-110875","adplug","adplug","AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111252","The OpenNMS Group","Meridian","OpenNMS denial of service via XML entity expansion","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-87029","undici","undici","undici vulnerable to Denial of Service via unhandled exception in the decompress intercept","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-111234","SimplePie","simplepie","SimplePie through 1.9.0 Local File Read via file:// Redirect","HIGH",8.2,"2026-10-15",0],["CVE-2026-111232","Netgate","pfSense CE","Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color","MEDIUM",4.8,"2026-10-15",0],["CVE-2026-111233","Netgate","pfSense CE","Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php","LOW",2.3,"2026-10-15",0],["CVE-2026-111231","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_inst","HIGH",8.6,"2026-10-15",0],["CVE-2026-111229","Netgate","pfSense CE","Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync","HIGH",8.6,"2026-10-15",0],["CVE-2026-111230","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-111228","Netgate","pfSense CE","Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-111227","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-111225","Netgate","pfSense CE","Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh","LOW",2.3,"2026-10-15",0],["CVE-2026-111226","Netgate","pfSense CE","Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php","HIGH",8.6,"2026-10-15",0],["CVE-2026-111224","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh","HIGH",7.7,"2026-10-15",0],["CVE-2026-111222","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting","HIGH",7.5,"2026-10-15",0],["CVE-2026-111223","Netgate","pfSense CE","Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner","HIGH",8.6,"2026-10-15",0],["CVE-2026-111220","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid","HIGH",8.6,"2026-10-15",0],["CVE-2026-111221","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection","HIGH",7.5,"2026-10-15",0],["CVE-2026-111219","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username","HIGH",7.5,"2026-10-15",0],["CVE-2026-111217","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID","HIGH",8.6,"2026-10-15",0],["CVE-2026-111218","Netgate","pfSense CE","Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters","HIGH",8.6,"2026-10-15",0],["CVE-2026-111216","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP","HIGH",8.6,"2026-10-15",0],["CVE-2026-111214","Netgate","pfSense CE","Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php","HIGH",8.6,"2026-10-15",0],["CVE-2026-111215","Netgate","pfSense CE","Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface","HIGH",8.6,"2026-10-15",0],["CVE-2026-109131","Red Hat","Red Hat Ansible Automation Platform 2","Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-111235","The OpenNMS Group","Meridian","OpenNMS REST authorization bypass via non-canonical HTTP method","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-62322","python-social-auth","social-core","Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validati","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-108334","Red Hat","Red Hat Connectivity Link 1.4","Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope","HIGH",7.4,"2026-10-15",0],["CVE-2026-109932","undici","undici","undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffe","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-104150","adonisjs","http-server","AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression","HIGH",8.7,"2026-10-15",0],["CVE-2026-57496","Labs64","NetLicensing-MCP","NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction","CRITICAL",9.6,"2026-10-15",0],["CVE-2026-87018","undici","undici","undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","HIGH",7.5,"2026-10-15",0],["CVE-2026-105660","mtrudel","bandit","Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port i","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-104828","HtmlUnit","htmlunit-neko","HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode with","HIGH",7.2,"2026-10-15",0],["CVE-2026-92707","MessagePack-CSharp","MessagePack-CSharp","MessagePack: Nested arrays can blow past buffer length limits","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-109383","undici","undici","undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","HIGH",7.4,"2026-10-15",0],["CVE-2026-57183","Erudika","scoold","Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive C","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-55840","Erudika","scoold","Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypas","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-55842","Erudika","scoold","Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated AP","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-102946","authlib","joserfc","joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_j","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-109829","undici","undici","undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","HIGH",7.4,"2026-10-15",0],["CVE-2026-55872","mayerbalintdev","GYM-One","GYM One admin user list is vulnerable to stored cross-site scripting","HIGH",8.7,"2026-10-15",0],["CVE-2026-55871","mayerbalintdev","GYM-One","GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injectio","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-94621","aliasvault","aliasvault","AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-109841","undici","undici","undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-55587","aliasvault","aliasvault","AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID","HIGH",8.1,"2026-10-15",0],["CVE-2026-110361","ClikIT","Infinite Uploads","WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-110362","Planet studio","PlanetStudio Payment Gateway","WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerabili","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-104827","reactphp","http","react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","HIGH",7.5,"2026-10-15",0],["CVE-2026-109893","Brainstorm Force","Presto Player","WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-110374","Hamid Alinia","Login with phone number","WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-108499","WebberZone","Knowledge Base","WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-97370","junrar","junrar","Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction","HIGH",7.5,"2026-10-15",0],["CVE-2026-110364","WP Desk","Flexible Quantity – Measurement Price Calculator for WooCommerce","WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.2","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-109924","undici","undici","undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-110375","WP Chill","Download Monitor","WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-47218","containerd","runwasi","runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-55240","msgbyte","tianji","Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed template","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-109689","WP Sunshine","Sunshine Photo Cart","WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-55239","msgbyte","tianji","Tianji: SQL Injection via unsanitized timezone parameter in analytics queries","HIGH",8.8,"2026-10-15",0],["CVE-2026-110360","WPdreams","Ajax Search Lite","WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-109897","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-63430","rust-ammonia","ammonia","ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-109869","undici","undici","undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","HIGH",7.5,"2026-10-15",0],["CVE-2026-110378","WP E-Signature","Ninja Forms Signature Contract Add-On","WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vu","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-96449","WPExperts","WP EasyPay","WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-106604","YITH","YITH WooCommerce Compare","WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerabi","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-103083","ELEXtensions","ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-108175","PluginUs.Net","MDTF","WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-110381","NSquared","Simply Schedule Appointments","WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object Refere","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-103350","Magepeople inc.","Booking and Rental Manager","WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerabil","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110888","Meow Apps","AI Engine","WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-110891","WordLift Srl","WordLift","WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-110890","Crocoblock","JetSmartFilters","WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-110367","WPExperts","APIExperts Square for WooCommerce","WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulner","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110371","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-111105","Telegram","Telegram","Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability","HIGH",7,"2026-10-15",0],["CVE-2026-55414","nl-portal","nl-portal-backend-libraries","NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecte","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-54683","nl-portal","nl-portal-backend-libraries","NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-103936","libp2p","js-libp2p","libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js list","HIGH",7.5,"2026-10-15",0],["CVE-2026-102740","AsyncHttpClient","async-http-client","AsyncHttpClient: Resumable download index store is created world-readable and follows a pl","MEDIUM",5.8,"2026-10-15",0],["CVE-2026-55875","HeliumEdu","platform","Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Networ","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-55876","HeliumEdu","platform","Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Execut","LOW",3.5,"2026-10-15",0],["CVE-2026-104266","tinytag","tinytag","tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-61702","OpenPrinting","cups","OpenPrinting CUPS: root-side banner file disclosure","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-55453","OpenPrinting","cups","CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as","LOW",3.3,"2026-10-15",0],["CVE-2026-84731","Nutanix","Acropolis Operating System (AOS)","Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside ","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-55480","OpenPrinting","cups","CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TO","MEDIUM",5.7,"2026-10-15",0],["CVE-2026-55467","OpenPrinting","cups","CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete f","LOW",2.5,"2026-10-15",0],["CVE-2026-55246","Tatsh","bincookie","bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies","HIGH",7.8,"2026-10-15",0],["CVE-2026-55103","discourse","discourse-activity-pub","Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF harden","HIGH",8.6,"2026-10-15",0],["CVE-2026-105065","8theme.com","XStore","WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-100409","opennextjs","opennextjs-cloudflare","OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths","HIGH",7.5,"2026-10-15",0],["CVE-2026-102527","nuxt-modules","og-image","Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image route","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-102631","Canonical","authd","authd: Account takeover via username fallback in identity matching after IdP email reassig","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-77466","LycheeOrg","Lychee","Lychee: Webshop payment bypass via unrestricted \"Dummy\" gateway selection","HIGH",8.3,"2026-10-15",0],["CVE-2026-77470","LycheeOrg","Lychee","Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway","HIGH",8.3,"2026-10-15",0],["CVE-2026-77468","LycheeOrg","Lychee","Lychee: Missing Authentication for Critical Function and Allocation of Resources Without L","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-77467","LycheeOrg","Lychee","Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processin","HIGH",7.1,"2026-10-15",0],["CVE-2026-110812","AWS","Amazon Neptune Engine","Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune","CRITICAL",9.4,"2026-10-15",0],["CVE-2026-62679","LycheeOrg","Lychee","Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read","HIGH",8.9,"2026-10-15",0],["CVE-2026-61838","LycheeOrg","Lychee","Lychee: Album password bypass in ZIP downloads","HIGH",8.2,"2026-10-15",0],["CVE-2026-61610","LycheeOrg","Lychee","Lychee: unauthenticated photo starring reveals existence of private photos when photos_sta","LOW",2.3,"2026-10-15",0],["CVE-2026-61611","LycheeOrg","Lychee","Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks","HIGH",7.5,"2026-10-15",0],["CVE-2026-57569","LycheeOrg","Lychee","Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after D","LOW",2.3,"2026-10-15",0],["CVE-2026-57568","LycheeOrg","Lychee","Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery","MEDIUM",5.7,"2026-10-15",0],["CVE-2026-85634","Red Hat","Red Hat Fuse 7","Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in ","HIGH",8.8,"2026-10-15",0],["CVE-2026-100353","getkin","kin-openapi","kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths","HIGH",7.5,"2026-10-15",0],["CVE-2026-100354","getkin","kin-openapi","kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Pro","HIGH",7.5,"2026-10-15",0],["CVE-2026-100352","getkin","kin-openapi","kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation P","HIGH",7.5,"2026-10-15",0],["CVE-2026-100351","getkin","kin-openapi","kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation conf","HIGH",7.4,"2026-10-15",0],["CVE-2026-100349","getkin","kin-openapi","kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header dec","HIGH",8.2,"2026-10-15",0],["CVE-2026-100350","getkin","kin-openapi","kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-92982","Red Hat","Red Hat Ansible Automation Platform 2.6","Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te","HIGH",8.5,"2026-10-15",0],["CVE-2026-100347","getkin","kin-openapi","kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-97665","Sonatype","Nexus Repository 3","Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload","HIGH",7.1,"2026-10-15",0],["CVE-2026-97666","Sonatype","Nexus Repository 3","Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-97667","Sonatype","Nexus Repository 3","Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-97712","Sonatype","Nexus Repository 3","Nexus Repository 3 - Privilege Escalation via Role Management","HIGH",8.7,"2026-10-15",0],["CVE-2026-100348","getkin","kin-openapi","kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointe","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110958","Wavlink","WN530HG4B","Wavlink WN530HG4B api.cgi heap-based overflow","CRITICAL",10,"2026-10-15",0],["CVE-2026-111095","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project","HIGH",8,"2026-10-15",0],["CVE-2026-111096","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build l","MEDIUM",6.7,"2026-10-15",0],["CVE-2026-111093","JetBrains","Datalore","In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob e","HIGH",7.5,"2026-10-15",0],["CVE-2026-111094","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a white","HIGH",8.1,"2026-10-15",0],["CVE-2026-111091","JetBrains","Junie CLI","In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project'","HIGH",7.8,"2026-10-15",0],["CVE-2026-111092","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rule","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-97394","getkin","kin-openapi","kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas","HIGH",7.5,"2026-10-15",0],["CVE-2026-105474","WebPros","SolusVM 2","A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows","CRITICAL",9.4,"2026-10-15",0],["CVE-2026-45452","Unitronics","Unitronics UniStream Pro/UniLogic","Unitronics - CWE-134 Use of Externally-Controlled format string","HIGH",8.3,"2026-10-15",0],["CVE-2026-71490","opnsense","core","OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write prote","HIGH",7.1,"2026-10-15",0],["CVE-2026-45451","Unitronics","Unitronics UniStream Pro/UniLogic","Unitronics - CWE-287: Improper Authentication","HIGH",8.3,"2026-10-15",0],["CVE-2026-63442","opnsense","core","OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Block","HIGH",8.1,"2026-10-15",0],["CVE-2026-45450","Unitronics","Unitronics UniStream Pro/UniLogic","Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buf","HIGH",8.3,"2026-10-15",0],["CVE-2026-58390","opnsense","core","OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views","HIGH",8,"2026-10-15",0],["CVE-2026-58394","opnsense","core","OPNsense: Stored XSS in Administration Settings via Certificate Description","MEDIUM",5.2,"2026-10-15",0],["CVE-2026-109449","sensiolabs","symfony","Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the P","HIGH",8.7,"2026-10-15",0],["CVE-2026-45449","Unitronics","Unitronics UniStream Pro/UniLogic","Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('O","HIGH",8.3,"2026-10-15",0],["CVE-2026-58392","opnsense","core","OPNsense: Stored XSS in Services: NTP GPS","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-58395","opnsense","core","OPNsense: XPath injection in MVC safe-delete","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-58393","opnsense","core","OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated ","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-57155","opnsense","core","OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer","CRITICAL",9.9,"2026-10-15",0],["CVE-2026-58391","opnsense","core","OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-53582","opnsense","core","OPNsense: XPATH Injection can disclose any secret in config.xml","HIGH",7.1,"2026-10-15",0],["CVE-2026-75505","espocrm","espocrm","EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permis","MEDIUM",6,"2026-10-15",0],["CVE-2026-77460","espocrm","espocrm","EspoCRM: Mass email template renderer leaks restricted record fields","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-109413","sensiolabs","symfony","Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Pro","HIGH",8.7,"2026-10-15",0],["CVE-2026-63130","espocrm","espocrm","EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.jso","MEDIUM",5.5,"2026-10-15",0],["CVE-2026-79843","Hewlett Packard Enterprise","HPE NonStop SQL/MX EXE","HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-59994","espocrm","espocrm","EspoCRM: Pre-authentication stored HTML injection in stream notification emails about emai","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-55154","espocrm","espocrm","EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters ","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-55184","espocrm","espocrm","EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled","LOW",3.5,"2026-10-15",0],["CVE-2026-53575","espocrm","espocrm","EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user","LOW",2.7,"2026-10-15",0],["CVE-2026-108082","sensiolabs","symfony","Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","HIGH",8.7,"2026-10-15",0],["CVE-2026-53574","espocrm","espocrm","EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression","HIGH",7.6,"2026-10-15",0],["CVE-2026-110957","Wavlink","WL-WN530BE2-A","Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection","CRITICAL",10,"2026-10-15",0],["CVE-2026-46691","espocrm","espocrm","EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-46708","espocrm","espocrm","EspoCRM: Target list Opt-Out actions allows opting out record without access Target List a","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-79841","Hewlett Packard Enterprise","HPE NonStop RDMA SERVICES NSK","HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write vulnerability","MEDIUM",5.8,"2026-10-15",0],["CVE-2026-47168","espocrm","espocrm","EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export para","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-103509","Perforce","P4 (Helix core)","Credential Disclosure in P4 Search Configuration API","HIGH",8.5,"2026-10-15",0],["CVE-2026-46694","espocrm","espocrm","EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-79840","Hewlett Packard Enterprise","HPE NonStop XABroker","HPE NonStop XABroker - Memory corruption vulnerability","HIGH",7.3,"2026-10-15",0],["CVE-2026-79839","Hewlett Packard Enterprise","HPE NonStop ODBC/MX Server","HPE NonStop ODBC/MX Server - Memory corruption vulnerability","HIGH",7.3,"2026-10-15",0],["CVE-2026-79838","Hewlett Packard Enterprise","HPE NonStop ODBC/MX Services","HPE NonStop ODBC/MX Services - Memory corruption vulnerability","HIGH",7.3,"2026-10-15",0],["CVE-2026-108116","Progress Software","Kendo UI for jQuery","MDX and SOAP Injection in Kendo UI for jQuery","HIGH",7.5,"2026-10-15",0],["CVE-2026-106153","Progress Software","Kendo UI for jQuery","Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106151","Progress Software","Kendo UI for jQuery","Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106150","Progress Software","Kendo UI for jQuery","Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106149","Progress Software","Kendo UI for jQuery","Cross-site Scripting (XSS) in Kendo UI for jQuery Menu","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-110746","TotalSecurity","TotalAV","CVE-2026-110746","HIGH",7.8,"2026-10-15",0],["CVE-2026-103508","Perforce","P4 (Helix core)","Path traversal via logging configuration in P4Search","HIGH",7.3,"2026-10-15",0],["CVE-2026-9703","Grafana","Grafana Enterprise","Viewer role can create, modify and delete Loki alerting rules","HIGH",7.1,"2026-10-15",0],["CVE-2026-110936","Siemens","Siemens Software Center","A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). ","HIGH",8.4,"2026-10-15",1],["CVE-2026-104024","PeaZip","PeaZip","Incomplete dangerous-extension list in PeaZip object open allows execution of a program or","MEDIUM",4.6,"2026-10-15",0],["CVE-2026-93649","Eclipse Foundation","Adoptium Temurin","In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24","HIGH",7.5,"2026-10-15",0],["CVE-2026-106148","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106147","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106161","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106160","Progress Software","Kendo UI for jQuery","Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106159","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery","MEDIUM",4.7,"2026-10-15",0],["CVE-2026-106158","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery","MEDIUM",4.7,"2026-10-15",0],["CVE-2026-106157","Progress Software","Kendo UI for jQuery","Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery","MEDIUM",4.7,"2026-10-15",0],["CVE-2026-106162","Progress Software","Kendo UI for jQuery","Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery","MEDIUM",4.7,"2026-10-15",0],["CVE-2026-106163","Progress Software","Kendo UI for jQuery","Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-109686","Link Whisper INC","Link Whisper Free","WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-102389","WPMU DEV","Broken Link Checker","WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-105882","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-107416","Webba Plugins","Webba Booking","WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnera","HIGH",7.5,"2026-10-15",0],["CVE-2026-109685","Link Whisper INC","Link Whisper Free","WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-109688","Link Whisper INC","Link Whisper Free","WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-109702","maxfoundry","Social Share Buttons","WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-109892","Shabti Kaplan","Frontend Admin by DynamiApps","WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerabil","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-88794","Sparx Systems","Enterprise Architect","XML External Entity injection in Sparx Enterprise Architect","HIGH",8.2,"2026-10-15",0],["CVE-2026-99999","Linux","Linux","ipv4: validate checksum_start before completing checksum","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-110723","Eclipse Foundation","Eclipse Connected Services Platform","In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyR","HIGH",7.5,"2026-10-15",0],["CVE-2026-110724","Eclipse Foundation","Eclipse Connected Services Platform","In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyR","HIGH",7.5,"2026-10-15",0],["CVE-2026-109692","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-109698","Kitae Park","Mang Board WP","WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-109693","WP ManageNinja LLC","Fluent CRM","WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-15",0],["CVE-2026-98432","Linux","Linux","ipv4: free inet_opt and ireq_opt after an RCU grace period","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-79837","Hewlett Packard Enterprise","HPE NonStop SQL/MX UDR SERVER","HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability","HIGH",7.3,"2026-10-15",0],["CVE-2026-104025","PeaZip","PeaZip","Path traversal in PeaZip object preview allows execution of arbitrary programs via a craft","HIGH",8.4,"2026-10-15",0],["CVE-2026-110726","Eclipse Foundation","Eclipse Connected Services Platform","In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyR","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-79836","Hewlett Packard Enterprise","HPE NonStop SQL/MX Run-Time Statistics","HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulnerability","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-8145","wpxpo","WholesaleX – All-in-One B2B Solution with Wholesale Pricing","WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registrati","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-79835","Hewlett Packard Enterprise","HPE Nonstop KMS Server","HPE Nonstop KMS Server - Buffer overflow vulnerability","LOW",2.8,"2026-10-15",0],["CVE-2026-79834","Hewlett Packard Enterprise","HPE NonStop SQL/MX SQLCAT","HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability","HIGH",7.4,"2026-10-15",0],["CVE-2026-79833","Hewlett Packard Enterprise","HPE NonStop ANSI SQLUTIL","HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-108491","Everest Forms","Everest Forms","WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-108497","TMS","Amelia","WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-108498","bannersky","BSK PDF Manager","WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-109694","WP ManageNinja LLC","Fluent CRM","WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-109695","WPManageNinja","FluentCart","WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-79832","Hewlett Packard Enterprise","HPE NonStop SQL/MX Executor","HPE NonStop SQL/MX Executor - Buffer overflow vulnerability","HIGH",7.6,"2026-10-15",0],["CVE-2026-79831","Hewlett Packard Enterprise","HPE NonStop Posix User Threads","HPE NonStop Posix User Threads - Heap buffer overflow vulnerability","MEDIUM",6.6,"2026-10-15",0],["CVE-2026-79830","Hewlett Packard Enterprise","HPE NonStop Kernel Level Thread Model Lib","HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability","MEDIUM",6.6,"2026-10-15",0],["CVE-2026-17525","ABB","My Control System","My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup aft","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-79829","Hewlett Packard Enterprise","HPE NonStop HTTP WEBSERVER","HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability","HIGH",8.2,"2026-10-15",0],["CVE-2026-79828","Hewlett Packard Enterprise","HPE NonStop Debug Utilities","HPE NonStop Debug Utilities - Heap buffer overflow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-79827","Hewlett Packard Enterprise","HPE NonStop Inspect Subsystem","HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-18659","Eclipse Foundation","org.eclipse.jetty.ee11:jetty-ee11-servlet","Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission m","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-18662","Eclipse Foundation","org.eclipse.jetty.ee11:jetty-ee11-servlet","In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, t","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-19864","Eclipse Foundation","org.eclipse.jetty:jetty-security","Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializab","MEDIUM",5.6,"2026-10-15",0],["CVE-2026-19863","Eclipse Foundation","org.eclipse.jetty:jetty-ethereum","An unauthenticated client may access certain protected resources when using EthereumAuthen","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-79826","Hewlett Packard Enterprise","HPE NonStop OCAX","HPE NonStop OCAX - Heap buffer overflow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-50619","QNAP Systems Inc.","Qsirch","Unauthenticated remote code execution vulnerability","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-47790","QNAP Systems Inc.","QuFTP Service","Privilege Escalation via QuFTP Log-based XSS","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-47786","QNAP Systems Inc.","HybridDesk Station","Pre-Authentication Command Injection","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-18660","Eclipse Foundation","org.eclipse.jetty:jetty-server","Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames","HIGH",8.8,"2026-10-15",0],["CVE-2026-39997","QNAP Systems Inc.","HybridDesk Station","Unauthenticated Remote Input Injection in QNAP HD Station's remotepad","HIGH",8.9,"2026-10-15",0],["CVE-2026-39991","QNAP Systems Inc.","Notes Station 3","Stored Cross-Site Scripting (XSS) in Note Station file upload functionality","MEDIUM",4.8,"2026-10-15",0],["CVE-2026-34009","QNAP Systems Inc.","Notes Station 3","**Container Escape** Host user home directory mounted with write access into application c","HIGH",8.4,"2026-10-15",0],["CVE-2026-34008","QNAP Systems Inc.","Notes Station 3","**Privilege Escalation** World-writable crontab path monitored and executed by root-owned ","HIGH",8.5,"2026-10-15",0],["CVE-2026-34007","QNAP Systems Inc.","Notes Station 3","**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP valida","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-53882","QNAP Systems Inc.","Virtualization Station","Path Traversal in Virtualization Station VM Import","HIGH",8.7,"2026-10-15",0],["CVE-2026-50612","QNAP Systems Inc.","QuMagie","Import Symlink Following Remote Code Execution Vulnerability in QuMagie","CRITICAL",9.4,"2026-10-15",0],["CVE-2026-44084","QNAP Systems Inc.","Video Station","Access Code Forgery in Video Station leading to unauthorized media access","HIGH",8.7,"2026-10-15",0],["CVE-2026-41545","QNAP Systems Inc.","QuMagie","WebSocket timelapse path traversal and command injection","HIGH",8.6,"2026-10-15",0],["CVE-2026-41541","QNAP Systems Inc.","Qsync Central","Symlink creation in qsyncsrv.cgi","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-39989","QNAP Systems Inc.","Download Station","SSRF in QNAP Download Station","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-34015","QNAP Systems Inc.","Video Station","Remote Code Execution in upload.php of Video Station","HIGH",8.7,"2026-10-15",0],["CVE-2026-34014","QNAP Systems Inc.","Download Station","ds-move-files.sh is writable and executed as root","HIGH",8.4,"2026-10-15",0],["CVE-2026-34006","QNAP Systems Inc.","sMedio DTCP MOVE","Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-26245","QNAP Systems Inc.","Video Station","SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset","HIGH",7.1,"2026-10-15",0],["CVE-2026-26244","QNAP Systems Inc.","Video Station","SQLi#1 SQL Injection in class_videos.php _getFilters","HIGH",7.1,"2026-10-15",0],["CVE-2026-26243","QNAP Systems Inc.","Qsync Central","Arbitrary Folder Deletion in Qsync Central 5.0.0.5","HIGH",7.2,"2026-10-15",0],["CVE-2026-79825","Hewlett Packard Enterprise","HPE NonStop NDSREST","HPE NonStop NDSREST - Heap buffer overflow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-79824","Hewlett Packard Enterprise","HPE NonStop Python 3.x","HPE NonStop Python 3.x - Directory traversal vulnerability","HIGH",8,"2026-10-15",0],["CVE-2026-18661","Eclipse Foundation","org.eclipse.jetty.ee11:jetty-ee11-annotations","In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotatio","HIGH",8.8,"2026-10-15",0],["CVE-2026-79823","Hewlett Packard Enterprise","HPE NonStop EMS Distributor","HPE NonStop EMS Distributor - Buffer Overflow vulnerability","MEDIUM",4,"2026-10-15",0],["CVE-2026-63315","Slican","IPx","Plaintext storage of a password in WebCTI","HIGH",8.2,"2026-10-15",0],["CVE-2026-63314","Slican","IPx","SQL Injection in WebCTI","HIGH",8.7,"2026-10-15",0],["CVE-2026-35088","Slican","IPx","Inadequate Encryption Strength in Slican telephone exchanges","HIGH",8.2,"2026-10-15",0],["CVE-2026-101287","Diaple","Stela","Authentication bypass in Stela by Diaple Networking","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-101290","SICK AG","Sick_Safetyscanners_Base CPP Driver","CVE-2026-101290","HIGH",7.5,"2026-10-15",0],["CVE-2026-77711","Eclipse Foundation","Eclipse Jetty","When Jetty's `HttpClient` make a request to a server through a forward proxy, the server m","HIGH",8.2,"2026-10-15",0],["CVE-2026-76184","Eclipse Foundation","Eclipse Jetty","In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` I","HIGH",8.2,"2026-10-15",0],["CVE-2026-104618","SUSE","SUSE Linux Enterprise Server 16.1","sdbootutil: world-readable debug log","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-76182","Eclipse Foundation","Eclipse Jetty","In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requ","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-104617","SUSE","SUSE Linux Enterprise Server 16.1","sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-16438","Mitsubishi Electric Corporation","GENESIS64","An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, Analyti","CRITICAL",9.4,"2026-10-15",0],["CVE-2026-16437","Mitsubishi Electric Corporation","GENESIS","An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Histori","HIGH",7.1,"2026-10-15",0],["CVE-2026-72528","CREEMA LTD.","\"Handmade Marketplace App - Creema\" for Android","\"Handmade Marketplace App - Creema\" provided by CREEMA LTD. contains an open redirect vuln","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-16436","Mitsubishi Electric Corporation","GENESIS","An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Histori","CRITICAL",9.2,"2026-10-15",0],["CVE-2026-75559","Ministry of Land, Infrastructure, Transport and Tourism","Vehicle Inspection Certificate Viewer (for Android)","The smartphone application \"Vehicle Inspection Certificate Viewer\" contains a vulnerabilit","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-102477","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.7,"2026-10-15",0],["CVE-2026-102464","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2026-96614","GEO CORPORATION","\"ゲオアプリ\" for Android","\"ゲオアプリ\" provided by GEO CORPORATION is vulnerable to improper authorization in handler for","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-105271","GEO CORPORATION","\"ゲオアプリ\" for Android","\"ゲオアプリ\" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive ","MEDIUM",5.1,"2026-10-15",0],["CVE-2026-102461","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.7,"2026-10-15",0],["CVE-2023-32198","SUSE","steve","Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM)","HIGH",8,"2026-10-15",0],["CVE-2026-103224","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2024-22031","SUSE","rancher","Rancher users who can create Projects can gain access to arbitrary projects","HIGH",8.5,"2026-10-15",0],["CVE-2026-103223","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2025-23390","SUSE","fleet","Fleet doesn’t validate a server’s certificate when connecting through SSH","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-102466","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2026-102463","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2026-109855","undici","undici","undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake","HIGH",7.5,"2026-10-15",0],["CVE-2026-102469","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","CRITICAL",9.2,"2026-10-15",0],["CVE-2026-102462","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2026-108092","pr-gateway","Blog2Social: Social Media Auto Post & Scheduler","Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-102465","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.2,"2026-10-15",0],["CVE-2026-102475","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP pro","HIGH",8.7,"2026-10-15",0],["CVE-2026-102467","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.7,"2026-10-15",0],["CVE-2026-101311","FreeBSD","FreeBSD","Multiple vulnerabilities in bhyve device models","HIGH",7,"2026-10-15",0],["CVE-2026-101310","FreeBSD","FreeBSD","Multiple vulnerabilities in bhyve device models","HIGH",7,"2026-10-15",0],["CVE-2026-101309","FreeBSD","FreeBSD","Multiple vulnerabilities in bhyve device models","HIGH",7,"2026-10-15",0],["CVE-2026-101308","FreeBSD","FreeBSD","TOCTOU race between sound(4) buffer resizing and mmap","MEDIUM",5.5,"2026-10-15",0],["CVE-2026-101307","FreeBSD","FreeBSD","Remotely triggerable buffer overflow in tcp_rack","HIGH",8.2,"2026-10-15",0],["CVE-2026-19377","Cato Networks","Cato Client for Windows","Improper certificate validation in Cato Client tunnel handshake","MEDIUM",6,"2026-10-15",0],["CVE-2026-41544","QNAP Systems Inc.","QcalAgent","Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/rena","HIGH",8.7,"2026-10-15",0],["CVE-2026-39993","QNAP Systems Inc.","Download Station","Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter","HIGH",8.7,"2026-10-15",0],["CVE-2026-24723","QNAP Systems Inc.","File Station 5","NULL Pointer Dereference in utilRequest.cgi","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-24722","QNAP Systems Inc.","File Station 5","Null Pointer Dereference in File Station 5","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-24721","QNAP Systems Inc.","File Station 5","Null Pointer Dereference in File Station 5","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-24718","QNAP Systems Inc.","Qsync Central","Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-101303","FreeBSD","FreeBSD","IPv6 UDP sendto(2) bypasses jail loopback restriction","HIGH",7.5,"2026-10-15",0],["CVE-2026-24715","QNAP Systems Inc.","QuRouter","Lack of Reproducible Vulnerability Evidence in QNAP Report","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-22896","QNAP Systems Inc.","Network & Virtual Switch","Stored XSS via Interface Name in Network & Virtual Switch App","MEDIUM",6.2,"2026-10-15",0],["CVE-2025-68404","QNAP Systems Inc.","QuRouter","vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management inte","HIGH",7.5,"2026-10-15",0],["CVE-2025-68403","QNAP Systems Inc.","QuRouter","Inadequate Steps to Confirm Vulnerability in QuRouter","MEDIUM",4.6,"2026-10-15",0],["CVE-2025-66275","QNAP Systems Inc.","Video Station","Remote code execution via command injection","HIGH",7.7,"2026-10-15",0],["CVE-2025-66272","QNAP Systems Inc.","Video Station","Arbitrary file deletion and remote code execution","HIGH",7.7,"2026-10-15",0],["CVE-2025-29897","QNAP Systems Inc.","Qsync Central","Stack-based Buffer Overflow in qsyncsrv.cgi","LOW",2.3,"2026-10-15",0],["CVE-2025-29896","QNAP Systems Inc.","Qsync Central","NULL Pointer Dereference in qsyncsrv.cgi","LOW",2.3,"2026-10-15",0],["CVE-2025-29895","QNAP Systems Inc.","Qsync Central","NULL Pointer Dereference in qsyncsrv.cgi","LOW",2.3,"2026-10-15",0],["CVE-2026-79822","Hewlett Packard Enterprise","HPE NonStop TNS/X Native Inspect","HPE NonStop TNS/X Native Inspect - Execution flow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-101302","FreeBSD","FreeBSD","Remote DoS via receive-side kernel TLS","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-110934","Samsung Open Source","Vyond","Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input","MEDIUM",4.4,"2026-10-15",0],["CVE-2026-110933","Samsung Open Source","Vyond","Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulati","MEDIUM",4.4,"2026-10-15",0],["CVE-2026-101306","FreeBSD","FreeBSD","Multiple jail filesystem root escapes","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-101305","FreeBSD","FreeBSD","Multiple jail filesystem root escapes","HIGH",8.8,"2026-10-15",0],["CVE-2026-101304","FreeBSD","FreeBSD","Multiple jail filesystem root escapes","HIGH",7.1,"2026-10-15",0],["CVE-2026-81534","ThemeHigh","Email Customizer for WooCommerce (Pro)","Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code ","HIGH",8.8,"2026-10-15",0],["CVE-2026-11905","elemntor","Elementor Website Builder – more than just a page builder","Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+)","MEDIUM",4.3,"2026-10-15",0],["CVE-2026-92429","","Rede Itaú for WooCommerce","Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via ma","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-92428","","Rede Itaú for WooCommerce","Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Fail","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-103324","","Cardinity Payment Gateway for WooCommerce","Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order ","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-79821","Hewlett Packard Enterprise","HPE NonStop SOAP 4.0","HPE NonStop SOAP 4.0 - Memory corruption","HIGH",8.2,"2026-10-15",0],["CVE-2026-76668","Hewlett Packard Enterprise","HPE NonStop Kernel","HPE NonStop Kernel - Access to unmapped or privileged data","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-58100","FreeBSD","FreeBSD","Memory safety bugs in kqueue copy-on-fork implementation","HIGH",7,"2026-10-15",0],["CVE-2026-58099","FreeBSD","FreeBSD","Memory safety bugs in kqueue copy-on-fork implementation","HIGH",7,"2026-10-15",0],["CVE-2026-58098","FreeBSD","FreeBSD","Heap out-of-bounds access in semop(2)","HIGH",8.4,"2026-10-15",0],["CVE-2026-109145","","User Rights Access Manager","User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Regist","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-74920","","Document Gallery","Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute","HIGH",7.1,"2026-10-15",0],["CVE-2026-96537","","Tutor LMS","Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite","HIGH",7.5,"2026-10-15",0],["CVE-2026-103304","","eaSYNC Booking","eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-104643","","Easy HTTPS Redirection (SSL)","Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide UR","MEDIUM",4.2,"2026-10-15",0],["CVE-2026-106031","","Spin Wheel","Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-15090","jackdewey","Link Library","Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter","HIGH",7.5,"2026-10-15",0],["CVE-2026-15180","data443","Tracking Code Manager","Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-78087","vektor-inc","VK Blocks","VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group ","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-18548","trainingbusinesspros","Groundhogg — CRM, Newsletters, and Marketing Automation","Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter","HIGH",7.2,"2026-10-15",0],["CVE-2026-18557","10web","Photo Gallery by 10Web – Mobile-Friendly Image Gallery","Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-88043","kitae-park","Mang Board","Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Param","HIGH",7.2,"2026-10-15",0],["CVE-2026-17031","quadlayers","Checkout Field Manager (Checkout Manager) for WooCommerce","Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization","HIGH",8.1,"2026-10-15",0],["CVE-2026-18586","codename065","Premium Packages – Sell Digital Products Securely","Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'","HIGH",7.2,"2026-10-15",0],["CVE-2026-17001","carazo","Import and export users and customers","Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-78001","boldgrid","Post and Page Builder by BoldGrid – Visual Drag and Drop Editor","Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-S","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-86803","oceanwp","Ocean Extra","Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library'","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-76667","Hewlett Packard Enterprise","HPE NonStop EXPAND","HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability","MEDIUM",5.7,"2026-10-15",0],["CVE-2026-76666","Hewlett Packard Enterprise","HPE NonStop EXPAND","HPE NonStop EXPAND - Out-of-Bounds memory read","MEDIUM",4.7,"2026-10-15",0],["CVE-2026-76665","Hewlett Packard Enterprise","HPE NonStop EXPAND","HPE NonStop EXPAND - Buffer Overflow vulnerability","HIGH",7.1,"2026-10-15",0],["CVE-2026-14572","themeum","Kirki – Freeform Page Builder, Website Builder & Customizer","Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-108587","10web","10Web Booster – Website speed optimization, Cache & Page Speed optimizer","10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-3712","kiboit","PhastPress","PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter","HIGH",7.3,"2026-10-15",0],["CVE-2026-76664","Hewlett Packard Enterprise","HPE NonStop EXPAND","HPE NonStop EXPAND - Out-of-Bounds memory read/write","MEDIUM",6.4,"2026-10-15",0],["CVE-2026-93484","Znuny","Znuny","Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating us","HIGH",8.6,"2026-10-15",0],["CVE-2026-93483","Znuny","Znuny","In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain","CRITICAL",9.5,"2026-10-15",0],["CVE-2026-110912","DragonFlyBSD","DragonFlyBSD","In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arp","HIGH",7.1,"2026-10-15",0],["CVE-2026-110911","Wheels","Wheels","Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are par","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-110909","Wheels","Wheels CLI","Wheels CLI through 4.1.0 does not verify that the local development server answering its H","MEDIUM",5,"2026-10-15",0],["CVE-2026-110908","Netgate","pfSense-pkg-frr","Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain ","HIGH",8.8,"2026-10-15",0],["CVE-2026-76663","Hewlett Packard Enterprise","HPE NonStop TELSERV","HPE NonStop TELSERV - Memory corruption vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-76662","Hewlett Packard Enterprise","HPE NonStop TELSERV","HPE NonStop TELSERV - Memory corruption vulnerability","MEDIUM",5.9,"2026-10-15",0],["CVE-2026-110907","BackdropCMS","Backdrop","Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token","HIGH",7.5,"2026-10-15",0],["CVE-2026-76661","Hewlett Packard Enterprise","HPE NonStop QIOMON","HPE NonStop QIOMON - Memory corruption vulnerability","HIGH",7.6,"2026-10-15",0],["CVE-2026-76660","Hewlett Packard Enterprise","HPE NonStop CIPSAM","HPE NonStop CIPSAM - Memory corruption vulnerability","HIGH",8.7,"2026-10-15",0],["CVE-2026-76066","crestalnetwork","intentkit","IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode","HIGH",8.7,"2026-10-15",0],["CVE-2026-76659","Hewlett Packard Enterprise","HPE NonStop TCP/IP UTILITIES","HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-109430","Ellucian","WebAdvisor","Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection","HIGH",8.7,"2026-10-15",0],["CVE-2026-76656","Hewlett Packard Enterprise","HPE NonStop TCP/IP UTILITIES","HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-77931","jxxghp","MoviePilot","MoviePilot 3.1.5 Command Injection via ExecuteCommandTool","HIGH",8.7,"2026-10-15",0],["CVE-2026-73799","Hewlett Packard Enterprise","HPE NonStop SNMP Trap Multiplexer","HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability","HIGH",7.5,"2026-10-15",0],["CVE-2026-110904","apostrophecms","ApostropheCMS","ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as dem","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-0993","SODOLA","SL902-SWTGW124AS","SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser","HIGH",8.7,"2026-10-15",0],["CVE-2026-110810","ggml-org","whisper.cpp","ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds","LOW",2.4,"2026-10-15",0],["CVE-2026-104586","","","AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in bor","CRITICAL",9.8,"2026-10-15",0],["CVE-2026-106700","","","ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-man","HIGH",8.8,"2026-10-15",0],["CVE-2026-106701","","","ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebS","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-106706","","","XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the G","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106707","","","XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the","MEDIUM",5.4,"2026-10-15",0],["CVE-2026-106708","","","XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerabil","HIGH",8.8,"2026-10-15",0],["CVE-2026-36436","","","An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext wit","HIGH",7.5,"2026-10-15",0],["CVE-2026-52167","","","A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers","","","2026-10-15",0],["CVE-2026-78850","","","An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via t","MEDIUM",5,"2026-10-15",0],["CVE-2026-78851","","","Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker","MEDIUM",6.5,"2026-10-15",0],["CVE-2026-88753","","","A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() functi","HIGH",7.5,"2026-10-15",0],["CVE-2026-95155","","","FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.","HIGH",7.5,"2026-10-15",0],["CVE-2026-95179","","","An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to caus","HIGH",7.5,"2026-10-15",0],["CVE-2026-95180","","","An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to o","MEDIUM",5.5,"2026-10-15",0],["CVE-2026-110809","sgl-project","SGLang","sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of serv","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110807","sgl-project","SGLang","sgl-project SGLang generate Endpoint io_struct.py denial of service","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110873","heymrun","heym","Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field","HIGH",7.1,"2026-10-15",0],["CVE-2026-110872","nodemailer","nodemailer","Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing","HIGH",8.2,"2026-10-15",0],["CVE-2026-110871","nodemailer","nodemailer","Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service","HIGH",7.1,"2026-10-15",0],["CVE-2026-110870","nodemailer","nodemailer","Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-110869","nodemailer","nodemailer","Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes","HIGH",8.7,"2026-10-15",0],["CVE-2026-110868","renovatebot","renovate","Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources","HIGH",8.4,"2026-10-15",0],["CVE-2026-110867","renovatebot","renovate","Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset","CRITICAL",9,"2026-10-15",0],["CVE-2026-110866","renovatebot","renovate","Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110865","renovatebot","renovate","Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets","HIGH",7.1,"2026-10-15",0],["CVE-2026-110864","better-auth","better-auth","Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-110863","better-auth","sso","Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers","HIGH",8.6,"2026-10-15",0],["CVE-2026-110862","better-auth","better-auth","Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link","CRITICAL",9.3,"2026-10-15",0],["CVE-2026-110861","better-auth","drizzle-adapter","Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-110860","gitpython-developers","GitPython","GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-110859","gitpython-developers","GitPython","GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name","HIGH",8.7,"2026-10-15",0],["CVE-2026-110858","gitpython-developers","GitPython","GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec","CRITICAL",9.2,"2026-10-15",0],["CVE-2026-110857","gitpython-developers","GitPython","GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs","HIGH",7.7,"2026-10-15",0],["CVE-2026-110856","gitpython-developers","GitPython","GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date","HIGH",8.7,"2026-10-15",0],["CVE-2026-110855","gitpython-developers","GitPython","GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name","HIGH",7.1,"2026-10-15",0],["CVE-2026-110854","parse-community","parse-server","Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error","HIGH",8.2,"2026-10-15",0],["CVE-2026-110853","n8n-io","n8n","n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON","HIGH",7.1,"2026-10-15",0],["CVE-2026-110852","n8n-io","n8n","n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Pat","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-110851","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endp","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-110850","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters","HIGH",7.2,"2026-10-15",0],["CVE-2026-110849","n8n-io","n8n","n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview","HIGH",7.2,"2026-10-15",0],["CVE-2026-110848","n8n-io","n8n","n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connec","MEDIUM",6,"2026-10-15",0],["CVE-2026-110847","n8n-io","n8n","n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter","HIGH",7,"2026-10-15",0],["CVE-2026-110846","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook","HIGH",7,"2026-10-15",0],["CVE-2026-110845","n8n-io","n8n","n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation","HIGH",7.7,"2026-10-15",0],["CVE-2026-110844","n8n-io","n8n","n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows","HIGH",7.2,"2026-10-15",0],["CVE-2026-110843","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Author","HIGH",8.2,"2026-10-15",0],["CVE-2026-110842","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter","HIGH",7.7,"2026-10-15",0],["CVE-2026-110841","n8n-io","n8n","n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-110840","n8n-io","n8n","n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field","HIGH",7,"2026-10-15",0],["CVE-2026-110839","FreeRDP","FreeRDP","FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data","HIGH",7.1,"2026-10-15",0],["CVE-2026-110838","FreeRDP","FreeRDP","FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass","HIGH",8.7,"2026-10-15",0],["CVE-2026-110837","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding","MEDIUM",6.1,"2026-10-15",0],["CVE-2026-110836","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type","HIGH",7.1,"2026-10-15",0],["CVE-2026-110835","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-110834","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle","HIGH",7.1,"2026-10-15",0],["CVE-2026-110833","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy","HIGH",8.2,"2026-10-15",0],["CVE-2026-110832","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST","HIGH",7.1,"2026-10-15",0],["CVE-2026-110831","FreeRDP","FreeRDP","FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110830","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE","HIGH",8.2,"2026-10-15",0],["CVE-2026-110829","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment","HIGH",7.1,"2026-10-15",0],["CVE-2026-107795","TP-Link Systems Inc.","Omada Software Controller","Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Managem","HIGH",7.5,"2026-10-15",0],["CVE-2026-110816","ljharb","qs","qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coer","MEDIUM",6.3,"2026-10-15",0],["CVE-2026-102298","TP-Link System Inc.","Omada Software Controller (Windows)","Insufficient Authorization and User Boundary Validation in Omada Controller MSP","HIGH",7.5,"2026-10-15",0],["CVE-2026-110698","","Praat","Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-108337","Hitachi Vantara","Remot Ops Agent","Password Reset Code Accessible in User Listing API","HIGH",7.4,"2026-10-15",0],["CVE-2026-108336","Hitachi Vantara","Remot Ops Agent","Token Signing Key Allows Unauthenticated Administrative Access","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-108335","Hitachi Vantara","Remote Ops Agent","Password Reset Functionality Missing Brute-Force Protection","CRITICAL",9.1,"2026-10-15",0],["CVE-2026-110696","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System dbtables.sql information disclosure","MEDIUM",6.9,"2026-10-15",0],["CVE-2026-110695","turboderp","ExLlamaV2","turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflo","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110694","OAID","Tengine","OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds","MEDIUM",5.3,"2026-10-15",0],["CVE-2026-110689","OpenClaw","ClawScan","OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-104109","error311","FileRise","FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files ou","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-104107","error311","FileRise","FileRise: Authenticated path traversal escapes configured storage root through inherited A","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-104110","error311","FileRise","FileRise: Unauthenticated disclosure of internal folder path, client email, and upload pol","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-104108","error311","FileRise","FileRise OIDC login can bind an attacker identity to an existing local account","HIGH",8.1,"2026-10-14",0],["CVE-2026-103977","error311","FileRise","FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts","HIGH",8.1,"2026-10-14",0],["CVE-2026-104105","error311","FileRise","FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its wi","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-104106","error311","FileRise","FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activ","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-103988","error311","FileRise","FileRise renameFolder omits destination-parent authorization","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-69193","error311","FileRise","FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-69191","error311","FileRise","FileRise: Login Method Restriction Bypass via Direct API Access","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-77427","error311","FileRise","FileRise: Insecure default cryptographic key fallback in manual installs","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-69194","error311","FileRise","FileRise: Unsanitized footerHtml in Public Site Config","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110679","","OpenSIPS","OpenSIPS rtpproxy rtpproxy_answer out-of-bounds","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-0311","Palo Alto Networks","Checkov by Prisma Cloud","Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability","LOW",1.1,"2026-10-14",0],["CVE-2026-0312","Palo Alto Networks","Checkov by Prisma Cloud","Checkov by Prisma Cloud: Path Traversal Vulnerabilities","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-0313","Palo Alto Networks","Cortex XSOAR OS Query","Cortex XSOAR: OS Command Injection Vulnerability","MEDIUM",6.1,"2026-10-14",0],["CVE-2026-64856","error311","FileRise","FileRise: Missing Authentication Guard on File Snippet Preview Endpoint","LOW",3.7,"2026-10-14",0],["CVE-2026-0314","Palo Alto Networks","GlobalProtect App","GlobalProtect App: Local Denial of Service (DoS) on Windows","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-62664","error311","FileRise","FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-0315","Palo Alto Networks","GlobalProtect App","GlobalProtect App: Local Privilege Escalation Vulnerability on macOS","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-61844","error311","FileRise","FileRise: Folder Metadata Filename Collisions Bypass \"read_own\" Isolation","HIGH",7.1,"2026-10-14",0],["CVE-2026-0316","Palo Alto Networks","Cloud NGFW","PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability","LOW",1.1,"2026-10-14",0],["CVE-2026-61843","error311","FileRise","FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares","HIGH",8.2,"2026-10-14",0],["CVE-2026-57493","error311","FileRise","FileRise: Remember-me auto-login uses stale admin role from token instead of current role","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-0317","Palo Alto Networks","Cloud NGFW","PAN-OS: Denial of Service Vulnerability","LOW",1.2,"2026-10-14",0],["CVE-2026-57492","error311","FileRise","FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated a","HIGH",7.4,"2026-10-14",0],["CVE-2026-57490","error311","FileRise","FileRise: WebDAV authentication bypasses TOTP/MFA entirely","HIGH",8.1,"2026-10-14",0],["CVE-2026-0318","Palo Alto Networks","Cloud NGFW","PAN-OS: Denial of Service (DoS) on Panorama","MEDIUM",4.6,"2026-10-14",0],["CVE-2026-57491","error311","FileRise","FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload bloc","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-57489","error311","FileRise","FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full","HIGH",8.1,"2026-10-14",0],["CVE-2026-0319","Palo Alto Networks","Cloud NGFW","PAN-OS: Improper Input Handling Vulnerability","MEDIUM",4.9,"2026-10-14",0],["CVE-2026-110670","cemtan","sar2html","cemtan sar2html Archive Processing sar2html.py updateDb sql injection","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-0320","Palo Alto Networks","Cloud NGFW","PAN-OS: Authenticated Admin Command Injection Vulnerability","MEDIUM",6.1,"2026-10-14",0],["CVE-2026-100232","SonicWall","Network Security Manager (NSM)","Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS","HIGH",7.2,"2026-10-14",0],["CVE-2026-96540","SonicWall","Network Security Manager (NSM)","An improper access control vulnerability has been identified in the SonicWall Network Secu","HIGH",8.8,"2026-10-14",0],["CVE-2026-71854","OpenAEV-Platform","openaev","OpenAEV has unauthenticated access and missing object-level authorization on player lesson","HIGH",8.2,"2026-10-14",0],["CVE-2026-0321","Palo Alto Networks","Cloud NGFW","PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services","MEDIUM",6.6,"2026-10-14",0],["CVE-2026-55498","error311","FileRise","FileRise Shared Folder Symlink Escape","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-55684","LabRedesCefetRJ","WeGIA","WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-55682","LabRedesCefetRJ","WeGIA","WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/segura","HIGH",8.1,"2026-10-14",0],["CVE-2026-110669","cemtan","sar2html","cemtan sar2html sar2html.py deleteAll missing authentication","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-55681","LabRedesCefetRJ","WeGIA","WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parame","HIGH",8.8,"2026-10-14",0],["CVE-2026-55679","LabRedesCefetRJ","WeGIA","WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-55680","LabRedesCefetRJ","WeGIA","WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via \"codigo\" parameter","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-55683","LabRedesCefetRJ","WeGIA","WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-110310","Amazon","Amazon.Extensions.S3.Encryption","RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encry","MEDIUM",6,"2026-10-14",0],["CVE-2026-102980","makeplane","plane","Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-102985","makeplane","plane","Plane: Any project member can modify (deactivate) other members' records","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-110668","cemtan","sar2html","cemtan sar2html sar2html.py index sql injection","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102986","makeplane","plane","Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /a","HIGH",8.1,"2026-10-14",0],["CVE-2026-55382","InvoiceShelf","InvoiceShelf","InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NoteP","HIGH",7.6,"2026-10-14",0],["CVE-2026-55385","InvoiceShelf","InvoiceShelf","InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-55381","InvoiceShelf","InvoiceShelf","InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user ","HIGH",7.1,"2026-10-14",0],["CVE-2026-55383","InvoiceShelf","InvoiceShelf","InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure","HIGH",8.2,"2026-10-14",0],["CVE-2026-55387","InvoiceShelf","InvoiceShelf","InvoiceShelf bulk deletion lacks company scoping","HIGH",7.2,"2026-10-14",0],["CVE-2026-55386","InvoiceShelf","InvoiceShelf","InvoiceShelf ORDER BY SQL injection through orderByField","HIGH",7.1,"2026-10-14",0],["CVE-2026-55384","InvoiceShelf","InvoiceShelf","InvoiceShelf trusts client-supplied document totals","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-54702","shd101wyy","vscode-markdown-preview-enhanced","Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler","HIGH",7.3,"2026-10-14",0],["CVE-2026-54701","shd101wyy","vscode-markdown-preview-enhanced","Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in ","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-54703","shd101wyy","vscode-markdown-preview-enhanced","Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Va","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-54566","shd101wyy","vscode-markdown-preview-enhanced","Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/conf","HIGH",8.5,"2026-10-14",0],["CVE-2026-54525","shd101wyy","vscode-markdown-preview-enhanced","Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows","HIGH",8.8,"2026-10-14",0],["CVE-2026-110667","cemtan","sar2html","cemtan sar2html sar2html.py hard-coded credentials","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102354","alam00000","bentopdf","BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-102899","getsentry","sentry","Sentry: Improper authentication on SAML SSO process allows user identity linking","HIGH",7.6,"2026-10-14",0],["CVE-2026-102471","Eclipse Foundation","Eclipse Vert.x","CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-82402","gogs","gogs","Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110775","ModelEngine-Group","nexent","Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access","HIGH",7.1,"2026-10-14",0],["CVE-2026-110774","blinkospace","blinko","Blinko through 1.8.8 Private Attachment Read via /api/file Route","MEDIUM",6,"2026-10-14",0],["CVE-2026-110773","growchief","growchief","GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110772","we-promise","sure","Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110771","Shopizer","Shopizer","Shopizer through 3.2.5 Authorization Bypass via Product Review customerId","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110770","databasus","databasus","Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-110769","holaboss-ai","holaOS","holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors","HIGH",8.3,"2026-10-14",0],["CVE-2026-110768","holaboss-ai","holaOS","holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-110767","coderamp-labs","gitingest","Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion","HIGH",8.7,"2026-10-14",0],["CVE-2026-110766","colanode","colanode","Colanode Server through 0.4.7 Path Traversal via Avatar Download Route","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110765","flexprice","flexprice","FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass","HIGH",8.2,"2026-10-14",0],["CVE-2026-110764","iflytek","astron-rpa","AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download","MEDIUM",6,"2026-10-14",0],["CVE-2026-110763","zuihou","lamp-boot","lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110762","bbPress","bbPress","bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-110761","ILIAS-eLearning e.V.","ILIAS","ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import","HIGH",8.7,"2026-10-14",0],["CVE-2026-102755","dataease","dataease","DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-110666","cemtan","sar2html","cemtan sar2html File Upload sar2html.py updateDb path traversal","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102756","dataease","dataease","DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-102479","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x H","HIGH",8.7,"2026-10-14",0],["CVE-2026-104143","dataease","dataease","DataEase: Stored SQL Injection via dateFormat field templates","HIGH",8.7,"2026-10-14",0],["CVE-2026-104142","dataease","dataease","DataEase: Stored SQL Injection in group-field binning bounds","HIGH",8.7,"2026-10-14",0],["CVE-2026-104141","dataease","dataease","DataEase: SQL Injection in datasource metadata identifiers","HIGH",8.7,"2026-10-14",0],["CVE-2026-82153","Dell","OS Recovery Tool","Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive ","LOW",2.2,"2026-10-14",0],["CVE-2026-53999","radius-project","radius","Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (M","HIGH",7.7,"2026-10-14",0],["CVE-2026-102460","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5","HIGH",8.6,"2026-10-14",0],["CVE-2026-110248","AWS","SageMaker Python SDK","Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils","MEDIUM",6,"2026-10-14",0],["CVE-2026-102748","dgraph-io","dgraph","Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-109506","TP-Link Systems Inc.","RE190 v5","Improper Authentication in Multiple TP-Link WiFi Repeaters","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-102682","pipecat-ai","pipecat","Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot ses","MEDIUM",5.6,"2026-10-14",0],["CVE-2026-100406","dbt-labs","dbt-core","dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`","HIGH",8.2,"2026-10-14",0],["CVE-2026-63626","cesanta","mongoose","Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB r","HIGH",8.8,"2026-10-14",0],["CVE-2026-73261","cesanta","mongoose","Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, sil","HIGH",7.5,"2026-10-14",0],["CVE-2026-73260","cesanta","mongoose","Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser","HIGH",7.5,"2026-10-14",0],["CVE-2026-73252","cesanta","mongoose","Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one lengt","HIGH",7.5,"2026-10-14",0],["CVE-2026-55167","LDAPAccountManager","lam","LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session","MEDIUM",4.2,"2026-10-14",0],["CVE-2026-85714","Stirling-Tools","Stirling-PDF","Stirling-PDF: Remote Code Execution via H2","CRITICAL",9.1,"2026-10-14",0],["CVE-2026-103930","yhirose","cpp-httplib","cpp-httplib open_stream serializes CRLF in request target into HTTP request line","LOW",3.7,"2026-10-14",0],["CVE-2026-102944","yhirose","cpp-httplib","cpp-httplib: Cookie header leaked on cross-origin redirect","HIGH",7.5,"2026-10-14",0],["CVE-2026-103974","lichess-org","lila","lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-110536","D-Link","DIR-868L","D-Link DIR-868L HNAP CGI cgibin system os command injection","CRITICAL",10,"2026-10-14",0],["CVE-2026-55786","flytohub","flyto-core","Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`","HIGH",8.4,"2026-10-14",0],["CVE-2026-55787","flytohub","flyto-core","Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) ","HIGH",7.1,"2026-10-14",0],["CVE-2026-55573","e107inc","e107","e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-55572","e107inc","e107","e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username","CRITICAL",10,"2026-10-14",0],["CVE-2026-102476","Eclipse Foundation","Eclipse Vert.x","In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x H","CRITICAL",9.1,"2026-10-14",0],["CVE-2026-103975","appium","appium","Appium: Symlink based Zip Slip in @appium/support ZIP extraction","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-105066","SimplyRETS","SimplyRETS Real Estate IDX","WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerab","HIGH",7.1,"2026-10-14",0],["CVE-2026-108480","Skydropx","Skydropx","WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability","HIGH",8.2,"2026-10-14",0],["CVE-2026-108483","hippooo","Hippoo Mobile App for WooCommerce","WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) ","HIGH",7.1,"2026-10-14",0],["CVE-2026-108484","WPManageNinja","Best Payments Plugin for WP","WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulner","HIGH",7.1,"2026-10-14",0],["CVE-2026-103081","VillaTheme","Salevo","WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability","HIGH",7.5,"2026-10-14",0],["CVE-2026-108151","PluginUs.Net","MDTF","WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-104103","ludwig-ai","ludwig","Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symli","HIGH",8.1,"2026-10-14",0],["CVE-2026-110777","GNOME","evolution-data-server","Evolution-data-server: local file disclosure via attach file:// uris","MEDIUM",5.7,"2026-10-14",0],["CVE-2026-54554","FOGProject","fogproject","FOG adInfo endpoint is reported to disclose the Active Directory join password","HIGH",7.5,"2026-10-14",0],["CVE-2026-100413","seaweedfs","seaweedfs","SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deploy","HIGH",7,"2026-10-14",0],["CVE-2026-77371","getredash","redash","Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external acc","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-79957","ServiceNext","SerTec","ServiceNext Insecure Direct Object Reference via GetUsarios","HIGH",8.1,"2026-10-14",0],["CVE-2026-76083","getredash","redash","Redash: JSON data source query URL can bypass base URL restriction","MEDIUM",4.9,"2026-10-14",0],["CVE-2026-42093","getredash","redash","Redash: SQL Injection via Query Results parameterized query substitution","HIGH",8.7,"2026-10-14",0],["CVE-2026-109527","modelcontextprotocol","python-sdk","Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through","HIGH",7.5,"2026-10-14",0],["CVE-2026-86849","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflo","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86856","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86847","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86846","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86845","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session clea","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86566","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split ","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-86848","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds","HIGH",8.8,"2026-10-14",0],["CVE-2026-88164","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-14",0],["CVE-2026-86567","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, le","HIGH",8.8,"2026-10-14",0],["CVE-2026-106465","Eclipse Foundation","NetX Duo","The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie","HIGH",8.7,"2026-10-14",0],["CVE-2026-108395","modelcontextprotocol","io.modelcontextprotocol.sdk:mcp","Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unb","HIGH",7.5,"2026-10-14",0],["CVE-2026-106464","Eclipse Foundation","NetX Duo","`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv","HIGH",8.7,"2026-10-14",0],["CVE-2026-103415","Eclipse Foundation","NetX Duo","When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into it","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-107350","","PgBouncer","Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer","HIGH",8.8,"2026-10-14",0],["CVE-2026-107349","","PgBouncer","Infinite loop on empty option name in startup options parameter in PgBouncer","HIGH",7.5,"2026-10-14",0],["CVE-2026-107348","","PgBouncer","Integer overflow causes an infinite loop in message buffer growth in PgBouncer","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-103414","Eclipse Foundation","GUIX","The GUIX binary resource (theme) loader sizes its arena and populates it in two separate p","HIGH",8.4,"2026-10-14",0],["CVE-2026-86461","foliovision","FV Flowplayer Video Player","FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upl","HIGH",8.8,"2026-10-14",0],["CVE-2026-0322","Palo Alto Networks","Cloud NGFW","PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface","HIGH",8.6,"2026-10-14",1],["CVE-2026-101954","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover ","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101952","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP ","HIGH",8.7,"2026-10-14",0],["CVE-2026-101949","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specif","HIGH",8.7,"2026-10-14",0],["CVE-2026-92160","nasa","fprime","F´: SendPartial Integer Overflow Leading to Assertion DoS","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-101964","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP messag","HIGH",7.1,"2026-10-14",0],["CVE-2026-101963","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihomi","HIGH",8.7,"2026-10-14",0],["CVE-2026-101962","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash ","HIGH",8.7,"2026-10-14",0],["CVE-2026-92155","nasa","fprime","F´: FileUplink Unknown Packet Type Assertion DoS","HIGH",7.5,"2026-10-14",0],["CVE-2026-101961","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qual","HIGH",8.7,"2026-10-14",0],["CVE-2026-101959","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash","HIGH",7.1,"2026-10-14",0],["CVE-2026-92150","nasa","fprime","F´: GenericHub Malformed Buffer Assertion DoS","HIGH",7.5,"2026-10-14",0],["CVE-2026-101983","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-108390","hestiacp","hestiacp","HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking","CRITICAL",9.9,"2026-10-14",0],["CVE-2026-92154","nasa","fprime","F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packe","HIGH",8.1,"2026-10-14",0],["CVE-2026-101982","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise wh","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101981","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when ","HIGH",8.7,"2026-10-14",0],["CVE-2026-101979","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or deni","HIGH",8.7,"2026-10-14",0],["CVE-2026-101976","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an ","HIGH",8.7,"2026-10-14",0],["CVE-2026-101975","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefi","HIGH",7.1,"2026-10-14",0],["CVE-2026-101972","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF ","HIGH",7.1,"2026-10-14",0],["CVE-2026-92158","nasa","fprime","F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds","HIGH",7.2,"2026-10-14",0],["CVE-2026-102077","Juniper Networks","Junos OS","Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to res","HIGH",8.7,"2026-10-14",0],["CVE-2026-92159","nasa","fprime","F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corru","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-92156","nasa","fprime","F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard G","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-92157","nasa","fprime","F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-92152","nasa","fprime","F´: Unvalidated Port Index in GenericHub","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-33798","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when S","HIGH",8.7,"2026-10-14",0],["CVE-2026-33796","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP r","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-33795","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-S","HIGH",8.7,"2026-10-14",0],["CVE-2026-33792","Juniper Networks","Junos OS","Junos OS: SRX Series: An attacker causes remote code execution and denial of service when ","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-33789","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a speci","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-102185","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multi","HIGH",8.7,"2026-10-14",0],["CVE-2026-102184","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash","HIGH",8.7,"2026-10-14",0],["CVE-2026-102183","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd ","HIGH",8.7,"2026-10-14",0],["CVE-2026-102182","Juniper Networks","Junos OS","Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102180","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming tele","HIGH",8.7,"2026-10-14",0],["CVE-2026-102179","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB","HIGH",8.7,"2026-10-14",0],["CVE-2026-102178","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malform","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102177","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backu","HIGH",7.2,"2026-10-14",0],["CVE-2026-102176","Juniper Networks","Junos OS","Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the S","HIGH",8.7,"2026-10-14",0],["CVE-2026-102175","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of servi","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-96596","erlang","rebar3","erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-102174","Juniper Networks","Junos OS","Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of serv","HIGH",8.7,"2026-10-14",0],["CVE-2026-102061","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provi","HIGH",8.7,"2026-10-14",0],["CVE-2026-105236","Erlang","OTP","TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust bounda","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-102060","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon ","HIGH",7.1,"2026-10-14",0],["CVE-2026-102059","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server caus","HIGH",8.7,"2026-10-14",0],["CVE-2026-94200","Erlang","OTP","TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in","HIGH",8.2,"2026-10-14",0],["CVE-2026-102058","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is ena","HIGH",7.1,"2026-10-14",0],["CVE-2026-102057","Juniper Networks","Junos OS","Junos OS: An attacker causes DHCP service disruption during DHCP client operation","HIGH",8.7,"2026-10-14",0],["CVE-2026-102056","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclo","HIGH",7.1,"2026-10-14",0],["CVE-2026-105659","mtrudel","bandit","HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream p","HIGH",8.7,"2026-10-14",0],["CVE-2026-102055","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execu","HIGH",8.7,"2026-10-14",0],["CVE-2026-102054","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes inform","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-102053","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when act","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102052","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-cl","HIGH",8.7,"2026-10-14",0],["CVE-2026-102051","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast r","HIGH",7.1,"2026-10-14",0],["CVE-2026-102050","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of","HIGH",8.7,"2026-10-14",0],["CVE-2026-102049","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when ","HIGH",8.7,"2026-10-14",0],["CVE-2026-102048","Juniper Networks","Junos OS","Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation ena","HIGH",7.1,"2026-10-14",0],["CVE-2026-102047","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is use","HIGH",7.1,"2026-10-14",0],["CVE-2026-102046","Juniper Networks","Junos OS","Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP servi","HIGH",8.7,"2026-10-14",0],["CVE-2026-102045","Juniper Networks","Junos OS Evolved","Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled","HIGH",7.1,"2026-10-14",0],["CVE-2026-102044","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of servic","HIGH",8.7,"2026-10-14",0],["CVE-2026-102043","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fas","HIGH",7.1,"2026-10-14",0],["CVE-2026-102042","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidire","HIGH",7.1,"2026-10-14",0],["CVE-2026-102041","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enab","HIGH",7.1,"2026-10-14",0],["CVE-2026-102040","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidir","HIGH",7.1,"2026-10-14",0],["CVE-2026-102039","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when G","HIGH",7.1,"2026-10-14",0],["CVE-2026-102037","Juniper Networks","Junos OS","Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom UR","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-102036","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of ","HIGH",8.7,"2026-10-14",0],["CVE-2026-102035","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC ","HIGH",7.1,"2026-10-14",0],["CVE-2026-102034","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC sy","HIGH",7.1,"2026-10-14",0],["CVE-2026-102033","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchr","HIGH",7.1,"2026-10-14",0],["CVE-2026-102032","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of servi","HIGH",7.1,"2026-10-14",0],["CVE-2026-102031","Juniper Networks","Junos OS Evolved","Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authori","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102030","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BG","HIGH",8.7,"2026-10-14",0],["CVE-2026-102029","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an","HIGH",8.7,"2026-10-14",0],["CVE-2026-102028","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is","HIGH",8.7,"2026-10-14",0],["CVE-2026-102027","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath n","HIGH",8.7,"2026-10-14",0],["CVE-2026-102026","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB shar","HIGH",8.7,"2026-10-14",0],["CVE-2026-102025","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended","HIGH",8.7,"2026-10-14",0],["CVE-2026-102024","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended","HIGH",8.7,"2026-10-14",0],["CVE-2026-102023","Juniper Networks","Junos OS Evolved","Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are","HIGH",8.7,"2026-10-14",0],["CVE-2026-102022","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traf","HIGH",8.7,"2026-10-14",0],["CVE-2026-102021","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error p","HIGH",7.1,"2026-10-14",0],["CVE-2026-102020","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED","HIGH",8.7,"2026-10-14",0],["CVE-2026-102019","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption w","HIGH",7.1,"2026-10-14",0],["CVE-2026-102018","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing serv","HIGH",7.1,"2026-10-14",0],["CVE-2026-75085","zephyrproject","zephyr","Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driv","MEDIUM",4.2,"2026-10-14",0],["CVE-2026-75084","zephyrproject","zephyr","Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-suppli","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-19673","zephyrproject","zephyr","Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a trunc","HIGH",7.1,"2026-10-14",0],["CVE-2026-75083","zephyrproject","zephyr","Integer underflow of the radio-reported frame length causes an out-of-bounds write in the ","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-102017","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Aut","HIGH",7.1,"2026-10-14",0],["CVE-2026-109439","LANTRONIX","XPress-DR","Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102016","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling","HIGH",8.7,"2026-10-14",0],["CVE-2026-102015","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authenti","HIGH",8.7,"2026-10-14",0],["CVE-2026-102014","Juniper Networks","Junos OS","Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used","HIGH",8.7,"2026-10-14",0],["CVE-2026-102013","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync s","MEDIUM",6.7,"2026-10-14",0],["CVE-2026-102012","Juniper Networks","Junos OS Evolved","Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled","HIGH",8.7,"2026-10-14",0],["CVE-2026-102011","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is","HIGH",7.1,"2026-10-14",0],["CVE-2026-102000","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled","HIGH",7.1,"2026-10-14",0],["CVE-2026-101999","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled","HIGH",7.1,"2026-10-14",0],["CVE-2026-101971","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv","HIGH",7.1,"2026-10-14",0],["CVE-2026-101970","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-trigge","HIGH",7.1,"2026-10-14",0],["CVE-2026-101969","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service wh","HIGH",7.1,"2026-10-14",0],["CVE-2026-101968","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd he","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-101946","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 ","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-101945","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EV","HIGH",8.7,"2026-10-14",0],["CVE-2026-101944","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of serv","HIGH",8.7,"2026-10-14",0],["CVE-2026-101943","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVP","HIGH",8.7,"2026-10-14",0],["CVE-2026-101942","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route si","HIGH",8.7,"2026-10-14",0],["CVE-2026-101941","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolut","HIGH",8.7,"2026-10-14",0],["CVE-2026-101940","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN ","HIGH",8.7,"2026-10-14",0],["CVE-2026-101939","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon deni","HIGH",8.7,"2026-10-14",0],["CVE-2026-101938","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage wh","HIGH",7.1,"2026-10-14",0],["CVE-2026-101937","Juniper Networks","Junos OS","Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster","HIGH",7.1,"2026-10-14",0],["CVE-2026-101936","Juniper Networks","Junos OS","Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster","HIGH",7.1,"2026-10-14",0],["CVE-2026-101934","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd","MEDIUM",6.7,"2026-10-14",0],["CVE-2026-101927","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or ","HIGH",8.6,"2026-10-14",0],["CVE-2026-101984","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggrega","HIGH",7.1,"2026-10-14",0],["CVE-2026-100236","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: heap out-of-bounds read/write in gso header copy","HIGH",8.6,"2026-10-14",0],["CVE-2026-101987","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexi","HIGH",7.1,"2026-10-14",0],["CVE-2026-101988","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash wh","HIGH",7.1,"2026-10-14",0],["CVE-2026-101989","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enab","HIGH",7.1,"2026-10-14",0],["CVE-2026-101990","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101992","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID ","HIGH",7.1,"2026-10-14",0],["CVE-2026-101993","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-I","HIGH",7.1,"2026-10-14",0],["CVE-2026-101994","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure ","HIGH",7.1,"2026-10-14",0],["CVE-2026-101996","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash whe","HIGH",7.1,"2026-10-14",0],["CVE-2016-15060","PCMan","FTP Server","PCMan FTP Server PORT buffer overflow","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102064","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress ","HIGH",8.7,"2026-10-14",0],["CVE-2026-102066","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabl","HIGH",7.1,"2026-10-14",0],["CVE-2026-15102","Autodesk","ADP Desktop SDK","Cleartext Transmission of Sensitive Information in ADP Desktop SDK","HIGH",7.5,"2026-10-14",0],["CVE-2026-102071","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bi","HIGH",7.1,"2026-10-14",0],["CVE-2026-101950","Juniper Networks","Junos OS","Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Se","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101955","Juniper Networks","Junos OS","Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SB","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-101997","Juniper Networks","Junos OS","Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security ","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-92153","nasa","fprime","F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinatio","HIGH",7.1,"2026-10-14",0],["CVE-2026-102062","Juniper Networks","Junos OS","Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution whe","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-102078","Juniper Networks","Junos OS","Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash","HIGH",8.2,"2026-10-14",0],["CVE-2026-102079","Juniper Networks","Junos OS","Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows comm","HIGH",8.5,"2026-10-14",0],["CVE-2026-102080","Juniper Networks","Junos OS","Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover","MEDIUM",6,"2026-10-14",0],["CVE-2026-102081","Juniper Networks","Junos OS","Junos OS: SRX4000 Series, SRX5000 Series and MX Series with SPC3: With application service","HIGH",8.7,"2026-10-14",0],["CVE-2026-92151","nasa","fprime","F´: SpacePacketDeframer Small Packet Assertion DoS","HIGH",7.5,"2026-10-14",0],["CVE-2026-102082","Juniper Networks","Junos OS","Junos OS: SRX Series: If TLS session resumption is configured and a specific TLS message i","HIGH",8.2,"2026-10-14",0],["CVE-2026-93637","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting","LOW",3.7,"2026-10-14",0],["CVE-2026-102083","Juniper Networks","Junos OS","Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a cr","HIGH",8.2,"2026-10-14",0],["CVE-2026-102084","Juniper Networks","Junos OS","Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote C","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-93635","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substi","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-102085","Juniper Networks","Junos OS Evolved","Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacke","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-102086","Juniper Networks","Junos OS","Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same sessi","HIGH",8.2,"2026-10-14",0],["CVE-2026-102087","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-L","HIGH",7.1,"2026-10-14",0],["CVE-2026-103993","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and gracefu","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-59951","modelcontextprotocol","python-sdk","MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resourc","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-101991","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engi","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-101986","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101951","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NL","HIGH",8.7,"2026-10-14",0],["CVE-2026-101957","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived grace","HIGH",8.7,"2026-10-14",0],["CVE-2026-102065","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dyn","HIGH",8.7,"2026-10-14",0],["CVE-2026-101974","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or servi","HIGH",7.1,"2026-10-14",0],["CVE-2026-102067","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP supp","HIGH",7.1,"2026-10-14",0],["CVE-2026-101995","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and di","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-101948","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP","HIGH",8.7,"2026-10-14",0],["CVE-2026-101977","Juniper Networks","Junos OS","Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral co","HIGH",8.7,"2026-10-14",0],["CVE-2026-103946","Tenable, Inc.","Nessus","SQL Injection","HIGH",8.7,"2026-10-14",0],["CVE-2026-101956","Juniper Networks","Junos OS","Junos OS: Unauthorized root command execution when J-Web is enabled","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-101980","Juniper Networks","Junos OS","Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Ech","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102069","Juniper Networks","Junos OS","Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled","HIGH",8.7,"2026-10-14",0],["CVE-2026-102070","Juniper Networks","Junos OS","Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-101973","Juniper Networks","Junos OS","Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is","HIGH",8.7,"2026-10-14",0],["CVE-2026-102072","Juniper Networks","Junos OS","Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-ser","HIGH",7.1,"2026-10-14",0],["CVE-2026-103994","Juniper Networks","Junos OS","Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution","HIGH",8.7,"2026-10-14",0],["CVE-2026-102063","Juniper Networks","Junos OS","Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR lin","HIGH",7.1,"2026-10-14",0],["CVE-2026-101965","Juniper Networks","Junos OS Evolved","Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry","HIGH",8.7,"2026-10-14",0],["CVE-2026-77524","kedacore","keda","KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentic","CRITICAL",9.9,"2026-10-14",0],["CVE-2026-101967","Juniper Networks","Junos OS Evolved","Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compr","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-102068","Juniper Networks","Junos OS Evolved","Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP ke","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-101960","Juniper Networks","Junos OS Evolved","Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is","HIGH",7.1,"2026-10-14",0],["CVE-2026-101978","Juniper Networks","Junos OS Evolved","Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compr","HIGH",8.7,"2026-10-14",0],["CVE-2026-101985","Juniper Networks","Junos OS Evolved","Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is en","HIGH",7.1,"2026-10-14",0],["CVE-2026-101966","Juniper Networks","Junos OS Evolved","Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon den","HIGH",8.8,"2026-10-14",0],["CVE-2026-77564","siderolabs","talos","Talos Linux: Support bundle does not redact registry credentials","LOW",3.3,"2026-10-14",0],["CVE-2026-86565","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, ca","HIGH",8.2,"2026-10-14",0],["CVE-2026-86563","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: double offset bug in vhost log mapping calculation","HIGH",7.8,"2026-10-14",0],["CVE-2026-86562","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse","HIGH",7.8,"2026-10-14",0],["CVE-2026-76519","Cisco","Cisco Secure Email","Cisco Secure Email Gateway Arbitrary File Write Vulnerability","CRITICAL",9.8,"2026-10-14",1],["CVE-2026-67418","rabbitmq","rabbitmq-server","RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-67414","rabbitmq","rabbitmq-server","RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggrega","MEDIUM",6,"2026-10-14",0],["CVE-2026-100169","Prowler","Prowler","Account pre-hijacking in the Prowler API through email based social account linking withou","HIGH",7.6,"2026-10-14",0],["CVE-2026-67416","rabbitmq","rabbitmq-server","RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-102695","omnifaces","omnifaces","OmniFaces: Forged combined-resource IDs and related output/push boundaries","HIGH",8.2,"2026-10-14",0],["CVE-2026-53615","util-linux","util-linux","util-linux libblkid DOS extended-partition overflow produces invalid partition metadata","HIGH",8,"2026-10-14",0],["CVE-2026-86002","dokku","dokku","Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS","CRITICAL",9,"2026-10-14",0],["CVE-2026-109438","3proxy","3proxy","3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-110736","godotengine","Godot Engine","Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (","LOW",3.6,"2026-10-14",0],["CVE-2026-100404","zulip","zulip","Zulip: Guests can read new messages in non-subscribed public channels","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-102893","zulip","zulip","Zulip: OpenID Connect authentication ignores the email_verified claim","CRITICAL",9.1,"2026-10-14",0],["CVE-2026-49206","d99kris","rapidcsv","rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access","LOW",2.9,"2026-10-14",0],["CVE-2026-62858","YOURLS","YOURLS","YOURLS: Unauthenticated File Inclusion","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-86561","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-93683","Red Hat","Fast Datapath for RHEL 10","Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-110735","godotengine","Godot Engine","Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (c","LOW",2.5,"2026-10-14",0],["CVE-2026-53614","util-linux","util-linux","util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass","HIGH",7,"2026-10-14",0],["CVE-2026-100394","nezhahq","nezha","Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process fo","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-91157","discourse","discourse","Discourse: Media uploads remain publicly accessible after category permissions are restric","HIGH",7.5,"2026-10-14",0],["CVE-2026-110734","godotengine","Godot Engine","Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image","LOW",2.5,"2026-10-14",0],["CVE-2026-91156","discourse","discourse","Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","HIGH",7.5,"2026-10-14",0],["CVE-2026-91159","discourse","discourse","Discourse: Stored oEmbed HTML injection via allowed iframe","HIGH",7.7,"2026-10-14",0],["CVE-2026-77572","veracrypt","VeraCrypt","VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink ta","LOW",3.3,"2026-10-14",0],["CVE-2026-91883","Dell","Terraform Provider for OME","Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Se","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-89077","Progress","MOVEit Transfer","MOVEit Transfer Identity validation flaw in SFTP authentication","HIGH",7.5,"2026-10-14",0],["CVE-2026-91882","Dell","Terraform Provider for OME","Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Se","HIGH",8.6,"2026-10-14",0],["CVE-2026-89076","Progress","MOVEit Transfer","MOVEit Transfer SQL injection in custom reporting","HIGH",7.2,"2026-10-14",0],["CVE-2026-89075","Progress","MOVEit Transfer","MOVEit Transfer Local Disclosure of Session Information Vulnerability","HIGH",7.3,"2026-10-14",0],["CVE-2026-89074","Progress","MOVEit Transfer","MOVEit Transfer Email MFA Bypass","HIGH",7.5,"2026-10-14",0],["CVE-2026-89073","Progress","MOVEit Transfer","MOVEit Transfer Access restriction bypass in OAuth authentication","HIGH",7.5,"2026-10-14",0],["CVE-2026-103929","jdx","mise","mise permits untrusted local configuration to override default shell arguments","HIGH",7.8,"2026-10-14",0],["CVE-2026-89072","Progress","MOVEit Transfer","MOVEit Transfer Authorization Flaw in Certificate Management","HIGH",7.5,"2026-10-14",0],["CVE-2026-91881","Dell","Terraform Provider for Redfish","Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certifi","CRITICAL",9,"2026-10-14",0],["CVE-2026-89071","Progress","MOVEit Transfer","MOVEit Transfer LDAP injection in certificate-based authentication","HIGH",7.5,"2026-10-14",0],["CVE-2026-89070","Progress","MOVEit Transfer","MOVEit Transfer OIDC Authentication Replay Vulnerability","HIGH",7.5,"2026-10-14",0],["CVE-2026-89069","Progress","MOVEit Transfer","MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages","HIGH",8,"2026-10-14",0],["CVE-2026-89068","Progress","MOVEit Transfer","MOVEit Transfer Authentication bypass in LDAP sign-on","HIGH",8.1,"2026-10-14",0],["CVE-2026-101896","angular","angular","Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR","HIGH",8.2,"2026-10-14",0],["CVE-2026-89067","Progress","MOVEit Transfer","MOVEit Transfer Secure Messaging Authentication Bypass","HIGH",8.8,"2026-10-14",0],["CVE-2026-76113","Dell","Terraform Provider for Redfish","Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-87093","Progress","MOVEit Transfer","MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalati","HIGH",8.8,"2026-10-14",0],["CVE-2026-101897","angular","angular","Angular DevTools (Local DoS)","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-110719","Portkey-AI","gateway","Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110717","meetecho","janus-gateway","Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110718","TurboDocx","html-to-docx","TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download","HIGH",8.2,"2026-10-14",0],["CVE-2026-110716","twogood","unshield","unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110714","sahlberg","libsmb2","libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow","HIGH",7.1,"2026-10-14",0],["CVE-2026-110715","Artifex Software","MuJS","MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110713","sahlberg","libsmb2","libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders","HIGH",7.1,"2026-10-14",0],["CVE-2026-110712","sahlberg","libsmb2","libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info","HIGH",7.1,"2026-10-14",0],["CVE-2026-110660","vgmstream","vgmstream","vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110661","CGNS","CGNS","CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110659","serge1","ELFIO","ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110658","freeswitch","sofia-sip","Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110656","miniupnp project","miniupnpc","miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt","LOW",2.3,"2026-10-14",0],["CVE-2026-110657","Khronos Group","nnef","Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Va","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110655","miniupnp project","miniupnpc","miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt","LOW",2.3,"2026-10-14",0],["CVE-2026-110654","zapping-vbi","libzvbi","libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-101895","angular","angular","Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE","HIGH",8.7,"2026-10-14",0],["CVE-2026-107381","darylldoyle","svg-sanitizer","svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::proc","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-53613","util-linux","util-linux","util-linux mount target TOCTOU allows local privilege escalation","HIGH",7,"2026-10-14",0],["CVE-2026-53612","util-linux","util-linux","util-linux mount hook_owner TOCTOU allows local privilege escalation","HIGH",7,"2026-10-14",0],["CVE-2026-104939","F5","NGINX Ingress Controller","NGINX Ingress Controller vulnerability","HIGH",8.7,"2026-10-14",0],["CVE-2026-101019","F5","NGINX JavaScript","NGINX ngx_http_js_module vulnerability","HIGH",8.3,"2026-10-14",0],["CVE-2026-101025","F5","NGINX JavaScript","NGINX ngx_http_js_module vulnerability","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-94197","F5","NGINX Ingress Controller","NGINX Ingress Controller vulnerability","HIGH",8.7,"2026-10-14",0],["CVE-2026-95101","F5","NGINX Plus","NGINX ngx_http_v3_module vulnerability","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-96615","F5","NGINX Gateway Fabric","NGINX Gateway Fabric vulnerability","HIGH",7.1,"2026-10-14",0],["CVE-2026-91184","F5","NGINX Gateway Fabric","NGINX Gateway Fabric vulnerability","HIGH",8.7,"2026-10-14",0],["CVE-2026-93479","F5","NGINX Plus","NGINX map directive and regex matching vulnerability","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-97205","F5","NGINX Plus","NGINX ngx_http_core_module vulnerability","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-15176","F5","NGINX Plus","NGINX ngx_http_core_module vulnerability","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-97629","F5","NGINX Plus","NGINX ngx_http_ssl_module vulnerability","HIGH",8.3,"2026-10-14",0],["CVE-2026-78433","Gitea","Gitea","Gitea private attachment disclosure through repository mismatch","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-78231","Gitea","Gitea","Gitea blind SSRF through OpenID assertion verification","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-73814","Gitea","Gitea","Gitea repository ownership escalation by administrators","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-73804","Gitea","Gitea","Gitea API token scope escalation through HTTP signatures","HIGH",8.1,"2026-10-14",0],["CVE-2026-73802","Gitea","Gitea Runner","Gitea Runner host isolation bypass through container options","HIGH",8.8,"2026-10-14",0],["CVE-2026-73800","Gitea","Gitea","Gitea reusable workflow secret exposure in pull_request_target","HIGH",8.8,"2026-10-14",0],["CVE-2026-73539","Gitea","Gitea","Gitea external renderer argument injection and code execution","HIGH",7.5,"2026-10-14",0],["CVE-2026-73535","Gitea","Gitea","Gitea second-factor bypass through OpenID identity linking","HIGH",8.8,"2026-10-14",0],["CVE-2026-73273","Gitea","Gitea","Gitea Maven checksum upload quota bypass and memory exhaustion","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-73135","Gitea","Gitea","Gitea hidden-owner repository listing disclosure","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-73130","Gitea","Gitea","Gitea repository initialization resource exhaustion","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-73126","Gitea","Gitea","Gitea private workflow badge token scope bypass","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-71301","Gitea","Gitea","Gitea private pull request title disclosure through markup","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-71184","Gitea","Gitea","Gitea fork workflow approval bypass through review events","HIGH",8.8,"2026-10-14",0],["CVE-2026-70407","Gitea","Gitea","Gitea organization listing token scope bypass","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-70406","Gitea","Gitea","Gitea private comparison disclosure with public-only tokens","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-70402","Gitea","Gitea","Gitea local code execution through writable Git hooks","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-70400","Gitea","Gitea","Gitea private migration creation with public-only tokens","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-70396","Gitea","Gitea","Gitea organization repository creation token scope bypass","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-68964","Gitea","Gitea","Gitea restricted-user SSH and GPG key metadata disclosure","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-68957","Gitea","Gitea","Gitea restricted-user issue search disclosure","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-67577","Gitea","Gitea","Gitea restricted-user activity and heatmap disclosure","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-66877","Gitea","Gitea","Gitea fork workflow approval bypass through concurrency cancellation","HIGH",8.1,"2026-10-14",0],["CVE-2026-66874","Gitea","Gitea","Gitea required Actions check bypass through skipped workflows","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-66853","Gitea","Gitea","Gitea restricted-user organization metadata disclosure","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-66849","Gitea","Gitea","Gitea restricted-user package visibility bypass","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-84471","OpenVPN","OpenVPN","The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.2","HIGH",7.2,"2026-10-14",0],["CVE-2026-63792","Gitea","Gitea","Gitea private reusable workflow disclosure to fork runs","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-63021","Gitea","Gitea","Gitea Swift package manifest memory exhaustion","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-62925","Gitea","Gitea","Gitea Alpine package parsing memory exhaustion","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-60021","Gitea","Gitea","Gitea GitLab migration denial of service","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-60018","Gitea","Gitea","Gitea OneDev migration denial of service","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-60010","Gitea","Gitea","Gitea organization team policy bypass through repository API","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-60008","Gitea","Gitea","Gitea Jupyter notebook UI redress through CSS class injection","LOW",3.5,"2026-10-14",0],["CVE-2026-59774","Gitea","Gitea","Gitea Org-mode file disclosure and code execution","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-59766","Gitea","Gitea","Gitea private repository metadata disclosure after access revocation","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-25946","Gitea","Gitea","Gitea OpenID discovery server-side request forgery","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110650","anshulkharb","thumbnail","Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110648","adamarcanov","compress-fonts","@offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names","HIGH",8.5,"2026-10-14",0],["CVE-2026-110649","shahkashani","stills","Stills before 25.24.2 OS Command Injection via Media File Names","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110646","beganovich","snappdf","Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-110647","jinghaihan","turnpress","Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names","HIGH",8.5,"2026-10-14",0],["CVE-2026-110645","ArsalanDotMe","video-stitch","Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110643","kky-ykk","transcribe2texts","transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110644","ChetanXpro","nodejs-whisper","nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110642","xhtml2pdf","xhtml2pdf","xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name","HIGH",8.5,"2026-10-14",0],["CVE-2026-110640","ariym","whisper-node","Whisper-node through 1.1.1 OS Command Injection via filePath and language","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110641","runnerty","@runnerty/executor-decompress","@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name","HIGH",8.7,"2026-10-14",0],["CVE-2026-110639","mborne","@mborne/extract","@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110637","wastemobile","buildebooks","buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name","HIGH",8.5,"2026-10-14",0],["CVE-2026-110638","zepspaiva","doc-recog","doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110636","revolunet","pypdftk","pypdftk through 0.5 OS Command Injection via PDF and Output Paths","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110634","danday74","git-diff","git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110635","scionoftech","webp-converter","webp-converter before 3.0.0 OS Command Injection via File Names and Options","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110633","Report One","MyReport Updater","MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service","HIGH",8.5,"2026-10-14",0],["CVE-2026-110631","moghtech","komodo","Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110632","Report One","MyReport Updater","Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-110630","venturedrake","laravel-crm","VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment","HIGH",7,"2026-10-14",0],["CVE-2026-110628","kanbn","kan","Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-110629","venturedrake","laravel-crm","VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions","HIGH",7.1,"2026-10-14",0],["CVE-2026-110627","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter","LOW",2.1,"2026-10-14",0],["CVE-2026-110625","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-110626","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-110624","papermerge","papermerge-core","Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all","LOW",2.3,"2026-10-14",0],["CVE-2026-110622","papermerge","papermerge-core","Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints","HIGH",7.7,"2026-10-14",0],["CVE-2026-110623","papermerge","papermerge-core","Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API","HIGH",7.7,"2026-10-14",0],["CVE-2026-110621","Swetrix","swetrix","Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId","HIGH",8.7,"2026-10-14",0],["CVE-2026-110619","fatedier","frp","frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-110620","formbricks","formbricks","Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId","MEDIUM",6.1,"2026-10-14",0],["CVE-2026-110618","pppscn","SmsForwarder","SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API","HIGH",8.6,"2026-10-14",0],["CVE-2026-110616","nullclaw","NullHub","NullHub through 2026.5.29 Missing Authentication for /api Management API","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-110617","rachelos","we-mp-rss","we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-110615","jishenghua","jshERP","jshERP through 3.6 Missing Authorization via /user/batchSetStatus","HIGH",7.1,"2026-10-14",0],["CVE-2026-110613","youlaitech","youlai-mall","youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List","HIGH",7.1,"2026-10-14",0],["CVE-2026-110614","Yiuman","citrus","Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter","HIGH",7.1,"2026-10-14",0],["CVE-2026-110612","wwwlike","vlife","vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil","CRITICAL",9.3,"2026-10-14",0],["CVE-2026-110610","YunaiV","ruoyi-vue-pro","ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110611","getrebuild","rebuild","REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid","MEDIUM",6,"2026-10-14",0],["CVE-2026-110609","dromara","skyeye","Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter","HIGH",7.1,"2026-10-14",0],["CVE-2026-110608","BizSpring","BizSpring Shop","BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110607","BizSpring","BizSpring Shop","BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint","HIGH",7.1,"2026-10-14",0],["CVE-2026-110606","LibreCAD","libdxfrw","LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110605","tomolt","libschrift","libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110603","rapidlasso","LASzip","LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-110604","Michael R Sweet","Mini-XML","Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()","LOW",2,"2026-10-14",0],["CVE-2026-110601","saitoha","libsixel","libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-110602","kyz","libmspack","libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-110600","brechtsanders","xlsxio","xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110599","l-smash","l-smash","L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110597","syoyo","tinyexr","Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110598","libyal","libpff","Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_v","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110595","MicroPyramid","BottleCRM","BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110596","dlbeer","quirc","quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110594","MicroPyramid","BottleCRM","BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-110592","MicroPyramid","BottleCRM","BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-110593","MicroPyramid","BottleCRM","BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110591","OW2","ASM","OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110270","OW2","ASM","OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110262","OW2","ASM","OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter","MEDIUM",4.8,"2026-10-14",0],["CVE-2026-110263","OW2","ASM","OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110261","OW2","ASM","OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110259","OW2","ASM","OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110260","OW2","ASM","OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-110258","OW2","ASM","OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions","MEDIUM",6.8,"2026-10-14",0],["CVE-2025-71433","usekaneo","kaneo","Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access","HIGH",7.7,"2026-10-14",0],["CVE-2026-110257","OW2","ASM","OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute","MEDIUM",6.8,"2026-10-14",0],["CVE-2024-58392","icculus","PhysicsFS","PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint","MEDIUM",4.8,"2026-10-14",0],["CVE-2020-37281","Gravitee","Gravitee API Management","Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass","CRITICAL",9.2,"2026-10-14",0],["CVE-2020-37282","vworld4u","office-converter","office-converter through 1.0.2 OS Command Injection via fileName in generatePdf","CRITICAL",9.3,"2026-10-14",0],["CVE-2017-20286","DentonW","DevIL","DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette","HIGH",8.5,"2026-10-14",0],["CVE-2016-20099","l-smash","l-smash","L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-35161","Dell","PowerScale InsightIQ","Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Ac","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-104086","7-Zip","7-Zip","7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-107870","Crocoblock","JetEngine","WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-14",0],["CVE-2026-94348","Dell","PowerScale InsightIQ","Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralizati","MEDIUM",6.1,"2026-10-14",0],["CVE-2026-101215","Dell","Unisphere for PowerMax vApp","Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralizatio","MEDIUM",6.6,"2026-10-14",0],["CVE-2026-101217","Dell","Unisphere for PowerMax vApp","Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-110690","coderaiser","cloudcmd","Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack","HIGH",8.7,"2026-10-14",0],["CVE-2026-101216","Dell","Unisphere for PowerMax vApp","Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralizatio","MEDIUM",6.6,"2026-10-14",0],["CVE-2026-108065","Channel Software","WebAlliance eCommerce","Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-98431","Linux","Linux","RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","","","2026-10-14",0],["CVE-2026-98430","Linux","Linux","RDMA/efa: Keep admin queues alive while IRQ is registered","","","2026-10-14",0],["CVE-2026-98428","Linux","Linux","ALSA: usb: 6fire: Avoid embedded URBs","","","2026-10-14",0],["CVE-2026-98429","Linux","Linux","RDMA/efa: Keep EQ resources alive while IRQ is registered","","","2026-10-14",0],["CVE-2026-98426","Linux","Linux","wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path","","","2026-10-14",0],["CVE-2026-98427","Linux","Linux","net/sched: codel: bound the dropping loop per dequeue call","","","2026-10-14",0],["CVE-2026-98425","Linux","Linux","wifi: mac80211: don't warn when an IBSS has no channel to scan","","","2026-10-14",0],["CVE-2026-98423","Linux","Linux","wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping","","","2026-10-14",0],["CVE-2026-98424","Linux","Linux","wifi: cfg80211: undo netns switch if renaming the wiphy fails","","","2026-10-14",0],["CVE-2026-98421","Linux","Linux","wifi: mac80211: require a peer station for TDLS setup confirm","","","2026-10-14",0],["CVE-2026-98422","Linux","Linux","wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown","","","2026-10-14",0],["CVE-2026-98419","Linux","Linux","drop_monitor: fix out-of-bounds write in reset_per_cpu_data()","HIGH",7,"2026-10-14",0],["CVE-2026-98420","Linux","Linux","ksmbd: follow SMB2 session expiration semantics","","","2026-10-14",0],["CVE-2026-98418","Linux","Linux","sched/core: Avoid false migration warning for proxy donors","","","2026-10-14",0],["CVE-2026-98416","Linux","Linux","dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()","","","2026-10-14",0],["CVE-2026-98417","Linux","Linux","net: xfrm: reject unrepresentable espintcp transport headers","","","2026-10-14",0],["CVE-2026-98414","Linux","Linux","memcg: avoid charging the root memcg from obj_cgroup_charge_pages()","","","2026-10-14",0],["CVE-2026-98415","Linux","Linux","soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node","","","2026-10-14",0],["CVE-2026-98413","Linux","Linux","selinux: always fill AVC decision in avc_has_perm_noaudit()","","","2026-10-14",0],["CVE-2026-98411","Linux","Linux","power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()","","","2026-10-14",0],["CVE-2026-98412","Linux","Linux","power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()","","","2026-10-14",0],["CVE-2026-98410","Linux","Linux","watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog","","","2026-10-14",0],["CVE-2026-98408","Linux","Linux","watchdog: rzv2h: Avoid division by zero","","","2026-10-14",0],["CVE-2026-98409","Linux","Linux","watchdog: rtd119x: Avoid division by zero","","","2026-10-14",0],["CVE-2026-98406","Linux","Linux","wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver","","","2026-10-14",0],["CVE-2026-98407","Linux","Linux","wifi: rsi: fix heap OOB write on key removal","","","2026-10-14",0],["CVE-2026-98405","Linux","Linux","smb: client: fix missing iov bounds check in parse_posix_sids()","HIGH",8.1,"2026-10-14",0],["CVE-2026-98404","Linux","Linux","drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()","","","2026-10-14",0],["CVE-2026-98402","Linux","Linux","net: icmp: avoid invalid transport header access in icmp_send tracepoint","","","2026-10-14",0],["CVE-2026-98403","Linux","Linux","s390/boot: Avoid IPL parameter append past command line","","","2026-10-14",0],["CVE-2026-98401","Linux","Linux","net: iptunnel: fix stale transport header during tunnel decapsulation","HIGH",7.5,"2026-10-14",0],["CVE-2026-98399","Linux","Linux","s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","","","2026-10-14",0],["CVE-2026-98400","Linux","Linux","s390/ipl: Fix NULL deref in kdump without re-IPL parm block","","","2026-10-14",0],["CVE-2026-98397","Linux","Linux","platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown","","","2026-10-14",0],["CVE-2026-98398","Linux","Linux","locking/lockdep: Invalidate stale class_cache entries for zapped classes","","","2026-10-14",0],["CVE-2026-98396","Linux","Linux","powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()","","","2026-10-14",0],["CVE-2026-98394","Linux","Linux","af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","","","2026-10-14",0],["CVE-2026-98395","Linux","Linux","powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit","","","2026-10-14",0],["CVE-2026-98392","Linux","Linux","Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one","","","2026-10-14",0],["CVE-2026-98393","Linux","Linux","net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","","","2026-10-14",0],["CVE-2026-98391","Linux","Linux","drm/xe: Guard page-fault worker with runtime PM check","","","2026-10-14",0],["CVE-2026-98390","Linux","Linux","x86/amd_node: Avoid divide by zero on virtualized systems","","","2026-10-14",0],["CVE-2026-98388","Linux","Linux","exec: do_close_on_exec() before taking exec_update_lock","","","2026-10-14",0],["CVE-2026-98389","Linux","Linux","drm/amdgpu: skip gfx switch_power_profile during GPU reset","","","2026-10-14",0],["CVE-2026-98387","Linux","Linux","s390/crypto: Fix skcipher_walk return code handling in aes_s390","","","2026-10-14",0],["CVE-2026-98386","Linux","Linux","scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot","","","2026-10-14",0],["CVE-2026-110652","ONLYOFFICE","DocumentServer","ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass","MEDIUM",6.3,"2026-10-14",0],["CVE-2026-107417","Muralidharan Ramasamy","Push Notification for Post and BuddyPress","WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-107426","VideoWhisper.com","Paid Videochat Turnkey Site","WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerabili","HIGH",7.3,"2026-10-14",0],["CVE-2026-109968","Red Hat","Red Hat Enterprise Linux 10","Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file","MEDIUM",5.5,"2026-10-14",0],["CVE-2026-16740","TR7 Cyber ​​Defense Inc.","TR7 ASP","Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-16741","TR7 Cyber ​​Defense Inc.","TR7 ASP","OS Command in TR7 Cyber ​​Defense's TR7 ASP","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-82026","skyhook-io","radar","Radar < 1.12.2 Missing Authorization via /api/local-terminal","HIGH",8.7,"2026-10-14",0],["CVE-2026-107425","Magepeople inc.","Bus Ticket Booking with Seat Reservation","WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-107867","Crocoblock","JetProductTables","WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-14",0],["CVE-2026-108291","itthinx","Affiliates","WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-105874","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-14",0],["CVE-2026-106599","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-14",0],["CVE-2026-107421","VideoWhisper.com","Broadcast Live Video","WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability","HIGH",7.3,"2026-10-14",0],["CVE-2026-107422","axew3.com","WP w3all phpBB","WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-107424","M A Vinoth Kumar","Frontend Dashboard","WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-107433","miniOrange","WP OAuth Server","WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-97278","WP SYNTEX","Polylang","WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-14",0],["CVE-2026-76655","Hewlett Packard Enterprise","HPE NonStop SNMP Trap Multiplexer","HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability","HIGH",7.5,"2026-10-14",0],["CVE-2026-73798","Hewlett Packard Enterprise","HPE NonStop DNS 9.2.3 Non Secure Version","HPE NonStop DNS 9.2.3 Non Secure Version","HIGH",8.2,"2026-10-14",0],["CVE-2026-73797","Hewlett Packard Enterprise","HPE NonStop TSQLFIL","HPE NonStop TSQLFIL - Memory corruption vulnerability","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-85298","Google Cloud","Application Integration","Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalati","HIGH",7.3,"2026-10-14",0],["CVE-2026-73796","Hewlett Packard Enterprise","HPE NonStop TSQLEXE","HPE NonStop TSQLEXE - Memory Corruption vulnerability","MEDIUM",4.4,"2026-10-14",0],["CVE-2026-108072","TSplus","TSplus Remote Access","Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potenti","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-108071","TSplus","TSplus Remote Access","Improper Multi-Factor Authentication Validation Allows Authentication Bypass","HIGH",8.7,"2026-10-14",0],["CVE-2026-103358","VillaTheme","Email Template Customizer for WooCommerce","WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vu","HIGH",7.5,"2026-10-14",0],["CVE-2026-105067","Webnus","Modern Events Calendar Lite","WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability","HIGH",8.5,"2026-10-14",0],["CVE-2026-107431","Crocoblock","JetFormBuilder","WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-14",0],["CVE-2026-101341","NLnet Labs","NSD","Stack overwrite from specially formatted TXT-DATA RDATA field","HIGH",8.7,"2026-10-14",0],["CVE-2026-101339","NLnet Labs","NSD","Stack overwrite from a specially crafted and formatted HIP RR","HIGH",8.7,"2026-10-14",0],["CVE-2026-101338","NLnet Labs","NSD","Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR","HIGH",8.7,"2026-10-14",0],["CVE-2026-101337","NLnet Labs","NSD","Stack overwrite from specially formatted base64 RDATA field","HIGH",8.7,"2026-10-14",0],["CVE-2026-104795","Red Hat","Red Hat OpenShift Container Platform 4.21","Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged bi","HIGH",8.8,"2026-10-14",0],["CVE-2026-108070","TSplus","TSplus Remote Access","Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in ","HIGH",8.7,"2026-10-14",0],["CVE-2026-103905","JTL-Software GmbH","JTL-Shop","Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop","HIGH",8.7,"2026-10-14",0],["CVE-2026-97315","","Responsive Blocks","Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email","MEDIUM",5.4,"2026-10-14",0],["CVE-2026-82844","","WPForms Lite","WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-88998","","Tickera","Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-103308","","Visma Pay for WooCommerce","Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosu","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-101301","","WPCode","WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-103904","JTL-Software GmbH","JTL-Shop","Stored XSS Vulnerability in JTL-Shop","HIGH",8.6,"2026-10-14",0],["CVE-2026-73795","Hewlett Packard Enterprise","HPE NonStop TMF Auditread2","HPE NonStop TMF Auditread2 - Denial of Service vulnerability","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-100229","Red Hat","Red Hat Enterprise Linux 10","Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-88842","Red Hat","Red Hat Hardened Images","Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file","LOW",3.3,"2026-10-14",0],["CVE-2026-109971","Red Hat","Red Hat Enterprise Linux 10","Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool","MEDIUM",4.7,"2026-10-14",0],["CVE-2026-109970","Red Hat","Red Hat Enterprise Linux 10","Clevis: clevis: pkcs#11 token pin written to world-readable file","MEDIUM",4.7,"2026-10-14",0],["CVE-2026-109969","Red Hat","Red Hat Enterprise Linux 10","Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under pe","MEDIUM",4.7,"2026-10-14",0],["CVE-2026-100231","Red Hat","Red Hat Enterprise Linux 10","Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfm","MEDIUM",6.1,"2026-10-14",0],["CVE-2026-88829","Red Hat","Red Hat Hardened Images","Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy","HIGH",7.2,"2026-10-14",0],["CVE-2026-90954","Red Hat","Red Hat Hardened Images","Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush","HIGH",7.8,"2026-10-14",0],["CVE-2026-86476","Red Hat","Red Hat Enterprise Linux 10","Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideome","HIGH",8.4,"2026-10-14",0],["CVE-2026-73794","Hewlett Packard Enterprise","HPE NonStop MODULAR NSJ","HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation","MEDIUM",4.6,"2026-10-14",0],["CVE-2026-73793","Hewlett Packard Enterprise","HPE NonStop Middleware","HPE NonStop Middleware - Secret key handling vulnerability","HIGH",7.9,"2026-10-14",0],["CVE-2026-73792","Hewlett Packard Enterprise","HPE NonStop Java JToolkit","HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability","LOW",3.8,"2026-10-14",0],["CVE-2026-73791","Hewlett Packard Enterprise","HPE NonStop Hpjmeter","HPE NonStop Hpjmeter - Buffer overflow vulnerability","LOW",2,"2026-10-14",0],["CVE-2026-73790","Hewlett Packard Enterprise","HPE NonStop iTP WebServer","HPE NonStop iTP WebServer - Memory corruption vulnerability","HIGH",8.2,"2026-10-14",0],["CVE-2026-14851","Copart","Copart’s online billing service","Unauthorised disclosure of information on Copart’s online billing service","CRITICAL",9.2,"2026-10-14",0],["CVE-2026-103671","EC-CUBE CO.,LTD.","AmazonPay V2 Plugin (4.0/4.1 series)","External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-107428","VideoWhisper.com","Paid Videochat Turnkey Site","WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulner","HIGH",7.1,"2026-10-14",0],["CVE-2026-92392","curl","curl","HTTP/2 upload Use-After-Free","HIGH",8.1,"2026-10-14",0],["CVE-2026-104764","wpazleen","Post Export Import with Media","Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Inject","HIGH",7.2,"2026-10-14",0],["CVE-2026-104909","kitae-park","Mang Board","Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter","HIGH",8.1,"2026-10-14",0],["CVE-2026-107757","tigroumeow","Gallery Custom Links","Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vi","MEDIUM",4.9,"2026-10-14",0],["CVE-2026-103907","jegtheme","Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress","Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sen","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-104748","wpazleen","SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assign","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-107650","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dyna","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-107631","davidevalerio","Record of Consent Extension for Complianz","Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scrip","HIGH",7.2,"2026-10-14",0],["CVE-2026-107751","kitae-park","Mang Board","Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Paramete","HIGH",7.2,"2026-10-14",0],["CVE-2026-104761","kitae-park","Mang Board","Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Pa","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-107756","tigroumeow","Meow Lightbox","Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Outpu","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-110284","lifterlms","LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes","LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_che","HIGH",7.5,"2026-10-14",0],["CVE-2025-9373","peprodev","PeproDev Branches Map (Mapify)","PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-103367","wpdesk","ShopMagic – email automation for WordPress","ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Paramet","HIGH",8.1,"2026-10-14",0],["CVE-2026-103380","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Ex","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-100163","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Ac","HIGH",7.4,"2026-10-14",0],["CVE-2026-103366","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated ","HIGH",7.5,"2026-10-14",0],["CVE-2026-107754","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Imag","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-105107","Koha Community","Koha","Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request","HIGH",7.2,"2026-10-14",0],["CVE-2026-105106","Koha Community","Koha","Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when","HIGH",8.8,"2026-10-14",0],["CVE-2026-110227","10up","Restricted Site Access","WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-109901","Codepeople","CP Multi View Event Calendar","WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability","HIGH",8.5,"2026-10-14",0],["CVE-2026-107171","Trellix","Trellix Agent","An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-89310","JTL SW GmbH","JTL-WMS","SQL Command Injection Vulnerability in JTL-WMS","CRITICAL",9.4,"2026-10-14",0],["CVE-2026-110467","WisdomGarden","Tronclass","WisdomGarden｜Tronclass - Insecure Direct Object Reference","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110466","WisdomGarden","Tronclass","WisdomGarden｜Tronclass - Sensitive Data Exposure","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110465","WisdomGarden","Tronclass","WisdomGarden｜Tronclass - Insecure Direct Object Reference","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-94360","","Paymentfor Gateway for WooCommerce","Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unv","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-96900","","Cart Abandonment Recovery for WooCommerce","Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record ","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-96904","","AWP Classifieds","AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Pa","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-91076","","Robokassa payment gateway for Woocommerce","Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change ","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-92409","","Donation Thermometer","Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-92426","","YITH WooCommerce Popup","YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion","MEDIUM",4.9,"2026-10-14",0],["CVE-2026-94254","","SellKit","SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-94260","","Sifalo Pay","Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Or","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-94261","","Sifalo Pay","Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Trans","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-87974","","Asaas Gateway for WooCommerce","Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-88927","","rtMedia for WordPress, BuddyPress and bbPress","rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-89288","","Fast Courier","Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter","HIGH",8.6,"2026-10-14",0],["CVE-2026-90989","","Tainacan","Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST ","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-85345","","FV Flowplayer Video Player","FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data","MEDIUM",4.1,"2026-10-14",0],["CVE-2026-86787","","affiliate-toolkit","Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive","HIGH",7.2,"2026-10-14",0],["CVE-2026-86797","","Pricing Table","Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-86799","","Forms","Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission","HIGH",8.8,"2026-10-14",0],["CVE-2026-87843","","Trust Payments Gateway for WooCommerce","Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion ","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-87968","","Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant","Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-108064","","WP Encryption","WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replaceme","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-108066","","WP 2FA","WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR","LOW",2.7,"2026-10-14",0],["CVE-2026-108069","","Sunshine Photo Cart","Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_com","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-85000","","EmbedPress","EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-107160","","LTL Freight Quotes","LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-107178","","Image Photo Gallery Final Tiles Grid","Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptio","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-107319","","GamiPress","GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-107320","","GamiPress","GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-107508","","Ultimate Multisite","Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter","HIGH",8.6,"2026-10-14",0],["CVE-2026-107594","","File Upload to Order","File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion","CRITICAL",10,"2026-10-14",0],["CVE-2026-106099","","WP Data Access","WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-106166","","NEX-Forms","NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_en","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-106469","","Gutenverse Form","Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-106646","","Classified Listing","Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Ga","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-107126","","WP Booking System","WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header","HIGH",8.8,"2026-10-14",0],["CVE-2026-107158","","LTL Freight Quotes","LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integrati","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-104751","","Rank Math SEO","Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-105261","","Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateforma","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-105969","","CodeAtoZ B2B Suite for WooCommerce","CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-105975","","CamPay Shortcode Payment Gateway","CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via extern","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-106098","","WP Data Access","WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-103307","","Walletdoc Payment Gateway for WooCommerce","Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment","HIGH",8.6,"2026-10-14",0],["CVE-2026-104644","","Image Photo Gallery Final Tiles Grid","Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Config","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-94370","qt","Qt_for_MCUs","Memory corruption (double free / use-after-free) vulnerability in core string handling imp","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-110459","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network could exploit an Improper Access Control vuln","HIGH",8.6,"2026-10-14",0],["CVE-2026-110458","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network and under certain conditions could exploit a ","LOW",3.7,"2026-10-14",0],["CVE-2026-107153","Rakuten Mobile, Inc.","Rakuten Mini","Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their And","HIGH",7,"2026-10-14",0],["CVE-2026-110457","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network and under certain conditions could exploit a ","LOW",3.7,"2026-10-14",0],["CVE-2026-110456","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network and under certain conditions could exploit an","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-110455","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network and under certain conditions could exploit an","HIGH",8.1,"2026-10-14",0],["CVE-2026-110454","Ubiquiti Inc","UniFi Protect AI Key","A malicious actor with access to the network could exploit an Improper Access Control vuln","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-106931","EG Secure Solutions Inc.","SiteGuard Server Edition for Apache httpd","SiteGuard Server Edition contains an OS command injection vulnerability, which may allow a","HIGH",8.5,"2026-10-14",1],["CVE-2026-105429","NetBird","NetBird","NetBird client SSH config Match line injection via peer FQDN or hostname allows local comm","HIGH",8.9,"2026-10-14",0],["CVE-2026-101926","hyyan","Hyyan WooCommerce Polylang Integration","Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injectio","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-103369","joaoromao","Social Share Buttons & Analytics Plugin – GetSocial.io","Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-101924","ice00","NewStatPress","NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Att","HIGH",7.2,"2026-10-14",0],["CVE-2026-110453","NixOS","Nix","Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections ma","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-110452","NixOS","Nix","The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the ","MEDIUM",4,"2026-10-14",0],["CVE-2026-110451","NixOS","Nix","Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an u","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-110450","NixOS","Nix","Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation ","HIGH",8,"2026-10-14",0],["CVE-2026-110449","NixOS","Nix","Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-boun","HIGH",7.5,"2026-10-14",0],["CVE-2026-100153","ice00","NewStatPress","NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracki","HIGH",7.2,"2026-10-14",0],["CVE-2026-87855","ntbyk","JTL-Connector for WooCommerce","JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-97398","foliovision","FV Flowplayer Video Player","FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting vi","HIGH",7.2,"2026-10-14",0],["CVE-2026-97471","themefusion","Avada (Fusion) Builder","Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-100185","wpwax","Directorist: AI-Powered Business Directory, Listings & Classified Ads","Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authen","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-83592","doctorwp","Contact Form DB for Enfold","Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Cont","HIGH",7.2,"2026-10-14",0],["CVE-2026-95808","10web","Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder","Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter","HIGH",7.5,"2026-10-14",0],["CVE-2026-78193","ntbyk","JTL-Connector for WooCommerce","JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection","HIGH",7.5,"2026-10-14",0],["CVE-2026-95816","edgarrojas","Smart Forms – when you need more than just a contact form","Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Para","HIGH",7.2,"2026-10-14",0],["CVE-2026-93885","blackworks1","Cryptocurrency Donation Box – Bitcoin & Crypto Donations","Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via da","HIGH",7.2,"2026-10-14",0],["CVE-2026-94377","avisverifies","Verified Reviews (Avis Vérifiés)","Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting vi","HIGH",7.2,"2026-10-14",0],["CVE-2026-97020","dougwollison","PO/MO Editor","PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podat","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-100193","themeum","Tutor LMS – eLearning and online course solution","Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter","MEDIUM",4.7,"2026-10-14",0],["CVE-2026-16495","wpdevart","Countdown Timer – Widget Countdown","Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Si","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-77114","danrossiter","Document Gallery","Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting","HIGH",7.2,"2026-10-14",0],["CVE-2026-104800","streetforce1","AGE-GATE","AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-95807","foliovision","FV Player 8","FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synop","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-96661","pasyuk","Gmedia Photo Gallery","Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter","HIGH",7.5,"2026-10-14",0],["CVE-2026-110445","TEAMPLUS TECHNOLOGY","TeamPlus Messenger","TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection","HIGH",8.6,"2026-10-14",0],["CVE-2026-110444","TEAMPLUS TECHNOLOGY","TeamPlus Messenger","TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection","HIGH",8.6,"2026-10-14",0],["CVE-2026-14765","Epic Games","Unreal Engine","Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL","HIGH",7.7,"2026-10-14",0],["CVE-2026-110447","Collabora","Collabora Online - Built-in CODE Server","Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app","CRITICAL",9.2,"2026-10-14",1],["CVE-2026-102251","Tyche Softwares","Abandoned Cart Pro for WooCommerce","Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR C","HIGH",7.5,"2026-10-14",0],["CVE-2026-103422","ateshabaev","AnyComment","AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter","HIGH",7.2,"2026-10-14",0],["CVE-2026-97657","Tyche Softwares","Abandoned Cart Pro for WooCommerce","Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via M","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-110002","snazzyplugins","Snazzy Social Media Feed","Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Pa","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-97668","Tyche Softwares","Abandoned Cart Pro for WooCommerce","Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Per","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-82715","Hitachi","Hitachi Disk Array Driver for AIX","Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk A","HIGH",7.9,"2026-10-14",0],["CVE-2026-86573","Hitachi","Hitachi Disk Array Driver for AIX","Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-86607","Hitachi","Hitachi Ops Center Administrator","Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrato","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-110392","Samsung Open Source","QA-Board","Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-104995","dontdream","BP Profile Search","BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution v","HIGH",8.1,"2026-10-14",0],["CVE-2026-17092","wpwax","Directorist: AI-Powered Business Directory, Listings & Classified Ads","Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missin","HIGH",8.1,"2026-10-14",0],["CVE-2026-92097","holithemes","Click to Chat – HoliThemes","Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via ","CRITICAL",9.1,"2026-10-14",0],["CVE-2026-104767","davefx","Membership & User Roles for WooCommerce (Automatic Role Changer)","Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticat","HIGH",7.5,"2026-10-14",0],["CVE-2026-107652","arshidkv12","Database Addon for Contact Form 7 – CFDB7","Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Inj","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-103425","masaakitanaka","Booking Package","Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via '","MEDIUM",6.4,"2026-10-14",0],["CVE-2026-104749","bitpressadmin","Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Lo","HIGH",7.5,"2026-10-14",0],["CVE-2026-93388","printcart","Printcart Store – Web to Print Product Designer for WooCommerce","Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Un","CRITICAL",9.8,"2026-10-14",0],["CVE-2026-103423","masaakitanaka","Booking Package","Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information","HIGH",7.5,"2026-10-14",0],["CVE-2026-110385","ONLYOFFICE","Document Server","A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 ","HIGH",8.7,"2026-10-14",0],["CVE-2026-110359","Hyland","Desktop Host","Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.","HIGH",7.8,"2026-10-14",0],["CVE-2026-108473","TP-Link Systems Inc.","HS103 v5","Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices","HIGH",8.7,"2026-10-14",0],["CVE-2026-46449","Akamai","Guardicore Platform Agent","The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local pri","MEDIUM",6.7,"2026-10-14",0],["CVE-2026-50215","Akamai","Guardicore Platform Agent","A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guard","MEDIUM",4.4,"2026-10-14",0],["CVE-2026-50216","Akamai","Guardicore Platform Agent","An integer underflow exists in the DNS proxy component of the macOS NetworkExtension syste","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-50217","Akamai","Guardicore Platform Agent","A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Plat","MEDIUM",4.7,"2026-10-14",0],["CVE-2026-50218","Akamai","Guardicore Platform Agent","Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly valid","HIGH",8.5,"2026-10-14",0],["CVE-2026-92817","Inductive Automation","Ignition","Inductive Automation Ignition Software Incorrect Authorization","HIGH",8.7,"2026-10-14",0],["CVE-2026-105390","OpenVPN","ovpn-dco-win","Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-15468","HYPR","Passwordless","Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Win","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-88964","OpenVPN","OpenVPN","An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android al","HIGH",7.1,"2026-10-14",0],["CVE-2026-53564","Citrix","UniconOS","Arbitrary file read and write","MEDIUM",5.1,"2026-10-14",0],["CVE-2026-53563","Citrix","UniconOS","Persistent Command Execution","MEDIUM",6.9,"2026-10-14",0],["CVE-2026-84420","Citirx","Citrix Workspace app for Windows","Out-of-Bounds Write and Out-of-Bounds Read","MEDIUM",5.8,"2026-10-14",0],["CVE-2026-84419","Citrix","Workspace app for Windows","Out-of-Bounds Write","MEDIUM",6.8,"2026-10-14",0],["CVE-2026-84790","OpenVPN","OpenVPN","OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others v","HIGH",7.6,"2026-10-14",0],["CVE-2026-77207","The Libreswan Project","libreswan","Null Pointer Dereference in PKCS#7 bundle with no certificates","HIGH",7.5,"2026-10-14",0],["CVE-2026-77206","The Libreswan Project","libreswan","IKEv2 pre-authentication Null Pointer Dereference in EAP code","HIGH",7.5,"2026-10-14",0],["CVE-2026-77205","The Libreswan Project","libreswan","Denial of Service via sending bogus X.509 certificates","LOW",3.7,"2026-10-14",0],["CVE-2026-100119","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-102501","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-94453","The Libreswan Project","libreswan","IKEv2 Use-After-Free bug when using IKE-over-TCP","HIGH",7.5,"2026-10-14",0],["CVE-2026-100114","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Access Control (CWE-284)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100136","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)","HIGH",7.5,"2026-10-14",0],["CVE-2026-103294","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-100139","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-14",0],["CVE-2026-104345","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-105902","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-14",0],["CVE-2026-103297","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100116","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-103296","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100123","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","HIGH",7.5,"2026-10-14",0],["CVE-2026-48378","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-95633","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100122","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","HIGH",7.5,"2026-10-14",0],["CVE-2026-102502","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-100120","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100121","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","HIGH",7.5,"2026-10-14",0],["CVE-2026-95634","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",8.6,"2026-10-14",0],["CVE-2026-100115","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Access Control (CWE-284)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100117","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100137","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100135","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100118","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Certificate Validation (CWE-295)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100113","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100124","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-14",0],["CVE-2026-106627","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100125","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","MEDIUM",5.9,"2026-10-14",0],["CVE-2026-95632","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)","HIGH",7.5,"2026-10-14",0],["CVE-2026-100138","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-14",0],["CVE-2026-48377","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Input Validation (CWE-20)","MEDIUM",5.3,"2026-10-14",0],["CVE-2026-103820","Adobe","Content Credentials Rust SDK","CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Pa","MEDIUM",5.5,"2026-10-14",0],["CVE-2026-97381","LegacyUpdate","LegacyUpdate","Legacy Update ActiveX control accepts unauthorized hosting origins","CRITICAL",9.9,"2026-10-14",0],["CVE-2026-110142","Google","Chrome","Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote atta","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110155","Google","Chrome","Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacke","HIGH",8.8,"2026-10-14",0],["CVE-2026-110167","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110171","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110138","Google","Chrome","Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote ","HIGH",8.3,"2026-10-14",0],["CVE-2026-110147","Google","Chrome","Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","HIGH",8.8,"2026-10-14",0],["CVE-2026-110154","Google","Chrome","Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker","HIGH",8.8,"2026-10-14",0],["CVE-2026-110157","Google","Chrome","Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","HIGH",8.8,"2026-10-14",0],["CVE-2026-110141","Google","Chrome","Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote a","LOW",3.1,"2026-10-14",0],["CVE-2026-110163","Google","Chrome","Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","HIGH",8.8,"2026-10-14",0],["CVE-2026-110164","Google","Chrome","Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","HIGH",8.8,"2026-10-14",0],["CVE-2026-110172","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110139","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110168","Google","Chrome","Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110169","Google","Chrome","Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110153","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110166","Google","Chrome","Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote atta","HIGH",8.8,"2026-10-14",0],["CVE-2026-110144","Google","Chrome","Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allo","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110145","Google","Chrome","Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attac","HIGH",8.3,"2026-10-14",0],["CVE-2026-110158","Google","Chrome","Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attac","HIGH",8.3,"2026-10-14",0],["CVE-2026-110159","Google","Chrome","Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110137","Google","Chrome","Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker","HIGH",8.8,"2026-10-14",0],["CVE-2026-110140","Google","Chrome","Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110146","Google","Chrome","Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote att","MEDIUM",6.5,"2026-10-14",0],["CVE-2026-110150","Google","Chrome","Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 all","MEDIUM",5.5,"2026-10-14",0],["CVE-2026-110156","Google","Chrome","Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.805","HIGH",8.3,"2026-10-14",0],["CVE-2026-110143","Google","Chrome","Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-110160","Google","Chrome","Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a rem","MEDIUM",4.2,"2026-10-14",0],["CVE-2026-110162","Google","Chrome","Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacke","HIGH",8.8,"2026-10-14",0],["CVE-2026-110170","Google","Chrome","Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attack","MEDIUM",4.3,"2026-10-14",0],["CVE-2026-110148","Google","Chrome","Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","HIGH",8.8,"2026-10-14",0],["CVE-2026-110151","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker ","HIGH",8.8,"2026-10-14",0],["CVE-2026-110161","Google","Chrome","Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacke","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110165","Google","Chrome","Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a rem","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110136","Google","Chrome","Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110149","Google","Chrome","Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacke","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-110152","Google","Chrome","Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a r","CRITICAL",9.6,"2026-10-14",0],["CVE-2026-100128","Adobe","Adobe Bridge","Bridge | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-100126","Adobe","Adobe Bridge","Bridge | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-100129","Adobe","Adobe Bridge","Bridge | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-100127","Adobe","Adobe Bridge","Bridge | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-94512","Microsoft","Microsoft SQL Server 2017 (GDR)","SQL Server Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-94520","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Denial of Service Vulnerability","MEDIUM",4.9,"2026-10-13",0],["CVE-2026-85919","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88084","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Denial of Service Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-88085","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","MEDIUM",6.4,"2026-10-13",0],["CVE-2026-88086","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Information Disclosure Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-88088","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88089","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-85888","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Information Disclosure Vulnerability","HIGH",7.7,"2026-10-13",0],["CVE-2026-88081","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Information Disclosure Vulnerability","HIGH",7.7,"2026-10-13",0],["CVE-2026-88082","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88083","Microsoft","Microsoft SQL Server 2022 (CU 26)","Microsoft SQL Server Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-62840","Microsoft","Linux 3P (Third Party) Distros","Linux Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-65674","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-67626","Microsoft","Microsoft SQL Server 2022 (GDR)","Microsoft SQL Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-67628","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Information Disclosure Vulnerability","MEDIUM",4.9,"2026-10-13",0],["CVE-2026-68883","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","HIGH",8.5,"2026-10-13",0],["CVE-2026-70189","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-83945","Microsoft","Microsoft SQL Server 2022 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","MEDIUM",6.6,"2026-10-13",0],["CVE-2026-85876","Microsoft","Microsoft SQL Server 2019 (GDR)","Microsoft SQL Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85886","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","HIGH",8.5,"2026-10-13",0],["CVE-2026-67625","Microsoft","Microsoft SQL Server 2017 (GDR)","Microsoft SQL Server Remote Code Execution Vulnerability","HIGH",8.5,"2026-10-13",0],["CVE-2026-96956","Microsoft","Microsoft SQL Server 2017 (GDR)","SQL Server Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-103822","Adobe","Substance 3D Designer","Substance3D - Designer | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103825","Adobe","Substance 3D Designer","Substance3D - Designer | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103823","Adobe","Substance 3D Designer","Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103824","Adobe","Substance 3D Designer","Substance3D - Designer | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103826","Adobe","Substance 3D Designer","Substance3D - Designer | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103827","Adobe","Substance 3D Designer","Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103828","Adobe","Substance 3D Designer","Substance3D - Designer | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103821","Adobe","Substance 3D Designer","Substance3D - Designer | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103829","Adobe","Substance 3D Designer","Substance3D - Designer | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-100131","Adobe","Substance 3D Sampler","Substance3D - Sampler | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83966","Adobe","Substance 3D Sampler","Substance3D - Sampler | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-83965","Adobe","Substance 3D Sampler","Substance3D - Sampler | Stack-based Buffer Overflow (CWE-121)","HIGH",7.8,"2026-10-13",0],["CVE-2026-100130","Adobe","Substance 3D Sampler","Substance3D - Sampler | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96521","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-96522","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-83661","Adobe","Photoshop","Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95635","Adobe","Photoshop","Photoshop Desktop | Double Free (CWE-415)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95638","Adobe","Photoshop","Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)","HIGH",7.8,"2026-10-13",0],["CVE-2026-96523","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104346","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95637","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95639","Adobe","Photoshop","Photoshop Desktop | Incorrect Authorization (CWE-863)","HIGH",8.6,"2026-10-13",0],["CVE-2026-97312","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-100111","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104347","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104348","Adobe","Photoshop","Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95636","Adobe","Photoshop","Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)","HIGH",7.8,"2026-10-13",0],["CVE-2026-100112","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-95640","Adobe","Photoshop","Photoshop Desktop | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-105896","Adobe","Photoshop","Photoshop Desktop | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-95641","Adobe","Photoshop","Photoshop Desktop | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-108388","indico","indico","Indico legacy contribution export cache poisoning discloses restricted metadata","LOW",3.5,"2026-10-13",0],["CVE-2026-105897","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",8.6,"2026-10-13",0],["CVE-2026-106616","Adobe","ColdFusion 2025","ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)","HIGH",8.6,"2026-10-13",0],["CVE-2026-34633","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",7.7,"2026-10-13",0],["CVE-2026-106618","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-105994","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",7.7,"2026-10-13",0],["CVE-2026-106622","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","CRITICAL",10,"2026-10-13",0],["CVE-2026-106619","Adobe","ColdFusion 2025","ColdFusion | Improper Input Validation (CWE-20)","CRITICAL",9,"2026-10-13",0],["CVE-2026-106089","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-106613","Adobe","ColdFusion 2025","ColdFusion | Improper Input Validation (CWE-20)","HIGH",8.8,"2026-10-13",0],["CVE-2026-106614","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",7.8,"2026-10-13",0],["CVE-2026-106624","Adobe","ColdFusion 2025","ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)","CRITICAL",10,"2026-10-13",0],["CVE-2026-75996","Adobe","ColdFusion 2025","ColdFusion | Uncontrolled Resource Consumption (CWE-400)","HIGH",7.5,"2026-10-13",0],["CVE-2026-106621","Adobe","ColdFusion 2025","ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-105898","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.2,"2026-10-13",0],["CVE-2026-90530","Adobe","ColdFusion 2025","ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-105903","Adobe","ColdFusion 2025","ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-106090","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-75994","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-34634","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",8.6,"2026-10-13",0],["CVE-2026-106620","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-106612","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-76001","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",7.1,"2026-10-13",0],["CVE-2026-106615","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-75995","Adobe","ColdFusion 2025","ColdFusion | Improper Input Validation (CWE-20)","HIGH",8.4,"2026-10-13",0],["CVE-2026-75748","Adobe","ColdFusion 2025","ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)","HIGH",7.6,"2026-10-13",0],["CVE-2026-105900","Adobe","ColdFusion 2025","ColdFusion | Improper Input Validation (CWE-20)","HIGH",7.5,"2026-10-13",0],["CVE-2026-105901","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-71385","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.4,"2026-10-13",0],["CVE-2026-106623","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",7.5,"2026-10-13",0],["CVE-2026-105899","Adobe","ColdFusion 2025","ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)","CRITICAL",10,"2026-10-13",0],["CVE-2026-106617","Adobe","ColdFusion 2025","ColdFusion | Incorrect Authorization (CWE-863)","HIGH",8.8,"2026-10-13",0],["CVE-2026-49950","xorbitsai","xoscar","Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-93905","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted dat","HIGH",8.2,"2026-10-13",0],["CVE-2026-93909","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty is affected by an authentication bypass","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-93895","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Improper Access Control","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-95695","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Incorrect Authorization","HIGH",7.4,"2026-10-13",0],["CVE-2026-95696","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Denial of Service","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-101294","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by ","HIGH",8.7,"2026-10-13",0],["CVE-2026-105442","IBM","WebSphere Application Server","IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by ","HIGH",7.5,"2026-10-13",0],["CVE-2026-105443","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty is affected by an improper access control","HIGH",8.2,"2026-10-13",0],["CVE-2026-11713","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Incorrect Authorization","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-14532","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Integer Overflow","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-14909","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Information Disclosure","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-77816","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Improper Certificate Validation","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-79715","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server Liberty Path Traversal","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85473","Auth0","java-jwt","Out-of-Range Timestamp Claim Handling in auth0/java-jwt","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-78633","Okta","Okta RADIUS Agent","Denial of Service in Okta RADIUS Agent Packet Parser","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-78632","Okta","Okta RADIUS Agent","Insecure Default File Permissions in Okta RADIUS Agent Windows Installer","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-107371","Auth0","auth0.js","Missing Verification of auth_time Claim in auth0.js","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-107370","Auth0","auth0-lock","Improper Request Handling for Active Directory Logins in auth0-lock","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-107369","Auth0","nextjs-auth0","Improper Validation of Post-Login Redirect URL in nextjs-auth0","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-78628","Okta","Okta Credential Provider for Windows","Improper Input Validation in the Okta Credential Provider for Windows","MEDIUM",6,"2026-10-13",0],["CVE-2026-63171","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Category Description","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-63169","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-19810","Broadcom","Symantec Endpoint Detection and Response","Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-63168","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-63157","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Links Module","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-63156","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-63148","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-103852","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103832","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103842","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Read (CWE-125)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103836","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103835","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103837","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103833","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103834","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103839","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103841","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Read (CWE-125)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103850","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103838","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103840","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Out-of-bounds Read (CWE-125)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103851","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103830","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103843","Adobe","Adobe Substance 3D Stager","Substance3D - Stager | Use After Free (CWE-416)","HIGH",7.8,"2026-10-13",0],["CVE-2026-63147","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-63172","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit","HIGH",7.1,"2026-10-13",0],["CVE-2026-63161","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Session Fixation via Authentication","HIGH",8.6,"2026-10-13",0],["CVE-2026-63174","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList","HIGH",8.6,"2026-10-13",0],["CVE-2026-63153","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()","HIGH",8.6,"2026-10-13",0],["CVE-2026-63165","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter","HIGH",8.6,"2026-10-13",0],["CVE-2026-63152","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter","HIGH",8.6,"2026-10-13",0],["CVE-2026-63163","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload","HIGH",8.7,"2026-10-13",0],["CVE-2026-63162","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter","HIGH",8.7,"2026-10-13",0],["CVE-2026-103846","Adobe","Adobe Dimension","Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Script","HIGH",8.6,"2026-10-13",0],["CVE-2026-103845","Adobe","Adobe Dimension","Dimension | Uncontrolled Search Path Element (CWE-427)","HIGH",8.6,"2026-10-13",0],["CVE-2026-103855","Adobe","Adobe Dimension","Dimension | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103844","Adobe","Adobe Dimension","Dimension | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103854","Adobe","Adobe Dimension","Dimension | Stack-based Buffer Overflow (CWE-121)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103853","Adobe","Adobe Dimension","Dimension | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103847","Adobe","Adobe Dimension","Dimension | Untrusted Search Path (CWE-426)","HIGH",8.6,"2026-10-13",0],["CVE-2026-63154","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]","HIGH",8.7,"2026-10-13",0],["CVE-2026-63160","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-63159","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-63158","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-63149","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-90532","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Incorrect Authorization (CWE-863)","CRITICAL",10,"2026-10-13",0],["CVE-2026-90531","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-83960","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-83958","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-83662","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-75732","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Incorrect Authorization (CWE-863)","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-48398","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-48383","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Incorrect Authorization (CWE-863)","CRITICAL",10,"2026-10-13",0],["CVE-2026-48382","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Incorrect Authorization (CWE-863)","CRITICAL",10,"2026-10-13",0],["CVE-2026-110084","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)","HIGH",7.1,"2026-10-13",0],["CVE-2026-110083","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Comm","HIGH",7.1,"2026-10-13",0],["CVE-2026-110082","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110081","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110080","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110079","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110078","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110077","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110076","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110075","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110074","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110073","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-110037","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109415","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-107682","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-107305","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-106634","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('P","HIGH",7.7,"2026-10-13",0],["CVE-2026-106633","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-106632","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-106631","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-106630","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-106629","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-106628","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-106626","Adobe","Adobe Experience Manager as a Cloud Service","Adobe Experience Manager | Improper Input Validation (CWE-20)","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-105895","Adobe","Adobe Experience Manager 6.5","Adobe Experience Manager | Improper Input Validation (CWE-20)","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-63146","Omnispace","Agora Project","Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-103848","Adobe","Adobe Experience Manager 6.5 LTS","Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Comma","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-110005","Komodo","Komodo","Moghtech Komodo contains an OS command injection vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-104252","vitessio","vitess","Vitess vttablet /twopcz reflected XSS","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-16753","Lowcoder","Lowcoder","CVE-2026-16753","HIGH",8.8,"2026-10-13",0],["CVE-2026-86022","vnotex","vnote","VNote: Argument injection to arbitrary command execution via crafted note filename in exte","HIGH",7,"2026-10-13",0],["CVE-2026-86016","vnotex","vnote","VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration","HIGH",8.2,"2026-10-13",0],["CVE-2026-55601","folkertvanheusden","multitail","MultiTail: Shell injection in execute-on-match command handling","HIGH",7.3,"2026-10-13",0],["CVE-2026-56826","shopperlabs","shopper","Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire compo","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-104875","ente","ente","Ente: Accepted emergency contact can bypass the recovery notice period","HIGH",7.1,"2026-10-13",0],["CVE-2026-110255","Finsys","dockhand","Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint","HIGH",8.4,"2026-10-13",0],["CVE-2026-110256","Finsys","dockhand","Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-110254","Finsys","dockhand","Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110112","Finsys","dockhand","Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation","CRITICAL",9.2,"2026-10-13",0],["CVE-2026-110130","Finsys","dockhand","Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check","CRITICAL",10,"2026-10-13",0],["CVE-2026-110111","vatesfr","xen-orchestra","Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEs","HIGH",7.7,"2026-10-13",0],["CVE-2026-102599","socketio","socket.io","Socket.IO: Engine.IO Protocol Revision Mismatch DoS","HIGH",7.5,"2026-10-13",0],["CVE-2026-86063","anthropics","claude-code","Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning","HIGH",7.5,"2026-10-13",0],["CVE-2026-105016","Microsoft",".NET 10.0 runtime","Microsoft QUIC Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-108133","Microsoft","Windows Server 2022","Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-108134","Microsoft","Windows 11 Version 24H2","Windows Autopilot Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108135","Microsoft","Windows 10 Version 21H2","Windows Backup Engine Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108136","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-108463","Microsoft","Windows 11 Version 24H2","Windows SmartScreen Security Feature Bypass Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-108471","Microsoft","Windows 10 Version 1809","Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97781","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office OneNote Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97801","Microsoft","Microsoft .NET Framework 3.5",".NET Framework Tampering Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-108129","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-108130","Microsoft","Windows 11 Version 24H2","Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-108131","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-108132","Microsoft","Windows 10 Version 1607","Windows Kerberos Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108127","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-108128","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97839","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97840","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97841","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97842","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97843","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97844","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97827","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97828","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97829","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97830","Microsoft","Windows 11 version 23H2","Windows Internet Information Services Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-97831","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97832","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97833","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97834","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97835","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97836","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97837","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97838","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97813","Microsoft","Windows 10 Version 1809","Windows Hyper-V Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97814","Microsoft","Windows 10 Version 1607","Windows Text Shaping Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97815","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97816","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97817","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97819","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97820","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97821","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97822","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97823","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97824","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97825","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97826","Microsoft","Windows 10 Version 1607","Role: DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96113","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97803","Microsoft","Windows 11 version 26H1","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97804","Microsoft","Windows 10 Version 1607","HID Class Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97805","Microsoft","Windows 10 Version 1607","Windows Partition Management Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97806","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97807","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97808","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-97809","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97810","Microsoft","Windows 11 Version 24H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerab","HIGH",7,"2026-10-13",0],["CVE-2026-97811","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97812","Microsoft","Windows 10 Version 21H2","Windows Update Orchestrator Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-105007","Microsoft","Windows 10 Version 1607","Windows NDIS Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105008","Microsoft","Windows 10 Version 1607","Windows Schannel Spoofing Vulnerability","CRITICAL",9,"2026-10-13",0],["CVE-2026-105009","Microsoft","Windows Server 2012","Windows Server Update Service Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105010","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-105013","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-70162","Microsoft","Microsoft Visual Studio 2022 version 17.14",".NET Denial of Service Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-97798","Microsoft","Windows 10 Version 21H2","Windows Error Reporting Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97799","Microsoft","Windows 11 Version 24H2","Windows Audio Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-103565","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-103567","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103568","Microsoft","Windows 10 Version 1607","Windows Credential Providers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-103569","Microsoft","Windows 10 Version 1607","Windows IKE Extension Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-103575","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-103576","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-103577","Microsoft","Windows 11 version 23H2","Microsoft QUIC Security Feature Bypass Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-103578","Microsoft","Windows 11 version 26H1","Windows Kernel Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-105003","Microsoft","Windows 10 Version 1607","HID Class Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-105004","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-105005","Microsoft","Windows 11 version 26H1","Windows Schannel Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-105006","Microsoft","Windows 10 Version 1607","HID Class Driver Elevation of Privilege Vulnerability","MEDIUM",6.4,"2026-10-13",0],["CVE-2026-100215","Microsoft","Windows 10 Version 1607","Microsoft Graphics Component Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102217","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102225","Microsoft","Windows 10 Version 1607","Windows Text Shaping Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102226","Microsoft","Microsoft Dynamics NAV 2018","Dynamics Business Central Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102869","Microsoft","Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",".NET and Visual Studio Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-103553","Microsoft","Windows 10 Version 1607","Windows Partition Management Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-103554","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-103555","Microsoft","Windows 10 Version 1607","Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-103558","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-103560","Microsoft","Windows Server 2012","Role: DNS Server Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-109453","Microsoft","Windows 10 Version 1607","Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69922","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-102205","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-102207","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102208","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102209","Microsoft","Windows 11 version 26H1","Microsoft Graphics Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102210","Microsoft","Windows 10 Version 1809","Windows Text Shaping Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-102211","Microsoft","Windows 10 Version 1607","Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102214","Microsoft","Windows 10 Version 1607","Windows Hyper-V Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102215","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-102216","Microsoft","Windows 10 Version 1607","Windows StateRepository API Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102218","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-102220","Microsoft","Windows 10 Version 1607","Windows VHD miniport driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102221","Microsoft","Windows 10 Version 1607","Secure Boot Security Feature Bypass Vulnerability","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-102192","Microsoft","Windows Server 2019","Windows Failover Cluster Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-102193","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102194","Microsoft","Windows 10 Version 1607","Windows Graphics Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102195","Microsoft","Windows 11 version 23H2","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102196","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102197","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102198","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Protocol Information Disclosure Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-102199","Microsoft","Windows 10 Version 1607","Microsoft Windows Codecs Library Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-102201","Microsoft","Windows 10 Version 1809","Microsoft Windows Media Foundation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102202","Microsoft","Windows 11 version 23H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerab","HIGH",7.8,"2026-10-13",0],["CVE-2026-102203","Microsoft","Windows 10 Version 1607","RPC Runtime Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102204","Microsoft","Windows Subsystem for Linux (WSL2)","Windows Subsystem for Linux Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102206","Microsoft","Windows 10 Version 1607","Windows Portable Device MTP Driver Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-102186","Microsoft","Windows 10 Version 1607","Windows Network File System Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-102187","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-102188","Microsoft","Windows 10 Version 1607","Windows Storage Port Driver Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-102189","Microsoft","Windows 11 version 23H2","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102191","Microsoft","Windows 11 version 23H2","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70212","Microsoft","Windows 10 Version 1607","Windows Security Center Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88226","Microsoft","Windows 10 Version 1607","Windows Storage Port Driver Information Disclosure Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-96209","Microsoft","Windows 10 Version 1607","Windows Network File System Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-100214","Microsoft","Microsoft Dynamics NAV 2017","Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100216","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-100217","Microsoft","Windows 10 Version 1607","Windows Group Policy Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-100218","Microsoft","Windows 10 Version 1607","Remote Desktop Gateway Service Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-100219","Microsoft","Windows 11 version 23H2","Microsoft QUIC Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-100220","Microsoft","Windows 10 Version 1607","Windows Media Video Decoder Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100222","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-100225","Microsoft","Windows 10 Version 1607","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108396","Microsoft","Windows 10 Version 1809","Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69506","Microsoft","Windows 10 Version 1607","Windows Key Storage Provider Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-70023","Microsoft","Windows 10 Version 1809","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88219","Microsoft","Windows 10 Version 1607","RPC Runtime Library Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100202","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-100203","Microsoft","Windows 10 Version 1607","Windows Update Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-100205","Microsoft","Windows Sysinternals Process Monitor","SysInternals Elevation of Privilege Vulnerability","HIGH",7.1,"2026-10-13",0],["CVE-2026-100207","Microsoft","Azure CycleCloud 8.9.1","Azure CycleCloud Remote Code Execution Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-100209","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100210","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100211","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-100212","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102851","Microsoft","Visual Studio Code","Visual Studio Code Security Feature Bypass Vulnerability","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-102870","Microsoft","Microsoft Visual Studio 2022 version 17.14","ASP.NET Core Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105729","Microsoft","Windows Sysinternals Process Monitor","SysInternals Elevation of Privilege Vulnerability","HIGH",7.1,"2026-10-13",0],["CVE-2026-58280","Microsoft",".NET 10.0 runtime",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-100200","Microsoft","Windows 11 version 23H2","Windows Update Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-100201","Microsoft","Windows 10 Version 1809","Windows Client License Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96071","Microsoft","Windows 10 Version 1607","Windows Media Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96118","Microsoft","Windows 10 Version 1607","Windows Graphics Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97745","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97768","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97772","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97775","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97787","Microsoft","Windows 11 version 23H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerab","HIGH",7,"2026-10-13",0],["CVE-2026-97788","Microsoft","Microsoft .NET Framework 3.5","Active Directory Federation Services (AD FS) Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-97790","Microsoft","Windows 11 Version 24H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-97792","Microsoft","Windows 11 version 23H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerab","HIGH",7.8,"2026-10-13",0],["CVE-2026-97793","Microsoft","Windows 10 Version 1809","Windows Setup and Deployment Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-97004","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97010","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97011","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97738","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97741","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97742","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97743","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97746","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97757","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97760","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97762","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97763","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97777","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-95943","Microsoft","Windows 11 version 23H2","Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96957","Microsoft",".NET 10.0 runtime",".NET Security Feature Bypass Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96958","Microsoft","Microsoft .NET Framework 3.5",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96959","Microsoft","Microsoft .NET Framework 3.5",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96960","Microsoft","Microsoft .NET Framework 3.5",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-97007","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97008","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97748","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97756","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97769","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97773","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97779","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88094","Microsoft","azure-storage-blob-batch","Azure Storage Library Elevation of Privilege Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-96202","Microsoft","Raw Image Extension","Windows Raw Image Extension Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96944","Microsoft","Windows 11 Version 24H2","Windows Storage Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96945","Microsoft","Windows Server 2019","Windows Failover Cluster Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96946","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-96947","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-96948","Microsoft","Windows 10 Version 1607","Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96949","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7,"2026-10-13",0],["CVE-2026-96950","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-96951","Microsoft","Outlook.com","Windows Shell Security Feature Bypass Vulnerability","HIGH",8.8,"2026-10-13",1],["CVE-2026-96952","Microsoft","Windows 10 Version 1809","Microsoft Windows Media Foundation Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96953","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-96939","Microsoft","Windows 11 version 23H2","Servicing Stack Updates Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69675","Microsoft","Windows Server 2012","Windows Network File System Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85866","Microsoft","Windows 10 Version 1809","Windows ALPC Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-96926","Microsoft","Windows 10 Version 1607","Role: DNS Server Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96929","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96931","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96932","Microsoft","Windows 10 Version 1607","Windows Embedded Mode Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96934","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96937","Microsoft","Windows 10 Version 21H2","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96938","Microsoft","Windows 10 Version 1607","Windows Distributed File System (DFS) Elevation of Privilege Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-96919","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96923","Microsoft","Windows 10 Version 1607","Windows Workstation Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96924","Microsoft","Windows 10 Version 1607","Windows OLE Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96925","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96927","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96930","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerabili","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96933","Microsoft","Windows 10 Version 1607","Windows COM+ Event System Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96858","Microsoft","Windows 10 Version 21H2","Windows Security Account Manager Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96909","Microsoft","Windows 11 version 23H2","Windows BitLocker Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96910","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96911","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96912","Microsoft","Windows 10 Version 1809","Windows Client License Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96913","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96914","Microsoft","Windows 10 Version 1607","Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96915","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96916","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96917","Microsoft","Windows 10 Version 1809","Windows PCI Bus Driver Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96918","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96321","Microsoft","Windows 10 Version 21H2","Remote Desktop Display Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96324","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96325","Microsoft","Windows 10 Version 1607","Windows SMB Server Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96843","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96844","Microsoft","Windows 10 Version 1607","Microsoft Bluetooth Driver Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-96846","Microsoft","Windows 10 Version 1607","WebDAV Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96847","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96850","Microsoft","Windows 10 Version 1809","Windows Modern Device Management (MDM) Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96852","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96853","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-96854","Microsoft","Windows 10 Version 1607","Windows Device Association Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96251","Microsoft","PowerShell 7.4","Microsoft PowerShell Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96252","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-96253","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96254","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96300","Microsoft","Windows 10 Version 1607","RPC Endpoint Mapper Service Denial of Service Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-96301","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96303","Microsoft","PowerShell 7.4","Microsoft PowerShell Security Feature Bypass Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96304","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96310","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96320","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96322","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Protocol Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96323","Microsoft","Windows 10 Version 21H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96225","Microsoft",".NET 10.0 runtime",".NET Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96229","Microsoft",".NET 10.0 runtime",".NET Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96230","Microsoft","Microsoft Visual Studio 2022 version 17.14","ASP.NET Core Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96231","Microsoft",".NET 10.0 runtime",".NET Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96232","Microsoft",".NET 10.0 runtime",".NET Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96233","Microsoft",".NET 10.0 runtime","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96234","Microsoft",".NET 10.0 runtime",".NET Information Disclosure Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-96235","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96237","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96238","Microsoft",".NET 10.0 runtime",".NET Security Feature Bypass Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96243","Microsoft","Windows 10 Version 1607","Windows WalletService Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96249","Microsoft","Windows 11 Version 24H2","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96250","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70007","Microsoft",".NET 10.0 runtime",".NET Framework Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70035","Microsoft",".NET 10.0 runtime",".NET Framework Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70343","Microsoft","MPEG-2 Video Extension","Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83520","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-84008","Microsoft","Microsoft .NET Framework 3.5",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85363","Microsoft",".NET 10.0 runtime",".NET Framework Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88207","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96044","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96186","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96188","Microsoft","Microsoft PowerToys","Microsoft PowerToys Elevation of Privilege Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-96206","Microsoft","Windows Subsystem for Linux (WSL2)","Windows Subsystem for Linux Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88166","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88183","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88184","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88185","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-88186","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88190","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88192","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88195","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88200","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88203","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88206","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-88210","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Security Feature Bypass Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70215","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70217","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Information Disclosure Vulnerability","MEDIUM",4.9,"2026-10-13",0],["CVE-2026-70219","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70242","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70246","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70281","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85340","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Click-To-Run Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85932","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88144","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88154","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88163","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88172","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69802","Microsoft","Windows Server 2012","Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-69919","Microsoft","Windows 11 Version 24H2","Windows Cryptographic Services Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70153","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70202","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70214","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70254","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88120","Microsoft","Windows Server 2012","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-88122","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88123","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88125","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88129","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88130","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88092","Microsoft","ASP.NET Core 10.0","ASP.NET Core Tampering Vulnerability","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-88093","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88112","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88114","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88116","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88117","Microsoft","Windows Server 2012","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-88119","Microsoft","Windows Server 2012","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70279","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Spoofing Vulnerability","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-70297","Microsoft","Skype for Business Server 2015 CU13","Skype for Business Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70571","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-77910","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83746","Microsoft","Skype for Business Server 2015 CU13","Skype for Business Elevation of Privilege Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-85873","Microsoft","Skype for Business Server 2015 CU13","Skype for Business Elevation of Privilege Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-87692","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87695","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87696","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-88075","Microsoft","Microsoft Configuration Manager","Configuration Manager Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70111","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70158","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70160","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70184","Microsoft","Windows 10 Version 21H2","Windows Backup Engine Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70227","Microsoft","Windows 11 version 23H2","Windows Device Association Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70228","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70229","Microsoft","Windows 10 Version 1607","Windows Active Directory Domain Services Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70250","Microsoft","Windows Server 2012","Windows DHCP Client Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70260","Microsoft","Windows 10 Version 1607","Microsoft Trace Data Helper Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70261","Microsoft","Windows 10 Version 1607","Microsoft Trace Data Helper Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70264","Microsoft","Windows Defender","Microsoft Defender Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85922","Microsoft","azure_security_keyvault_certificates","Azure Key Vault Security Feature Bypass Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-85925","Microsoft","azure-keyvault-administration","Azure Key Vault Client SDK Elevation of Privilege Vulnerability","HIGH",8.2,"2026-10-13",0],["CVE-2026-69915","Microsoft","Windows 10 Version 1809","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70054","Microsoft","Windows 10 Version 1607","Windows NetBIOS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70084","Microsoft","Windows 10 Version 1809","Windows Projected File System Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70112","Microsoft","Windows 10 Version 1809","Windows Spaceport.sys Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70122","Microsoft","Windows 10 Version 21H2","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70143","Microsoft","Windows 10 Version 1607","Windows Network File System Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70148","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69884","Microsoft","Windows 10 Version 1607","Windows GDI Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69902","Microsoft","Windows 10 Version 1607","Windows NTFS Remote Code Execution Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-88177","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88179","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88180","Microsoft","Windows 10 Version 1809","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88181","Microsoft","Windows 10 Version 1809","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88182","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88188","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88189","Microsoft","Windows 10 Version 1809","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88191","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88193","Microsoft","Windows 10 Version 1607","Microsoft Scripting Engine Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88194","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88115","Microsoft","Windows 10 Version 1607","Windows Server for NFS Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88118","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-88121","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-88128","Microsoft","Windows 10 Version 1809","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88133","Microsoft","Windows 10 Version 1607","Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88135","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88139","Microsoft","Windows 11 Version 24H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88141","Microsoft","Windows 11 version 23H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88142","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88147","Microsoft","Windows 10 Version 1607","Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88149","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88152","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-88171","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-88174","Microsoft","Windows 10 Version 1607","Windows Deployment Services Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-87702","Microsoft","Windows 10 Version 1607","Windows Resource Management (MRM) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87715","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88072","Microsoft","Windows 10 Version 1809","Windows Host Guardian Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88079","Microsoft","Windows 11 Version 24H2","Windows MIDI Service Module Elevation of Privileges Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88103","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88105","Microsoft","Windows 10 Version 1607","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88109","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Click-To-Run Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88110","Microsoft","Windows 11 Version 24H2","Windows Graphics Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88113","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88126","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88127","Microsoft","Windows 10 Version 1607","Windows SMB Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88134","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85884","Microsoft","Windows 11 Version 24H2","Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85941","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85943","Microsoft","Windows 10 Version 1607","Reliable Multicast Transport Driver (RMCAST) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-87693","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-87694","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87698","Microsoft","Windows 10 Version 1607","Windows Remote Access Service Infrastructure Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-87699","Microsoft","Windows 10 Version 1607","Winlogon Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87700","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87704","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-87705","Microsoft","Windows 10 Version 1607","Windows Hyper-V Security Feature Bypass Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-87709","Microsoft","Windows 10 Version 1809","Windows Host Guardian Service Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-88076","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69789","Microsoft","Windows 10 Version 1607","Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69798","Microsoft","Windows 10 Version 1607","Windows Wired AutoConfig Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83924","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83925","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83930","Microsoft","Windows 11 version 23H2","Windows Update Orchestrator Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83931","Microsoft","Windows 11 version 23H2","Windows Hyper-V Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83933","Microsoft","Windows 10 Version 21H2","Windows Update Orchestrator Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83934","Microsoft","Windows 10 Version 1607","Windows GDI+ Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83935","Microsoft","Windows 10 Version 1607","Microsoft XML Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85874","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85879","Microsoft","Windows Subsystem for Linux (WSL2)","Windows Subsystem for Linux Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83910","Microsoft","Windows 10 Version 1607","RPC Runtime Library Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83913","Microsoft","Windows 10 Version 21H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83915","Microsoft","Windows 10 Version 1809","Windows Diagnostic Policy Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83918","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83923","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85908","Microsoft","Windows 10 Version 1607","Windows Graphics Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85909","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerabili","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85910","Microsoft","Windows 11 Version 24H2","Windows StateRepository API Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85911","Microsoft","Windows 10 Version 1809","Windows StateRepository API Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85912","Microsoft","Windows 10 Version 1607","Clipboard User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83904","Microsoft","Windows 10 Version 1809","HID Parser Library Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83905","Microsoft","Windows 10 Version 1607","Windows Shell Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83907","Microsoft","Windows 10 Version 21H2","Windows Hello Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83908","Microsoft","Windows 10 Version 1607","RPC Runtime Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85901","Microsoft","Windows 10 Version 1607","Windows Graphics Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85902","Microsoft","Windows 10 Version 1607","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85903","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85905","Microsoft","Windows 10 Version 1607","Windows UI Immersive Server API Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85906","Microsoft","Windows 10 Version 21H2","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83889","Microsoft","Windows 10 Version 1607","Windows DNS Server Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83897","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83899","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83900","Microsoft","Windows 11 version 23H2","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83903","Microsoft","Windows 11 Version 24H2","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85872","Microsoft","Windows 10 Version 1607","Windows Storage VSP Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83870","Microsoft","Windows 11 Version 24H2","Windows Aggregated Data Platform Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83873","Microsoft","Windows 10 Version 1607","Windows Shell Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83877","Microsoft","Windows 10 Version 1809","Windows Devices Human Interface Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83884","Microsoft","Windows 10 Version 1809","Windows Human Interface Device Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83887","Microsoft","Windows 10 Version 1809","HID Parser Library Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83895","Microsoft","Windows 10 Version 1809","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-83898","Microsoft","Windows 10 Version 1809","HID Parser Library Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83850","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83856","Microsoft","Windows 11 version 23H2","Windows Event Logging Service Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83857","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-83859","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83860","Microsoft","Windows 10 Version 1607","Windows GDI Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83861","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Protocol Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83863","Microsoft","Windows 10 Version 1607","Servicing Stack Updates Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83874","Microsoft","Windows 10 Version 1607","Windows Event Tracing Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83881","Microsoft","Windows 10 Version 1607","Windows exFAT File System Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83883","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83840","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83841","Microsoft","Windows 10 Version 1809","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83845","Microsoft","Windows 10 Version 21H2","Windows Internet (wininet.dll) Spoofing Vulnerability","HIGH",8.4,"2026-10-13",0],["CVE-2026-83794","Microsoft","Windows 10 Version 1607","Windows Portable Device MTP Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83795","Microsoft","Windows 10 Version 1607","Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83797","Microsoft","Windows 10 Version 1809","Windows Partition Management Driver Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83829","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83830","Microsoft","Windows 10 Version 1607","Windows COM+ Event System Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83835","Microsoft","Windows 10 Version 1607","Windows Common Log File System Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83837","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83777","Microsoft","Windows 10 Version 1607","Windows Bluetooth Service Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83781","Microsoft","Windows 11 version 23H2","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83783","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83785","Microsoft","Windows 10 Version 1607","Windows COM+ Event System Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83786","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83788","Microsoft","Windows 10 Version 1607","Windows rndismp6.sys Information Disclosure Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-83789","Microsoft","Windows 10 Version 1607","Windows SMB Client Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83790","Microsoft","Windows 10 Version 21H2","Windows Hello Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83791","Microsoft","Windows 10 Version 1809","Windows Virtual Input Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83792","Microsoft","Windows 10 Version 21H2","Windows Device Install Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83757","Microsoft","Windows 11 version 23H2","Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83762","Microsoft","Windows 10 Version 1809","Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83763","Microsoft","Windows 10 Version 1809","Windows Input System Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83764","Microsoft","Windows 10 Version 1809","Windows Clipboard User Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83765","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83766","Microsoft","Windows 10 Version 1607","Windows Hyper-V Security Feature Bypass Vulnerability","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-83767","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83770","Microsoft","Windows 10 Version 1607","Windows Text Shaping Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83771","Microsoft","Windows 11 version 23H2","Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83773","Microsoft","Windows 11 Version 24H2","Windows MIDI Service Module Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83774","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83778","Microsoft","Windows 10 Version 1607","Microsoft Internet Messaging API Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83735","Microsoft","Windows 11 version 23H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83737","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83747","Microsoft","Windows 10 Version 1607","Windows Error Reporting Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83750","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83751","Microsoft","Windows 11 Version 24H2","Windows MIDI Service Module Elevation of Privileges Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83752","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83755","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83756","Microsoft","Windows 10 Version 21H2","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-84994","QwikDev","qwik","Qwik: Crashing any Qwik Server via Resource thenable","HIGH",8.7,"2026-10-13",0],["CVE-2026-83716","Microsoft","Windows 10 Version 1607","Windows Hyper-V Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83717","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83718","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83720","Microsoft","Windows 11 version 26H1","Windows Kerberos Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83721","Microsoft","Windows 11 Version 24H2","Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83724","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83725","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83728","Microsoft","Windows 10 Version 1607","Windows Hyper-V Spoofing Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83732","Microsoft","Windows 10 Version 1607","Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83736","Microsoft","Windows 10 Version 21H2","Windows Kernel Elevation of Privilege Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83739","Microsoft","Windows 10 Version 1809","Windows Bluetooth Service Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83685","Microsoft","Windows 10 Version 1607","Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83686","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83689","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83695","Microsoft","Windows 10 Version 1607","Windows Event Logging Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83696","Microsoft","Windows 10 Version 1809","Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83697","Microsoft","Windows 10 Version 1809","Windows Modern Device Management (MDM) Tampering Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83698","Microsoft","Windows 10 Version 1607","Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83701","Microsoft","Windows 10 Version 1607","Windows Now Playing Session Manager Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83702","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83703","Microsoft","Windows 10 Version 1607","Windows Wi-Fi Driver Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83709","Microsoft","Windows 10 Version 1607","Windows NTLM Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83714","Microsoft","Windows 10 Version 1607","HTTP.sys Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83665","Microsoft","Windows 10 Version 1607","Windows DHCP Server Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83668","Microsoft","Windows 10 Version 1607","Windows WLAN Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83670","Microsoft","Windows 10 Version 1607","Function Discovery Service (fdwsd.dll) Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83672","Microsoft","Windows 10 Version 1607","Windows Installer Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83676","Microsoft","Windows 10 Version 21H2","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83677","Microsoft","Windows 11 Version 24H2","Windows DHCP Client Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83679","Microsoft","Windows 11 version 23H2","Windows Defender Firewall Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83680","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83682","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83683","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83634","Microsoft","Windows 11 version 23H2","Windows BitLocker Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83636","Microsoft","Windows 10 Version 21H2","Windows Hyper-V Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83637","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83638","Microsoft","Windows 10 Version 1607","Windows USB Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83639","Microsoft","Windows 10 Version 1607","Windows Sensor Data Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83640","Microsoft","Windows 10 Version 1607","Windows NTFS Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83643","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83645","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83647","Microsoft","Windows 10 Version 1607","Windows Active Directory Domain Services Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83651","Microsoft","Windows 10 Version 1607","Windows GDI Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83656","Microsoft","Windows 10 Version 21H2","Windows Modern Device Management (MDM) Tampering Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83659","Microsoft","Windows 10 Version 1607","Windows User Profile Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83664","Microsoft","Windows 10 Version 1607","Windows Portable Device File System Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83566","Microsoft","Windows 11 Version 24H2","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83567","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83568","Microsoft","Windows 11 Version 24H2","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83570","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83573","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Driver Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-83574","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83579","Microsoft","Windows 10 Version 1607","Windows Smart Card Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83582","Microsoft","Windows 10 Version 1607","Windows Graphics Kernel Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83585","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83587","Microsoft","Windows 10 Version 1607","Windows Core Messaging Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83588","Microsoft","Windows 10 Version 1607","Windows USB Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83513","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-83514","Microsoft","Windows 10 Version 1607","Windows Partition Management Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83517","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83519","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83522","Microsoft","Windows 10 Version 1607","Windows IKE Extension Spoofing Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-83523","Microsoft","Windows 11 Version 24H2","Windows Image Acquisition Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83564","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83565","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83506","Microsoft","Windows 10 Version 1607","Servicing Stack Updates Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83507","Microsoft","Windows 10 Version 21H2","Windows Update Orchestrator Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83508","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83509","Microsoft","Windows 10 Version 1607","Windows Setup Files Cleanup Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83511","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-69326","Microsoft","Windows 10 Version 1607","Graphic Fonts Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69454","Microsoft","Windows Server 2019","Microsoft Azure Attestation service and Device Health Attestation Service Information Disc","HIGH",7.5,"2026-10-13",0],["CVE-2026-69471","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69577","Microsoft","Windows Server 2019","Microsoft Azure Attestation service and Device Health Attestation Service Information Disc","HIGH",7.5,"2026-10-13",0],["CVE-2026-69596","Microsoft","Windows 10 Version 1607","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69635","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","MEDIUM",6.6,"2026-10-13",0],["CVE-2026-73027","Microsoft","Windows 10 Version 1607","Windows Setup Files Cleanup Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-77496","Microsoft","Windows 10 Version 1607","Windows Imaging Component Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-78459","Microsoft","Windows 10 Version 1607","Microsoft Internet Information Services Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-81971","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83505","Microsoft","Windows 10 Version 1607","Windows Setup Files Cleanup Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69640","Microsoft","Windows 10 Version 1607","Windows Key Distribution Center Security Feature Bypass Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-69733","Microsoft","Windows 11 version 23H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69736","Microsoft","Windows 10 Version 1607","Windows Credential Manager Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69765","Microsoft","Windows Server 2025","Windows Storport Miniport Driver Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69783","Microsoft","Windows 11 version 23H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70292","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70293","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70294","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70295","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-77902","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70208","Microsoft","Windows 10 Version 1607","HTTP.sys Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70209","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70232","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70236","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70237","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70258","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70288","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70072","Microsoft","Windows 10 Version 1607","Windows Netlogon Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70074","Microsoft","Windows 10 Version 1607","Windows DNS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70075","Microsoft","Windows 10 Version 1809","Windows Virtualization-Based Security (VBS) Enclave Security Feature Bypass Vulnerability","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-70144","Microsoft","Windows 11 version 23H2","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70157","Microsoft","Windows 10 Version 1607","Windows System Information Console Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70199","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70201","Microsoft","Windows Server 2012","Windows DHCP Server Denial of Service Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70207","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70211","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70230","Microsoft","Windows 10 Version 1809","Windows Audio Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69992","Microsoft","Windows 10 Version 1607","Remote Desktop Services Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69994","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69998","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69999","Microsoft","Windows 11 version 23H2","Windows Update Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70004","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70006","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70012","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70051","Microsoft","Windows 10 Version 1809","Windows SmartScreen Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70055","Microsoft","Windows 10 Version 1607","Windows Cryptographic Services Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70066","Microsoft","Windows 10 Version 1607","Windows DHCP Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70067","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70069","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70071","Microsoft","Windows 10 Version 1607","Role: DNS Server Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-62687","Microsoft","Windows 10 Version 21H2","Windows Backup Engine Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69856","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69880","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69931","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69984","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69985","Microsoft","Windows 10 Version 1809","Windows libarchive Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69986","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69987","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69988","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69991","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69995","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69996","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69997","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-59116","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Security Feature Bypass Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-62879","Microsoft","Windows 10 Version 1809","Windows SmartScreen Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96096","Microsoft","Windows 10 Version 1607","Windows Media Player Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97739","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97755","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97759","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97765","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97774","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Click-To-Run Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-97778","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97782","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Tampering Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-97783","Microsoft","Microsoft SharePoint Enterprise Server 2016","Microsoft Office SharePoint Spoofing Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-97789","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-97794","Microsoft","Windows 11 version 23H2","Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerab","HIGH",7.8,"2026-10-13",0],["CVE-2026-97003","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97747","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97751","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97752","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97754","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97758","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97761","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97767","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97770","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97771","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97776","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97780","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96997","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office OneNote Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97001","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97005","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-97009","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97014","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-97017","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97740","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97744","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-97749","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-97750","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97753","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97766","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69452","Microsoft","Windows 10 Version 1607","Windows Enterprise App Management Elevation of Privilege Vulnerability","HIGH",7.1,"2026-10-13",0],["CVE-2026-95904","Microsoft","Windows 10 Version 1607","Windows Event Logging Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96108","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96920","Microsoft","Windows 10 Version 1607","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96921","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96928","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96935","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96943","Microsoft","Raw Image Extension","Windows Raw Image Extension Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96995","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96996","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-97012","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-97016","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96855","Microsoft","Windows 10 Version 1809","Windows Modern Device Management (MDM) Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96856","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96857","Microsoft","Windows 10 Version 1809","Windows Projected File System Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96859","Microsoft","Windows 10 Version 1607","Windows Imaging Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96860","Microsoft","Windows 10 Version 1607","Windows USB Print Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96861","Microsoft","Windows 10 Version 1607","Network Device Enrollment Service (NDES) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96862","Microsoft","Windows 10 Version 1607","Windows Spaceport.sys Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96863","Microsoft","Windows 11 version 23H2","Windows Storage Port Driver Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-96864","Microsoft","Windows 10 Version 1607","Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96865","Microsoft","Windows 10 Version 1607","Windows Secure Kernel Mode Information Disclosure Vulnerability","MEDIUM",5.6,"2026-10-13",0],["CVE-2026-96867","Microsoft","Windows 10 Version 1607","Windows NTFS Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96868","Microsoft","Windows 11 Version 24H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96309","Microsoft","Windows 10 Version 21H2","Windows Subsystem for Linux Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96312","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96313","Microsoft","Windows 10 Version 1809","Windows Push Notifications Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96314","Microsoft","Windows 10 Version 1607","Windows Audio Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96315","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96316","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96317","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96318","Microsoft","Windows 10 Version 1607","Windows Resume Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96319","Microsoft","Windows 10 Version 21H2","Windows USB Print Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96848","Microsoft","Windows 10 Version 1809","Windows Win32 Kernel Subsystem Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96849","Microsoft","Windows 11 version 26H1","Windows Kernel-Mode Drivers Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96851","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96866","Microsoft","Windows 10 Version 1607","Network Device Enrollment Service (NDES) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96236","Microsoft","ASP.NET Core 10.0","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96244","Microsoft","Windows 10 Version 1607","Windows Internal System User Profile Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96245","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96246","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96247","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96248","Microsoft","Windows 10 Version 1607","Windows Host Guardian Service Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-96302","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96305","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96306","Microsoft","Windows 10 Version 1607","Windows Sysmain Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96307","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96308","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96311","Microsoft","Windows 10 Version 1607","Windows Network List Service Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70049","Microsoft","Microsoft Configuration Manager","Microsoft Configuration Manager Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-88208","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-96204","Microsoft","Arc Enabled Servers - Azure Connected Machine Agent","Azure Arc Elevation of Privilege Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96215","Microsoft","Windows 11 Version 24H2","Windows Autopilot Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96216","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-96217","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96218","Microsoft","Windows 10 Version 1809","Windows Update Stack Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96219","Microsoft","Windows 10 Version 1809","Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerabi","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-96220","Microsoft","Windows 10 Version 1809","Windows Assigned Access Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96222","Microsoft","Microsoft .NET Framework 3.5","Active Directory Federation Services (AD FS) Spoofing Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-96223","Microsoft","Windows 11 Version 24H2","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-96224","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88167","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88169","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88175","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88178","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-88196","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88197","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88198","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88201","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88202","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88204","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-88209","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-70298","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70300","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70301","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83891","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85900","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88145","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88150","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88151","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88153","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Excel Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88155","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88156","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70276","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Click-To-Run Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70291","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70302","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70206","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70220","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70251","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70256","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70257","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70259","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70263","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70266","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70267","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",7.2,"2026-10-13",0],["CVE-2026-70268","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70269","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70282","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70287","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70159","Microsoft","Microsoft Visual Studio 2022 version 17.14","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70161","Microsoft",".NET 10.0 runtime",".NET Elevation of Privilege Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-70165","Microsoft",".NET 10.0 runtime",".NET Elevation of Privilege Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-70175","Microsoft","ASP.NET Core 10.0","ASP.NET Core Elevation of Privilege Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70179","Microsoft","Microsoft Visual Studio 2022 version 17.14","ASP.NET Core Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70181","Microsoft","ASP.NET Core 10.0","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70183","Microsoft","ASP.NET Core 10.0","ASP.NET Core Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70188","Microsoft","ASP.NET Core 10.0","ASP.NET Core Security Feature Bypass Vulnerability","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-70190","Microsoft",".NET 10.0 runtime",".NET Elevation of Privilege Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-70194","Microsoft",".NET 11.0 runtime",".NET Framework Security Feature Bypass Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70196","Microsoft","ASP.NET Core 10.0","ASP.NET Core Denial of Service Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-70197","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70092","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70109","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70110","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70116","Microsoft","Windows 11 Version 24H2","Windows Resilient File System (ReFS) Security Feature Bypass Vulnerability","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-70147","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70149","Microsoft","Windows 10 Version 1607","Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70174","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70186","Microsoft","ASP.NET Core 10.0","ASP.NET Core Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70011","Microsoft","Windows 10 Version 21H2","Windows IP Over USB Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70013","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70024","Microsoft","Windows 10 Version 1607","Windows Internet Information Services Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70031","Microsoft","Windows 10 Version 1607","Windows iSCSI Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70038","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70044","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70045","Microsoft","Windows 10 Version 1809","Windows Work Folders Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70068","Microsoft","Windows 10 Version 1607","Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70102","Microsoft","Windows 10 Version 1809","Windows Spaceport.sys Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70131","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70134","Microsoft","Windows 10 Version 1809","Windows Event Tracing Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70137","Microsoft","Windows 10 Version 1607","Windows Remote Access Connection Manager Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69940","Microsoft","Windows 10 Version 1607","Windows Client for NFS Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69949","Microsoft","Windows 10 Version 1607","Windows Client for NFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69955","Microsoft","Windows 10 Version 1607","Windows Client for NFS Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69977","Microsoft","Windows 10 Version 1607","Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerabilit","HIGH",7,"2026-10-13",0],["CVE-2026-69982","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-70005","Microsoft","Windows Server 2019","Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-70008","Microsoft","Windows 10 Version 21H2","Windows IP Over USB Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70113","Microsoft","Windows 10 Version 1607","Windows Client for NFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69923","Microsoft","Windows 11 Version 24H2","Windows AI Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88137","Microsoft","Windows 10 Version 1607","WebDAV Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-88140","Microsoft","Windows 10 Version 1607","Windows Key Storage Provider Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-88143","Microsoft","Windows 10 Version 1607","Windows Storage Spaces Controller Elevation of Privilege Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-88146","Microsoft","Windows 10 Version 1809","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7,"2026-10-13",0],["CVE-2026-88102","Microsoft","Windows Server 2019","Microsoft Failover Cluster Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-88106","Microsoft","Windows 10 Version 1809","Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88107","Microsoft","Windows 10 Version 1809","Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88132","Microsoft","azure-keyvault-administration","Azure Key Vault Information Disclosure Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-88136","Microsoft","Windows 10 Version 1607","Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88098","Microsoft","Windows 10 Version 1607","Windows Security Support Provider Interface Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88099","Microsoft","Windows Server 2019","Windows Failover Cluster Denial of Service Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-88100","Microsoft","Windows 11 Version 24H2","Windows Storage Spaces Controller Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88074","Microsoft","Windows 11 version 23H2","Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87697","Microsoft",".NET 10.0 runtime",".NET Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-87706","Microsoft","Windows 10 Version 1607","Windows Storage Spaces Controller Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87707","Microsoft","Windows 10 Version 1607","Windows Fax and Scan Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87710","Microsoft","Windows 10 Version 1607","Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-87712","Microsoft","Windows 10 Version 1607","Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87713","Microsoft","Windows 10 Version 1607","Windows Bluetooth Port Driver Remote Code Execution","HIGH",7.5,"2026-10-13",0],["CVE-2026-87714","Microsoft","Windows 10 Version 1607","WebDAV Security Feature Bypass Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-87716","Microsoft","Windows 10 Version 1809","Windows Storage Spaces Controller Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-88070","Microsoft","Windows 10 Version 1607","Windows BitLocker Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88071","Microsoft","Windows 11 version 23H2","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88073","Microsoft","Windows 10 Version 21H2","Windows Graphics Kernel Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85928","Microsoft","Windows 10 Version 1607","Windows Volume Manager Extension Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85930","Microsoft","Windows 10 Version 21H2","Windows Image Acquisition Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85931","Microsoft","Windows 10 Version 1607","Windows Distributed File System (DFS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85933","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85934","Microsoft","Windows 10 Version 1809","Windows AppX Deployment Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85935","Microsoft","Windows 10 Version 1607","Windows USB Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85936","Microsoft","Windows 10 Version 1607","Windows Shell Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85938","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85939","Microsoft","Windows 10 Version 1607","Windows Kernel Security Feature Bypass Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-85945","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87691","Microsoft","Windows 11 version 23H2","Windows Management Services Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70270","Microsoft","Windows 10 Version 1607","Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70277","Microsoft","Windows 10 Version 1607","Windows Fast FAT File System Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70303","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83674","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-83710","Microsoft","Windows 10 Version 1607","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83888","Microsoft","Windows 10 Version 1607","Windows CD-ROM Driver Elevation of Privilege Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85329","Microsoft","Windows 10 Version 1607","Microsoft Account Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85867","Microsoft","Windows 10 Version 1607","Windows Remote Access Connection Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85904","Microsoft","Windows 10 Version 1607","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85914","Microsoft","Windows 10 Version 1607","Windows Embedded Mode Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85916","Microsoft","Windows 11 version 23H2","Azure Active Directory Information Disclosure Vulnerability","MEDIUM",6.2,"2026-10-13",0],["CVE-2026-85926","Microsoft","Windows 10 Version 1607","Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70164","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70167","Microsoft","Windows Server 2022","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70170","Microsoft","Windows 10 Version 1607","Windows Kernel Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70172","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70185","Microsoft","Windows 10 Version 1607","Microsoft PowerShell Security Feature Bypass Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70187","Microsoft","Windows Server 2012","Windows Remote Desktop Services Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70210","Microsoft","Windows 10 Version 1607","Windows OLE DB Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70213","Microsoft","Microsoft Power Apps for Android","Microsoft Power Apps Remote Code Execution Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-70216","Microsoft","Windows 10 Version 1607","Windows Mobile Device Management Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70238","Microsoft","Windows 10 Version 1607","Windows Storage Spaces Controller Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70244","Microsoft","Windows 10 Version 1607","Windows DNS Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70262","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69877","Microsoft","Azure CLI","Azure DevOps Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69916","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69934","Microsoft","Windows 11 version 23H2","Windows Spaceport.sys Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69943","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70041","Microsoft","Windows 10 Version 1607","Windows CD-ROM Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70048","Microsoft","Windows 10 Version 1607","Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70052","Microsoft","Windows 11 version 23H2","Microsoft PowerShell Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88159","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88160","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88162","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-88165","Microsoft","Windows 10 Version 1607","Windows Active Directory Domain Services Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88168","Microsoft","Windows 10 Version 1809","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88173","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-85927","Microsoft","Windows 10 Version 1607","Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-87708","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-87711","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88080","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88091","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88096","Microsoft","Windows 10 Version 1607","Windows DCOM Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88101","Microsoft","Windows 10 Version 1607","Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-88124","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-88157","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-88158","Microsoft","Windows 10 Version 1607","Microsoft Digest Authentication Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-88161","Microsoft","Windows 10 Version 1607","Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-71347","Microsoft","Windows 10 Version 1607","Windows Security Center Elevation of Privilege Vulnerability","MEDIUM",6.4,"2026-10-13",0],["CVE-2026-85864","Microsoft","Windows 10 Version 1607","Python Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85865","Microsoft","Windows 10 Version 1607","Windows DHCP Server Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85868","Microsoft","Windows 10 Version 1607","Windows Common Log File System Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85869","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85870","Microsoft","Windows 10 Version 1607","Windows Common Log File System Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85871","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85881","Microsoft","Microsoft Office for Android","Microsoft Office Graphics Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-85891","Microsoft","Azure HDInsight","Azure HDInsight Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85915","Microsoft","Windows 10 Version 1809","Windows PCI Bus Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85918","Microsoft","Windows 10 Version 1607","Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85920","Microsoft","Windows 10 Version 1607","Windows BitLocker Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85851","Microsoft","Windows 11 version 23H2","Windows SmartScreen Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85852","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85853","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85854","Microsoft","Windows 10 Version 1809","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85855","Microsoft","Windows 11 Version 24H2","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85856","Microsoft","Windows 10 Version 1607","Internet Connection Sharing (ICS) Remote Code Execution Vulnerability","HIGH",7.1,"2026-10-13",0],["CVE-2026-85857","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85858","Microsoft","Windows 11 version 23H2","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85859","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85860","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85861","Microsoft","Windows 10 Version 1607","Clipboard User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85863","Microsoft","Windows 10 Version 1607","Clipboard User Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85833","Microsoft","Windows 10 Version 1607","Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85834","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85835","Microsoft","Windows 11 Version 24H2","Servicing Stack Updates Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85836","Microsoft","Windows 11 Version 24H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85837","Microsoft","Windows 11 Version 24H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85840","Microsoft","Windows 10 Version 1607","Windows Event Viewer Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85842","Microsoft","Windows 10 Version 21H2","Windows Image Acquisition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85843","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-85846","Microsoft","Windows 10 Version 1809","Web Account Manager Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85847","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85848","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-85849","Microsoft","Windows 10 Version 1607","Windows AppX Deployment Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85850","Microsoft","Windows 11 version 26H1","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85820","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7.8,"2026-10-13",0],["CVE-2026-85821","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerabili","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85822","Microsoft","Windows 10 Version 1607","Windows exFAT File System Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85823","Microsoft","Windows 11 Version 24H2","Windows Composite Image File System Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85824","Microsoft","Windows 10 Version 21H2","Windows Composite Image File System Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85825","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerabili","HIGH",7,"2026-10-13",0],["CVE-2026-85826","Microsoft","Windows 10 Version 1607","Windows Fast FAT Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85827","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85828","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85829","Microsoft","Windows 10 Version 1607","Windows Wired AutoConfig Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85830","Microsoft","Windows 10 Version 1607","Windows Installer Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85831","Microsoft","Windows 10 Version 1809","Windows Biometric Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85832","Microsoft","Windows 10 Version 1607","Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerabilit","HIGH",7.8,"2026-10-13",0],["CVE-2026-85806","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85807","Microsoft","Windows 10 Version 1607","Windows USB Video Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85808","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85809","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85810","Microsoft","Windows 10 Version 1607","Windows Telephony Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85811","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85812","Microsoft","Windows 10 Version 21H2","Windows Bind Filter Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85814","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85815","Microsoft","Windows 10 Version 1607","Windows Device Association Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85816","Microsoft","Windows 10 Version 1607","Windows Wi-Fi Driver Information Disclosure Vulnerability","MEDIUM",5.7,"2026-10-13",0],["CVE-2026-85817","Microsoft","Windows 10 Version 1607","Microsoft PowerShell Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85818","Microsoft","Windows 11 version 23H2","Windows Schannel Spoofing Vulnerability","CRITICAL",9,"2026-10-13",0],["CVE-2026-85793","Microsoft","Windows 10 Version 1607","Windows Sysmain Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85794","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85795","Microsoft","Windows 10 Version 1607","Windows Text Services Framework Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85796","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85797","Microsoft","Windows 10 Version 1607","Windows GDI Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85798","Microsoft","Windows 10 Version 1607","Windows Distributed File System (DFS) Remote Code Execution Vulnerability","HIGH",7.2,"2026-10-13",0],["CVE-2026-85799","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-85800","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85802","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85803","Microsoft","Windows 11 version 23H2","Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85804","Microsoft","Windows 11 version 23H2","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85805","Microsoft","Windows 10 Version 1607","Microsoft PowerShell Security Feature Bypass Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85369","Microsoft","Windows 10 Version 21H2","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",8.2,"2026-10-13",0],["CVE-2026-85370","Microsoft","Windows 10 Version 1607","WebDAV Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85371","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-85372","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85373","Microsoft","Windows 10 Version 1607","Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85374","Microsoft","Windows 10 Version 1607","Windows Installer Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85375","Microsoft","Windows 10 Version 1607","Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85376","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85377","Microsoft","Windows 10 Version 1607","Windows CD-ROM Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85790","Microsoft","Microsoft Visual Studio 2022 version 17.14","Microsoft QUIC Information Disclosure Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-85791","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85792","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-85354","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85355","Microsoft","Windows 10 Version 1607","Windows Common Log File System Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85356","Microsoft","Windows 10 Version 1607","Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85357","Microsoft","Windows 11 version 23H2","Windows Phone Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85358","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85359","Microsoft","Windows 10 Version 1607","Windows Performance Monitor Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85361","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85362","Microsoft","Windows 10 Version 1607","Windows Management Instrumentation Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85364","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85365","Microsoft","Windows 10 Version 1607","Servicing Stack Updates Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85366","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85367","Microsoft","Windows 10 Version 1607","Windows Cash Drawer Protocol Provider Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85368","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85332","Microsoft","Windows 10 Version 1809","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85333","Microsoft","Windows 10 Version 1607","Windows Performance Monitor Elevation of Privilege Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-85334","Microsoft","Windows 10 Version 1607","Windows Message Queuing Queue Manager Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85336","Microsoft","Windows 10 Version 1607","Windows Device Association Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85337","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Client Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-85338","Microsoft","Windows 10 Version 1809","Microsoft Graphics Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85339","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-85341","Microsoft","Windows 10 Version 1607","Windows USB Video Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85342","Microsoft","Windows 10 Version 1607","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85343","Microsoft","Windows 10 Version 1607","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85352","Microsoft","Windows 10 Version 1607","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85353","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-84020","Microsoft","Windows 10 Version 21H2","Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85318","Microsoft","Windows 10 Version 1607","Servicing Stack Updates Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85319","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85320","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-85321","Microsoft","Windows Server 2012 R2","Active Directory Federation Services (AD FS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85322","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85323","Microsoft","Windows 10 Version 1607","Network Device Enrollment Service (NDES) Spoofing Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-85324","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-85327","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-85328","Microsoft","Windows 10 Version 1809","Windows Projected File System Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-85331","Microsoft","Windows 10 Version 1607","Windows Device Association Service Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-84016","Microsoft","Windows 10 Version 1607","Windows EAPHost Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-84017","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-84018","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-84019","Microsoft","Windows 10 Version 1809","Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69886","Microsoft","Windows 10 Version 1607","Windows Imaging Component Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83927","Microsoft","Windows 10 Version 21H2","Windows Registry Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83928","Microsoft","Windows 10 Version 1607","Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerabi","HIGH",8.8,"2026-10-13",0],["CVE-2026-83929","Microsoft","Windows 10 Version 1607","Windows GDI Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83932","Microsoft","Windows 10 Version 1607","Windows Group Policy Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-84007","Microsoft","Windows Server 2012","Remote Desktop Gateway Service Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-84009","Microsoft","Windows 10 Version 1809","Windows Projected File System Tampering Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-84011","Microsoft","Windows 11 version 23H2","Windows SMB Client Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-84012","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Services Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-84013","Microsoft","Windows 10 Version 1607","Windows Telephony Server Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-84014","Microsoft","Windows 10 Version 1607","Windows Device Association Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-84015","Microsoft","Windows 10 Version 1607","Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83914","Microsoft","Windows 10 Version 1607","Microsoft XML Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-83916","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83917","Microsoft","Windows 10 Version 1809","Windows ALPC Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83919","Microsoft","Windows 10 Version 1607","Microsoft Internet Messaging API Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83920","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83921","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83922","Microsoft","Windows 10 Version 21H2","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83926","Microsoft","Windows 10 Version 1809","Windows Hello Security Feature Bypass Vulnerability","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-85841","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","MEDIUM",6.6,"2026-10-13",0],["CVE-2026-83586","Microsoft","Windows 11 version 23H2","Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerab","HIGH",7.8,"2026-10-13",0],["CVE-2026-83741","Microsoft","Windows 10 Version 1809","Internet Explorer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83769","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83871","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83886","Microsoft","Windows 11 version 23H2","Windows Update Orchestrator Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83906","Microsoft","Windows 11 version 23H2","Windows Shell Spoofing Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83911","Microsoft","Windows 10 Version 1607","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83912","Microsoft","Windows 10 Version 1607","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70089","Microsoft","Windows 10 Version 1607","Windows GDI Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70128","Microsoft","Windows 10 Version 1809","HID Parser Library Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70151","Microsoft","Windows 10 Version 21H2","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70163","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70222","Microsoft","Windows 10 Version 1607","Windows Shell Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70241","Microsoft","Windows 10 Version 1607","Windows Kerberos Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70243","Microsoft","Windows 11 version 23H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70248","Microsoft","Windows 10 Version 1607","Windows Hyper-V Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70275","Microsoft","Windows 10 Version 1607","Windows CD-ROM File System Driver Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70286","Microsoft","Windows 10 Version 1607","Windows Graphics Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70299","Microsoft","Windows 11 version 23H2","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83569","Microsoft","Windows 10 Version 1809","HID Parser Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83909","Microsoft","Windows 10 Version 1607","Windows Win32 Kernel Subsystem Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-70086","Microsoft","Windows 10 Version 1809","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83867","Microsoft","Windows 10 Version 1607","Windows Push Notifications Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83868","Microsoft","Windows 10 Version 1809","Microsoft Bluetooth Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83879","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83882","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83885","Microsoft","Windows 11 Version 24H2","Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability","MEDIUM",5.6,"2026-10-13",0],["CVE-2026-83892","Microsoft","Windows 10 Version 1809","Windows Human Interface Device Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83893","Microsoft","Windows 10 Version 1809","Windows Clipboard User Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83896","Microsoft","Windows 10 Version 1607","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83901","Microsoft","Windows 10 Version 1809","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83902","Microsoft","Windows 10 Version 1809","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83851","Microsoft","Windows 10 Version 1809","Windows Partition Management Driver Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83852","Microsoft","Windows 11 Version 24H2","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83853","Microsoft","Windows 10 Version 21H2","Windows Hello Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83854","Microsoft","Windows 10 Version 1809","Windows Notification Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83855","Microsoft","Windows 11 version 23H2","Windows WLAN Service Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83862","Microsoft","Windows 10 Version 1607","Windows Network Load Balancing Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83864","Microsoft","Windows 10 Version 1607","Windows NTFS Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83865","Microsoft","Windows 10 Version 1607","Windows Internet (wininet.dll) Tampering Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-83866","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83869","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83872","Microsoft","Windows 10 Version 1607","Windows TCP/IP Local Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83875","Microsoft","Windows 10 Version 1809","Windows Human Interface Device Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83876","Microsoft","Windows 10 Version 1607","Windows Shell Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83834","Microsoft","Windows 10 Version 1607","Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83836","Microsoft","Windows 10 Version 1607","Windows Event Tracing Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83838","Microsoft","Windows 10 Version 1607","Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-83839","Microsoft","Windows 10 Version 1809","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83842","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83843","Microsoft","Windows 10 Version 1607","Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83844","Microsoft","Microsoft Paint","Windows Paint Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-83846","Microsoft","Windows 10 Version 1809","Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83847","Microsoft","Windows 10 Version 1607","Microsoft Account Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83848","Microsoft","Windows 10 Version 1607","Windows COM+ Event System Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83849","Microsoft","Windows 10 Version 21H2","Windows Hello Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83780","Microsoft","Windows 10 Version 1607","Windows CCFFilter Driver Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83782","Microsoft","Windows 10 Version 1607","Windows Shell Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83784","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83787","Microsoft","Windows 10 Version 1607","Windows DHCP Server Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83793","Microsoft","Windows 10 Version 21H2","Windows Update Orchestrator Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83796","Microsoft","Windows 11 version 23H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83798","Microsoft","Windows 10 Version 1607","Windows Update Stack Spoofing Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83826","Microsoft","Windows 11 version 23H2","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83827","Microsoft","Windows 10 Version 1607","Windows Bluetooth Port Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83828","Microsoft","Windows 11 Version 24H2","Windows MIDI Service Module Elevation of Privileges Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83832","Microsoft","Windows 10 Version 1809","Windows Spaceport.sys Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83833","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83753","Microsoft","Windows 10 Version 21H2","Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83754","Microsoft","Windows 10 Version 1809","Microsoft OpenSSH for Windows Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83758","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83759","Microsoft","Windows 10 Version 1607","Windows Encrypting File System (EFS) Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83760","Microsoft","Windows 10 Version 1607","Microsoft Bluetooth Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83761","Microsoft","Windows 10 Version 1809","Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83768","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83775","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83776","Microsoft","Windows 10 Version 1607","Windows Bluetooth Driver Elevation of Privilege Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-83779","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83712","Microsoft","Windows 10 Version 1809","Windows NTFS Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83713","Microsoft","Windows 10 Version 1607","Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerabili","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83715","Microsoft","Windows 10 Version 1607","Windows Error Reporting Tampering Vulnerability","HIGH",7.1,"2026-10-13",0],["CVE-2026-83719","Microsoft","Windows 10 Version 1809","Servicing Stack Updates Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83722","Microsoft","Windows 10 Version 1607","Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83723","Microsoft","Windows 10 Version 1607","Windows Event Logging Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83726","Microsoft","Windows 10 Version 1607","Windows DWM Core Library Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83727","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83733","Microsoft","Windows 10 Version 1607","Windows Print Spooler Components Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83738","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83740","Microsoft","Windows 10 Version 1809","Windows Hello Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83748","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83749","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83690","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83691","Microsoft","Windows 10 Version 1607","Windows DHCP Server Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83692","Microsoft","Windows 10 Version 21H2","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83693","Microsoft","Windows 10 Version 1607","Windows Error Reporting Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83694","Microsoft","Windows 10 Version 1607","Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83699","Microsoft","Windows 10 Version 1607","Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83700","Microsoft","Windows 10 Version 1809","Windows Now Playing Session Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83704","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83705","Microsoft","Windows 10 Version 1607","HTTP.sys Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83706","Microsoft","Windows 11 Version 24H2","Windows NTFS Elevation of Privilege Vulnerability","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-83707","Microsoft","Windows 10 Version 1607","Windows Event Tracing Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83708","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83667","Microsoft","Windows 10 Version 1607","Windows Active Directory Domain Services Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83669","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83671","Microsoft","Windows 10 Version 1809","Windows Hyper-V Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83675","Microsoft","Windows 11 Version 24H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83678","Microsoft","Windows 10 Version 1607","Windows TCP/IP Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83681","Microsoft","Microsoft PowerToys","Microsoft PowerToys Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83687","Microsoft","Windows 11 version 23H2","Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83688","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83642","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-83644","Microsoft","Windows 10 Version 1607","Windows Audio Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83646","Microsoft","Windows 10 Version 1607","Active Directory Federation Services (AD FS) Spoofing Vulnerability","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-83648","Microsoft","Windows 10 Version 21H2","Windows Active Directory Domain Services Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83649","Microsoft","Windows 10 Version 1607","Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83650","Microsoft","Windows 10 Version 1607","Windows Media Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83652","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83654","Microsoft","Windows 10 Version 21H2","Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83655","Microsoft","Windows 10 Version 1607","Network Policy Server (NPS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83657","Microsoft","Windows 10 Version 1809","Windows Modern Device Management (MDM) Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83658","Microsoft","Windows 10 Version 1809","Windows Error Reporting Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83666","Microsoft","Windows 10 Version 1607","Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83499","Microsoft","Windows 10 Version 1607","Windows Server Update Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83510","Microsoft","Windows 10 Version 1607","Windows Setup Files Cleanup Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83515","Microsoft","Windows 10 Version 1607","RPC Runtime Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83516","Microsoft","Windows 10 Version 1809","Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83518","Microsoft","Windows 11 version 23H2","RPC Runtime Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83521","Microsoft","Windows 10 Version 1607","Windows IKE Extension Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-83571","Microsoft","Windows 10 Version 1607","Windows Audio Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-83575","Microsoft","Windows 10 Version 1607","Windows Search Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83578","Microsoft","Windows 10 Version 1607","Microsoft PowerShell Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-83580","Microsoft","Windows 10 Version 1607","Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83583","Microsoft","Windows 10 Version 1607","Windows Geotag Broker Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83584","Microsoft","Windows 10 Version 1607","Windows Smart Card Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-83635","Microsoft","Windows Server 2012","Role: DNS Server Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-83641","Microsoft","Windows 10 Version 1607","Windows Media Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69633","Microsoft","Windows 10 Version 1607","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69650","Microsoft","Windows 10 Version 1607","Windows Key Distribution Center Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69673","Microsoft","Windows 11 version 23H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69718","Microsoft","Windows 11 version 23H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69743","Microsoft","Windows 11 version 23H2","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69830","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-69882","Microsoft","Windows 11 version 23H2","Windows Update Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-72969","Microsoft","Windows 11 version 23H2","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-81964","Microsoft","Windows 10 Version 21H2","Windows Update Orchestrator Service Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-81969","Microsoft","Windows 10 Version 1607","Windows Server Update Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-83500","Microsoft","Windows 10 Version 1607","Windows BitLocker Security Feature Bypass Vulnerability","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-83504","Microsoft","Windows 11 version 23H2","Windows SmartScreen Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-66822","Microsoft",".NET 10.0 runtime",".NET Information Disclosure Vulnerability","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-69354","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69387","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69644","Microsoft","Windows 10 Version 1607","Windows iSCSI Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69651","Microsoft",".NET 10.0 runtime",".NET Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69721","Microsoft","Windows 10 Version 1607","Windows iSCSI Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69883","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70580","Microsoft","Windows 10 Version 1809","Windows Credential Guard Spoofing Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-72934","Microsoft","Windows 11 version 23H2","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-72955","Microsoft","Windows 11 version 23H2","Windows Application Compatibility Cache Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-68836","Microsoft","Windows 10 Version 1607","Windows kernel32.dll Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69521","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69634","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-69705","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70252","Microsoft","Windows 10 Version 1607","Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability","HIGH",7,"2026-10-13",0],["CVE-2026-70255","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70271","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70272","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70273","Microsoft","Windows 11 Version 24H2","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70274","Microsoft","Windows 11 version 23H2","Windows Bind Filter Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70278","Microsoft","Windows 10 Version 1607","Microsoft Windows Media Foundation Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70280","Microsoft","Windows 10 Version 21H2","Windows Hello Security Feature Bypass Vulnerability","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-70284","Microsoft","Windows 10 Version 1607","Win32k Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70285","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70218","Microsoft","Windows 11 Version 24H2","Windows StateRepository API Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70223","Microsoft","Windows 10 Version 1607","Windows Console Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70225","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70234","Microsoft","Windows 10 Version 1607","Desktop Window Manager Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70249","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70253","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70233","Microsoft","Windows 10 Version 1607","Windows Common Log File System Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70247","Microsoft","Windows 10 Version 1607","HTTP.sys Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70142","Microsoft","Windows 11 version 23H2","Windows Update Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70150","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70156","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70168","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70169","Microsoft","Windows 10 Version 1809","Windows Connected Devices Platform Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70173","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70176","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70177","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70195","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-70198","Microsoft","Windows 10 Version 1809","Windows Push Notifications Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70205","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70245","Microsoft","Windows 10 Version 1607","Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70115","Microsoft","Windows 11 Version 24H2","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70118","Microsoft","Windows 11 Version 24H2","Windows Audio Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70119","Microsoft","Windows Server 2022","Windows DNS Remote Code Execution Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70126","Microsoft","Windows 10 Version 1607","Windows Bluetooth Port Driver Remote Code Execution","HIGH",7.1,"2026-10-13",0],["CVE-2026-70132","Microsoft","Windows 10 Version 1607","Windows Portable Device File System Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70133","Microsoft","Windows 10 Version 1607","Windows SMB Server Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70135","Microsoft","Windows 10 Version 1607","Windows Remote POS Driver Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70136","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70138","Microsoft","Windows 10 Version 1607","Windows OLE Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70140","Microsoft","Windows 10 Version 1809","Windows Audio Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70141","Microsoft","Windows 10 Version 1607","Microsoft Windows Search Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70155","Microsoft","Windows 10 Version 1607","Windows DNS Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70166","Microsoft","Windows 10 Version 1607","Windows DNS Denial of Service Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-70093","Microsoft","Windows 10 Version 1607","Windows Rich Text Edit Control Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70095","Microsoft","Windows 10 Version 1607","Windows iSCSI Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70096","Microsoft","Microsoft 365 Apps for Enterprise","Windows Rich Text Edit Control Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-70103","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70104","Microsoft","Windows 10 Version 1809","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70106","Microsoft","Windows 10 Version 1607","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70108","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70114","Microsoft","Windows 11 version 23H2","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70117","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70121","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70123","Microsoft","Windows 10 Version 1607","Microsoft Graphics Component Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70127","Microsoft","Windows 10 Version 1607","Windows Domain Name Service Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70139","Microsoft","Windows 10 Version 1607","Windows Update Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70060","Microsoft","Windows 10 Version 1607","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70062","Microsoft","Windows 10 Version 1809","Windows libarchive Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-70063","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-70064","Microsoft","Windows 10 Version 1607","Windows Kerberos Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70076","Microsoft","Windows 11 Version 24H2","Windows Win32k Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70077","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-70079","Microsoft","Windows 10 Version 1607","Windows DNS Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70082","Microsoft","Windows Server 2012","Windows DNS Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70083","Microsoft","Windows 10 Version 1607","Role: DNS Server Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70085","Microsoft","Windows Server 2012","Role: DNS Server Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70087","Microsoft","Windows 10 Version 1607","Role: DNS Server Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70090","Microsoft","Windows 10 Version 1607","Windows Netlogon Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70097","Microsoft","Windows 11 Version 24H2","Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability","MEDIUM",5.6,"2026-10-13",0],["CVE-2026-70014","Microsoft","Windows 10 Version 1607","Windows Cryptographic Services Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70015","Microsoft","Windows 10 Version 1607","Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerab","HIGH",7.8,"2026-10-13",0],["CVE-2026-70017","Microsoft","Windows 10 Version 1809","Windows Secure Kernel Mode Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70021","Microsoft","Windows 11 Version 24H2","Windows Direct Composition Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70025","Microsoft","Windows 10 Version 1607","Windows Netlogon Denial of Service Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-70026","Microsoft","Windows 10 Version 1809","Windows Secure Kernel Mode Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70027","Microsoft","Windows 10 Version 21H2","Windows Subsystem for Linux Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70033","Microsoft","Windows 10 Version 1607","Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70056","Microsoft","Windows 10 Version 1809","Windows Update Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-70057","Microsoft","Windows 10 Version 1607","Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70058","Microsoft","Windows 10 Version 1607","Windows DHCP Server Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-70059","Microsoft","Windows 10 Version 1607","Windows OLE Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69964","Microsoft","Windows 10 Version 1607","Kernel Streaming Service Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69966","Microsoft","Windows 10 Version 1607","Kernel Streaming Service Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69968","Microsoft","Windows 10 Version 1809","Windows libarchive Tampering Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69969","Microsoft","Windows 10 Version 21H2","Windows AppX Deployment Service Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-69970","Microsoft","Windows 10 Version 1607","Kernel Streaming Service Driver Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69971","Microsoft","Windows 11 Version 24H2","Windows Kernel-Mode Drivers Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69973","Microsoft","Windows 10 Version 1809","Windows libarchive Tampering Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-69974","Microsoft","Windows 10 Version 1809","Desktop Window Manager Information Disclosure Vulnerability","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-69976","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-69978","Microsoft","Windows 10 Version 1809","Microsoft Windows VMSwitch Denial of Service Vulnerability","MEDIUM",5.6,"2026-10-13",0],["CVE-2026-69979","Microsoft","Windows 10 Version 21H2","Windows AppX Deployment Service Security Feature Bypass Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-70010","Microsoft","Windows 10 Version 1607","Windows NTFS Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69918","Microsoft","Windows 10 Version 1607","Windows Core Messaging Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69942","Microsoft","Windows 11 version 23H2","Windows Overlay Filter Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69945","Microsoft","Windows 10 Version 21H2","Windows AppX Deployment Extensions Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69947","Microsoft","Windows 10 Version 21H2","Windows Overlay Filter Remote Code Execution Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-69950","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69952","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69953","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69954","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69957","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69958","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Remote Code Execution Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-69959","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69963","Microsoft","Windows 10 Version 1607","Kernel Streaming Service Driver Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69967","Microsoft","Windows 10 Version 1607","Windows Overlay Filter Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69763","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69766","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69795","Microsoft","Windows 10 Version 1809","Windows Clipboard Server Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69840","Microsoft","Windows 10 Version 1607","Windows Certificates Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-69850","Microsoft","Windows 10 Version 1607","Windows Certificates Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69867","Microsoft","Windows 10 Version 1607","SQLite Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69905","Microsoft","Windows 10 Version 1809","Windows AppX Deployment Service Tampering Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69909","Microsoft","Windows 10 Version 1607","Microsoft COM for Windows Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69913","Microsoft","Windows 10 Version 1607","Windows TCP/IP Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-69914","Microsoft","Windows 10 Version 1809","Windows AppX Deployment Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-69926","Microsoft","Windows 10 Version 1809","Desktop Window Manager Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69935","Microsoft","Windows 10 Version 1809","Windows Storage Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108460","Microsoft","Windows 10 Version 1607","Windows Message Queuing Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-108461","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108462","Microsoft","Windows 10 Version 1607","Windows Kernel Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-108464","Microsoft","Windows 10 Version 1607","Software Protection Platform (SPP) Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108465","Microsoft","Windows 10 Version 1809","Windows Update Delivery Optimization Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-108466","Microsoft","Windows 10 Version 1607","Windows Kernel Denial of Service Vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-49785","Microsoft","Windows 10 Version 1607","UEFI Secure Boot Security Feature Bypass Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-61931","Microsoft","Windows 10 Version 1809","Windows Perception Simulation Service Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-69363","Microsoft","Windows 10 Version 1607","Windows Error Reporting Elevation of Privilege Vulnerability","HIGH",8,"2026-10-13",0],["CVE-2026-69639","Microsoft","Windows 10 Version 1809","Windows libarchive Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-69898","Microsoft","Windows 10 Version 1809","Windows Kernel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-70566","Microsoft","Windows 10 Version 1607","Windows Schannel Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-72968","Microsoft","Windows 10 Version 1607","Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-105717","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105718","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Excel Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105719","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft SharePoint Server Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-105722","Microsoft","Windows 10 Version 1809","Windows Broadcast DVR User Service Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-105723","Microsoft","Windows 10 Version 1607","Windows Distributed File System (DFS) Elevation of Privilege Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105726","Microsoft","Microsoft Defender for Endpoint for Windows","Microsoft Defender Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-105731","Microsoft","Microsoft Office for Android","Microsoft Office Graphics Component Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-105732","Microsoft","Sysinternals Suite","SysInternals Elevation of Privilege Vulnerability","HIGH",7.3,"2026-10-13",0],["CVE-2026-105733","Microsoft","Windows 10 Version 21H2","Windows Hyper-V Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-108399","Microsoft","Windows 10 Version 1607","Windows Hyper-V Elevation of Privilege Vulnerability","HIGH",7.2,"2026-10-13",0],["CVE-2026-108467","Microsoft","Windows 10 Version 1607","Microsoft PostScript Printer Driver Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70235","Microsoft","Windows 11 Version 24H2","Windows Event Tracing Spoofing Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-105598","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105599","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office PowerPoint Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105713","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","MEDIUM",5.7,"2026-10-13",0],["CVE-2026-105714","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105715","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105716","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105720","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-108398","Microsoft","Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",".NET Framework Security Feature Bypass Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-108458","Microsoft","Windows 10 Version 1607","Remote Desktop Client Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-69370","Microsoft","Visual Studio Code","Visual Studio Code Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-94506","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-97800","Microsoft","Windows 11 Version 24H2","Windows Mobile Broadband Elevation of Privilege Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102862","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102863","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102864","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-102865","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-102866","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-102867","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Word Information Disclosure Vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-105591","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105592","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-105593","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105595","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105596","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-105597","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-96183","Microsoft","Windows 11 Version 24H2","Windows Health and Optimized Experiences Service Information Disclosure Vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-102238","Microsoft","Visual Studio Code","Visual Studio Code Remote Code Execution Vulnerability","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-102855","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Visio Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102856","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Visio Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102857","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Visio Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102858","Microsoft","Microsoft Office 365 for Mac","Microsoft Office OneNote Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102859","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Spoofing Vulnerability","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-102860","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102861","Microsoft","Microsoft SharePoint Server Subscription Edition","Microsoft Office SharePoint Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-70098","Microsoft","Visual Studio Code","Visual Studio Code Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102231","Microsoft","Visual Studio Code","Visual Studio Code Security Feature Bypass Vulnerability","HIGH",7.7,"2026-10-13",0],["CVE-2026-102232","Microsoft","Visual Studio Code","Visual Studio Code Security Feature Bypass Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-102233","Microsoft","Visual Studio Code","Visual Studio Code Security Feature Bypass Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-102234","Microsoft","Visual Studio Code","Visual Studio Code Security Feature Bypass Vulnerability","HIGH",7.4,"2026-10-13",0],["CVE-2026-102235","Microsoft","Visual Studio Code","Visual Studio Code Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102229","Microsoft","Visual Studio Code","Visual Studio Code Information Disclosure Vulnerability","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-102227","Microsoft","Windows 10 Version 1607","Windows Resilient File System (ReFS) Remote Code Execution Vulnerability","HIGH",7.8,"2026-10-13",0],["CVE-2026-108468","Microsoft","Windows 10 Version 1607","Windows Installer Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-105728","Microsoft","Microsoft Dynamics NAV 2018","Dynamics Business Central Information Disclosure Vulnerability","HIGH",7.5,"2026-10-13",0],["CVE-2026-108400","Microsoft","HEVC Video Extensions","HEVC Video Extensions Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-108457","Microsoft","Windows 10 Version 21H2","Microsoft Windows PDF Remote Code Execution Vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-105725","Microsoft","Windows Security App","Windows Security App Elevation of Privilege Vulnerability","HIGH",7,"2026-10-13",0],["CVE-2026-105727","Microsoft","Microsoft Dynamics NAV 2018","Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-103572","Microsoft","Microsoft Visual Studio 2022 version 17.14","Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Executio","HIGH",8.8,"2026-10-13",0],["CVE-2026-102850","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-102849","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Access Remote Code Execution Vulnerability","HIGH",8.8,"2026-10-13",0],["CVE-2026-110240","duke-git","lancet","Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-110239","zofe","rapyd-admin","Rapyd Admin before 9.20.0 Stored XSS via rich-text Component","LOW",2.1,"2026-10-13",0],["CVE-2026-110237","vifm","vifm","Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Exe","HIGH",7,"2026-10-13",0],["CVE-2026-110238","zofe","rapyd-admin","Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component","HIGH",8.7,"2026-10-13",0],["CVE-2026-110236","KDE","Dolphin","KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name","HIGH",7.1,"2026-10-13",0],["CVE-2026-110234","elio-fm","elio","Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture","MEDIUM",4.1,"2026-10-13",0],["CVE-2026-110235","Abdurazaaq Mohammed","MP Manager","MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-110233","NSPC911","rovr","rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe","HIGH",8.4,"2026-10-13",0],["CVE-2026-110231","muCommander","muCommander","muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP","MEDIUM",5.6,"2026-10-13",0],["CVE-2026-110232","Fossify","Fossify File Manager","Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-110230","sergix44","XBackBone","XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110228","wallabag","wallabag","wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110229","Webkul","QloApps","QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110226","Webkul","QloApps","QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110225","shaarli","Shaarli","Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110223","Kareadita","Kavita","Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint","LOW",2.3,"2026-10-13",0],["CVE-2026-110224","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110222","Razorpay","IFSC","Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-110220","Kubeflow","Model Registry","Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation","HIGH",7.1,"2026-10-13",0],["CVE-2026-110221","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110219","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110217","lenve","vhr","vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /cha","HIGH",7.1,"2026-10-13",0],["CVE-2026-110218","Webkul","Aureus ERP","Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-110216","youlaitech","youlai-boot","youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint","HIGH",7.1,"2026-10-13",0],["CVE-2026-110214","xiaonuobase","Snowy","Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-110215","youlaitech","youlai-boot","youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege ","HIGH",8.7,"2026-10-13",0],["CVE-2026-110213","Stonewuu","ai-fusion-video","ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item End","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110211","iflytek","skillhub","SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint","HIGH",7.2,"2026-10-13",0],["CVE-2026-110212","Stonewuu","ai-fusion-video","ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110209","Stonewuu","ai-fusion-video","ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Expose","HIGH",7.1,"2026-10-13",0],["CVE-2026-110210","Phase","Phase Console","Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query","MEDIUM",6,"2026-10-13",0],["CVE-2026-110208","WuKongOpenSource","Wukong AICRM","Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes S","HIGH",7.1,"2026-10-13",0],["CVE-2026-110206","RooCodeInc","Roo-Code","Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position","HIGH",7.7,"2026-10-13",0],["CVE-2026-110207","WuKongOpenSource","Wukong AICRM","Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs","HIGH",8.7,"2026-10-13",0],["CVE-2026-110205","RooCodeInc","Roo-Code","Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution","HIGH",7.7,"2026-10-13",0],["CVE-2026-110203","RooCodeInc","Roo-Code","Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization","HIGH",7.7,"2026-10-13",0],["CVE-2026-110204","RooCodeInc","Roo-Code","Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution","HIGH",7.7,"2026-10-13",0],["CVE-2026-110202","RooCodeInc","Roo-Code","Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping","HIGH",7.7,"2026-10-13",0],["CVE-2026-92088","upKeeper Solutions","upKeeper Instant Privilege Access","Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant","HIGH",8.6,"2026-10-13",0],["CVE-2026-110036","Red Hat","Red Hat Enterprise Linux 10","Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafte","LOW",3.3,"2026-10-13",0],["CVE-2026-103937","misskey-dev","misskey","Misskey: Denial of service resulting from insufficient cleanup processing during file uplo","HIGH",8.7,"2026-10-13",0],["CVE-2026-104817","misskey-dev","misskey","Misskey: Lack of rate limiting and size restrictions in RSS fetching API","HIGH",8.7,"2026-10-13",0],["CVE-2026-104816","misskey-dev","misskey","Misskey: Cross-site scripting in RSS feed item links","HIGH",8.5,"2026-10-13",0],["CVE-2026-104340","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103856","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-104343","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | NULL Pointer Dereference (CWE-476)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103966","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)","HIGH",7.8,"2026-10-13",0],["CVE-2026-106625","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104341","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104342","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Use After Free (CWE-416)","HIGH",7.8,"2026-10-13",0],["CVE-2026-104344","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103967","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Out-of-bounds Write (CWE-787)","HIGH",7.8,"2026-10-13",0],["CVE-2026-103857","Adobe","Adobe FrameMaker 2026","Adobe Framemaker | Out-of-bounds Read (CWE-125)","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-54086","esa","sleapi-j","SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of ","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109429","mistralai","mistral-vibe","Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform","HIGH",8.7,"2026-10-13",0],["CVE-2026-85747","distribution","distribution","Distribution: Client `manifests.Get()` does not verify returned content against requested ","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-107607","Swann Communications","SWIFI-SE2KIC","Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-107606","Swann Communications","SWIFI-SE2KIC","Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-107605","Swann Communications","SWIFI-SE2KIC","Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-109428","mistralai","mistral-vibe","Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation","HIGH",8.7,"2026-10-13",0],["CVE-2026-95631","Adobe","Adobe Commerce","Adobe Commerce | Improper Input Validation (CWE-20)","HIGH",8.7,"2026-10-13",0],["CVE-2026-103849","Adobe","Adobe Commerce","Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CW","CRITICAL",10,"2026-10-13",0],["CVE-2026-92910","Adobe","Adobe Commerce","Adobe Commerce | Incorrect Authorization (CWE-863)","HIGH",7.2,"2026-10-13",0],["CVE-2026-91013","Adobe","Adobe Commerce","Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-92464","Adobe","Adobe Commerce","Adobe Commerce | Improper Input Validation (CWE-20)","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-95630","Adobe","Adobe Commerce","Adobe Commerce | Improper Input Validation (CWE-20)","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-92922","Adobe","Adobe Commerce","Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)","HIGH",8.1,"2026-10-13",0],["CVE-2026-92908","Adobe","Adobe Commerce","Adobe Commerce | Incorrect Authorization (CWE-863)","HIGH",8.3,"2026-10-13",0],["CVE-2026-92909","Adobe","Adobe Commerce","Adobe Commerce | Incorrect Authorization (CWE-863)","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-100133","Adobe","Adobe Commerce","Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-92911","Adobe","Adobe Commerce","Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)","HIGH",8.7,"2026-10-13",0],["CVE-2026-104937","Shopware","Shopware","CVE-2026-104937","HIGH",8.1,"2026-10-13",0],["CVE-2026-110249","Mozilla","Thunderbird","Denial-of-service in the Exchange email component","HIGH",8.6,"2026-10-13",0],["CVE-2026-110247","Mozilla","Thunderbird","Integer overflow in libmime buffer growth could lead to heap corruption","HIGH",8.4,"2026-10-13",0],["CVE-2026-75120","OpenText","Endpoint Investigator","Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-108385","marcosschroh","dataclasses-avroschema","dataclasses-avroschema enum symbols can inject statements through generated member names","HIGH",8.8,"2026-10-13",0],["CVE-2026-108384","marcosschroh","dataclasses-avroschema","dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare","HIGH",8.8,"2026-10-13",0],["CVE-2026-108383","marcosschroh","dataclasses-avroschema","dataclasses-avroschema enum field defaults can inject statements into generated modules","HIGH",8.8,"2026-10-13",0],["CVE-2026-92892","jfrog","jfrog-cli","Potential command execution on the host running JFrog CLI.","CRITICAL",9,"2026-10-13",0],["CVE-2026-108382","marcosschroh","dataclasses-avroschema","dataclasses-avroschema allows code injection through generated enum-symbol string literals","HIGH",8.8,"2026-10-13",0],["CVE-2026-108381","marcosschroh","dataclasses-avroschema","dataclasses-avroschema pydantic-class metadata allows code injection in generated annotati","HIGH",8.8,"2026-10-13",0],["CVE-2026-108380","marcosschroh","dataclasses-avroschema","dataclasses-avroschema field documentation allows code injection in generated Pydantic des","HIGH",8.8,"2026-10-13",0],["CVE-2026-108379","marcosschroh","dataclasses-avroschema","dataclasses-avroschema fixed namespaces allow code injection in generated annotations","HIGH",8.8,"2026-10-13",0],["CVE-2026-106175","Fortinet","FortiSwitch","A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.","LOW",2.1,"2026-10-13",0],["CVE-2026-106172","Fortinet","FortiSandbox","A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through","MEDIUM",4.9,"2026-10-13",0],["CVE-2025-46773","Fortinet","FortiAnalyzer Cloud","An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu","HIGH",7.9,"2026-10-13",0],["CVE-2026-23705","Fortinet","FortiAnalyzer","An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-23706","Fortinet","FortiAnalyzer Cloud","An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-23707","Fortinet","FortiManager Cloud","An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu","MEDIUM",6.5,"2026-10-13",0],["CVE-2025-57739","Fortinet","FortiMail","An improper neutralization of special elements used in an SQL Command (\"SQL Injection\") vu","HIGH",7.7,"2026-10-13",0],["CVE-2026-106170","Fortinet","FortiSandbox","An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-106173","Fortinet","FortiSIEM","A improper limitation of a pathname to a restricted directory ('path traversal') vulnerabi","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-106176","Fortinet","FortiSIEM","A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to ex","LOW",3.4,"2026-10-13",0],["CVE-2026-106171","Fortinet","FortiManager","A improper neutralization of special elements used in an os command ('os command injection","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-105445","Docker","Docker Hub","Docker Hub account conversion could reassign an active personal access token to another us","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-108378","marcosschroh","dataclasses-avroschema","dataclasses-avroschema record documentation can terminate generated class docstrings","HIGH",8.8,"2026-10-13",0],["CVE-2026-104085","odt2spip","odt2spip","odt2spip < 4.4.0 OS Command Injection via Document Filename","HIGH",8.7,"2026-10-13",0],["CVE-2026-108377","marcosschroh","dataclasses-avroschema","dataclasses-avroschema allows code injection through generated Meta.schema_name","HIGH",8.8,"2026-10-13",0],["CVE-2026-108376","marcosschroh","dataclasses-avroschema","dataclasses-avroschema allows code injection through record names in generated default fac","HIGH",8.8,"2026-10-13",0],["CVE-2026-15577","Grafana","Grafana Enterprise","Git Sync connection configuration can be modified with read-only access","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-33374","Grafana","Grafana Enterprise","Unbounded memory allocation in the Prometheus rule conversion API","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-93294","Grafana","Grafana Enterprise","Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager ","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-95502","Grafana","Nanogit","Git Sync memory exhaustion via a malicious Git server","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108375","marcosschroh","dataclasses-avroschema","dataclasses-avroschema allows code injection through generated field-default literals","HIGH",8.8,"2026-10-13",0],["CVE-2026-109828","","libsndfile","libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-88834","Red Hat","Red Hat Hardened Images","Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds","LOW",3.7,"2026-10-13",0],["CVE-2026-88838","Red Hat","Red Hat Hardened Images","Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restr","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-88833","Red Hat","Red Hat Hardened Images","Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-53562","Citrix","UniconOS","Local Privilege Escalation","HIGH",8.5,"2026-10-13",0],["CVE-2026-110131","LiuYuYang01","ThriveX-Server","ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-110129","fushengqian","fuintCatering","fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail","HIGH",7.1,"2026-10-13",0],["CVE-2026-110127","wayn111","waynboot-mall","waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110128","fushengqian","fuint","fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail","HIGH",8.7,"2026-10-13",0],["CVE-2026-110126","wayn111","waynboot-mall","waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110124","kerwincui","FastBee","FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints","HIGH",8.6,"2026-10-13",0],["CVE-2026-110125","wayn111","waynboot-mall","waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110123","makunet","maku-boot","Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoi","HIGH",7.1,"2026-10-13",0],["CVE-2026-110121","PickMall","lilishop","PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint","HIGH",7.1,"2026-10-13",0],["CVE-2026-110122","PickMall","lilishop","PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110120","guchengwuyue","yshopmall","yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110118","risesoft-y9","WorkFlow-Engine","WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoi","HIGH",7.1,"2026-10-13",0],["CVE-2026-110119","guchengwuyue","yshopmall","yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController","HIGH",7.1,"2026-10-13",0],["CVE-2026-110116","risesoft-y9","Digital-Infrastructure","Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile","HIGH",8.8,"2026-10-13",0],["CVE-2026-110117","1024-lab","SmartAdmin","SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController","HIGH",7.1,"2026-10-13",0],["CVE-2026-110115","risesoft-y9","Digital-Infrastructure","Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStr","HIGH",8.7,"2026-10-13",0],["CVE-2026-110113","Sanluan","PublicCMS","PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110114","FJ-OMS","oms-erp","oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-110110","jetlinks","JetLinks Community","JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110109","jetlinks","JetLinks Community","JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Code","HIGH",7.1,"2026-10-13",0],["CVE-2026-110107","dromara","RuoYi-Cloud-Plus","RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}","LOW",2.3,"2026-10-13",0],["CVE-2026-110108","mateaix","MateCloud","MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API","HIGH",8.6,"2026-10-13",0],["CVE-2026-110106","dromara","RuoYi-Vue-Plus","RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}","LOW",2.3,"2026-10-13",0],["CVE-2026-110104","xxyopen","novel","novel through 3.5.0 Unsalted MD5 Password Storage","HIGH",8.2,"2026-10-13",0],["CVE-2026-110105","b3log","Symphony","B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-110103","mlogclub","bbs-go","bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110101","benjaminjonard","Koillection","Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-110102","romkatv","powerlevel10k","powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Install","HIGH",7.7,"2026-10-13",0],["CVE-2026-110100","Jorani","Jorani","Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110098","Jorani","Jorani","Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110099","Jorani","Jorani","Jorani before 1.0.4 Missing Authorization in HR Export Actions","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-110097","ikaros-dev","ikaros","Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token","HIGH",8.6,"2026-10-13",0],["CVE-2026-94603","podman-container-tools","podman","Podman: The `podman run` command can be instructed to disable almost all sandboxing by ima","CRITICAL",10,"2026-10-13",0],["CVE-2026-55823","frappe","frappe","Frappe: Possibility of SQL injection in reportview","HIGH",8.7,"2026-10-13",0],["CVE-2026-66057","frappe","frappe","Frappe: Open Redirect via Unsanitized OAuth State Param.","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109827","","GPAC","GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-19940","zephyrproject","zephyr","Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corr","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-19939","zephyrproject","zephyr","Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kern","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-104126","jumpserver","jumpserver","JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation","MEDIUM",6,"2026-10-13",0],["CVE-2026-54454","opencats","OpenCATS","OpenCATS: Authenticated RCE in the Import module","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-103030","cfug","dio","Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`","HIGH",7.5,"2026-10-13",0],["CVE-2026-109620","SourceCodester","Online Reviewer System","SourceCodester Online Reviewer System index.php prepare sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-61642","squid-cache","squid","Squid Request Smuggling in HTTP Transfer-Encoding","HIGH",7.7,"2026-10-13",0],["CVE-2026-104250","Unstructured-IO","unstructured","unstructured: Stored XSS via unescaped HTML generation","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-77459","argoproj","argo-cd","Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-109412","Ivanti","Neurons Patch for Intune","An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authentic","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-85733","php","frankenphp","FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment va","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109898","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109896","WP Chill","Download Monitor integration for WooCommerce","WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Con","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109890","LeapWorx","Premium Addons for Elementor","WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerab","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-82416","php","frankenphp","FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is","HIGH",7.7,"2026-10-13",0],["CVE-2026-55183","Zarestia-Dev","rclone-manager","RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-106047","Ivanti","Xtraction","A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction be","HIGH",7.7,"2026-10-13",0],["CVE-2026-55562","jhuckaby","Cronicle","Cronicle: Stored XSS in admin Activity Log via account full_name field","CRITICAL",9,"2026-10-13",0],["CVE-2026-106043","Ivanti","Xtraction","A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before ve","HIGH",7.5,"2026-10-13",0],["CVE-2026-109607","SourceCodester","Online Exam System","SourceCodester Online Exam System Login Endpoint loginExe.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-85990","Leantime","leantime","Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Meth","HIGH",8.8,"2026-10-13",0],["CVE-2026-102989","TanStack","router","TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-106042","Ivanti","Xtraction","An External Control of File Name or Path vulnerability in Ivanti Xtraction before version ","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-106035","Ivanti","Xtraction","An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync bef","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-54641","openremote","openremote","OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl","HIGH",7.7,"2026-10-13",0],["CVE-2026-69226","Esri","Portal for ArcGIS","Portal for ArcGIS has a security vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-10759","Esri","Portal for ArcGIS","BUG-000171040 Portal for ArcGIS has a security vulnerability","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-106034","Ivanti","Xtraction","A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote a","MEDIUM",5,"2026-10-13",0],["CVE-2026-69227","Esri","Portal for ArcGIS","BUG-000187331 Portal for ArcGIS has a security vulnerability","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-54640","openremote","openremote","OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotect","HIGH",7.6,"2026-10-13",0],["CVE-2026-109606","SourceCodester","Art Gallery Management System","SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sq","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-54697","connectbot","cbssh","ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-54700","connectbot","cbssh","ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-102672","electron","electron","Electron: Local race condition in Squirrel.Mac update installation on macOS","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-55695","fearlessgeekmedia","FearlessCMS","FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-101899","axios","axios","Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-49264","oauthlib","oauthlib","OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScrip","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-49265","oauthlib","oauthlib","OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-102700","Xen","Xen","gnttab: cache-flush handling may cause page reference leak","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-102699","Xen","Xen","Arm: multiple issues with GNTTABOP_cache_flush","HIGH",7.5,"2026-10-13",0],["CVE-2026-102702","Xen","Xen","Arm: multiple issues with GNTTABOP_cache_flush","HIGH",7.5,"2026-10-13",0],["CVE-2026-109605","SourceCodester","Simple Cafe Billing System","SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improp","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-79611","Xen","Xen","VMX: VMentry failure with branch tracing and blocked states","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-79610","Xen","Xen","grant-table: double version change race","HIGH",8.8,"2026-10-13",0],["CVE-2026-103928","metabase","metabase","Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-79609","Xen","Xen","x86: XPTI may break on huge-memory systems","HIGH",8.8,"2026-10-13",0],["CVE-2026-79608","Xen","Xen","x86/AMD: ineffectual Zenbleed workaround","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-79607","Xen","Xen","Xenstore: Guests can crash xenstored during Live Update","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-110025","slackero","phpwcms","slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-104005","MongoDB","MongoDB Server","Incorrect authorization in MongoDB Server router for bulk writes to system namespaces","HIGH",7.1,"2026-10-13",0],["CVE-2026-104004","MongoDB","MongoDB Server","Collection validators using collation-accepting expressions can crash MongoDB Server on in","HIGH",7.1,"2026-10-13",0],["CVE-2026-102981","makeplane","plane","Plane: Unauthenticated Workspace Invitation Token Leakage","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-103965","MongoDB","MongoDB Server","Fixed values in MongoDB Server $bucket stage may be misread as field references","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-102982","makeplane","plane","Plane: XSS in work item comments","HIGH",8.5,"2026-10-13",0],["CVE-2026-104935","Ivanti","Connect Secure","Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthent","HIGH",8.6,"2026-10-13",1],["CVE-2026-102988","makeplane","plane","Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109526","HBAI-Ltd","Toonflow-app","HBAI-Ltd Toonflow-app exportData Endpoint information disclosure","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-102734","lmfit","asteval","asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default ast","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-96299","MongoDB","MongoDB Server","Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads t","HIGH",7.1,"2026-10-13",0],["CVE-2026-96297","MongoDB","MongoDB Server","MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggr","MEDIUM",6,"2026-10-13",0],["CVE-2026-69150","keepassxreboot","keepassxc","KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-102832","jupyterlab","jupyterlab","JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the on","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-55675","saltyorg","docs","Salty documentation workflow executes fork-controlled Python build hooks with deployment s","CRITICAL",10,"2026-10-13",0],["CVE-2026-109525","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorizatio","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-55376","heymrun","heym","heym Python Tool Sandbox Escape","HIGH",8.8,"2026-10-13",0],["CVE-2026-105460","Red Hat","Red Hat Enterprise Linux 10","Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_l","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-81507","espressif","esp-idf","ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Se","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109524","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authoriza","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-106108","quasarframework","quasar","Quasar Framework: App Vite SSG page output paths can escape the configured distribution di","MEDIUM",5.7,"2026-10-13",0],["CVE-2026-103028","drakkan","sftpgo","SFTPGo source-side file-pattern filter bypass during copy operations","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-77375","drakkan","sftpgo","SFTPGo: Denial of service via malformed SSH channel request","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-102250","Schneider Electric","Sage RTU 1410","CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could al","HIGH",8.6,"2026-10-13",0],["CVE-2026-107918","NETGEAR","R7300DST","Insufficient input validation vulnerability in NETGEAR R7300","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-107917","NETGEAR","R7300DST","Insufficient input validation vulnerability in NETGEAR R7300 router","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109523","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-104192","dragonflydb","dragonfly","DragonflyDB stream RDB deserialization double-free","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-11732","NETGEAR","CAX30","Insufficient input validation vulnerability exists in website blocking feature of certain ","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-11731","NETGEAR","RAX30","Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-11730","NETGEAR","EX3700","Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models","LOW",2.1,"2026-10-13",0],["CVE-2026-9218","NETGEAR","CBR40","Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-53711","IBM","mcp-context-forge","MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-53709","IBM","mcp-context-forge","MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example ena","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-109522","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql inj","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108185","Zoom Communications","Zoom Clients","Improper certificate validation in the My Notes feature of certain Zoom Clients may allow ","HIGH",7.4,"2026-10-13",0],["CVE-2026-102342","rust-ammonia","ammonia","ammonia allows stored XSS through unsanitized SVG animate and set attributes","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-108184","Zoom Communications","Zoom Clients","Improper certificate validation in certain Zoom Clients for Windows may allow an unauthent","HIGH",7.4,"2026-10-13",0],["CVE-2026-77100","Commvault","Commvault Cloud","MediaAgent Denial of Service","HIGH",8.7,"2026-10-13",0],["CVE-2026-97333","Commvault","Commvault Cloud","QAPI stack-based buffer overflow","HIGH",7.1,"2026-10-13",0],["CVE-2026-97334","Commvault","Commvault Cloud","Network messaging layer decompression resource exhaustion","HIGH",8.7,"2026-10-13",0],["CVE-2026-77094","Commvault","Commvault Cloud","CvFWD Out-of-Bounds Write","HIGH",7.1,"2026-10-13",0],["CVE-2026-77095","Commvault","Commvault Cloud","CvFWD Null Pointer Dereference","HIGH",7.1,"2026-10-13",0],["CVE-2026-77096","Commvault","Commvault Cloud","CVFS Missing Authentication","HIGH",7.7,"2026-10-13",0],["CVE-2026-77099","Commvault","Commvault Cloud","CVFS Command Execution","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-18228","Commvault","Commvault Cloud","Hyperscale Path Traversal","HIGH",7.1,"2026-10-13",0],["CVE-2026-77090","Commvault","Commvault Cloud","CVFS Information Disclosure","HIGH",8.7,"2026-10-13",0],["CVE-2026-77093","Commvault","Commvault Cloud","CvFWD Denial of Service","HIGH",7.1,"2026-10-13",0],["CVE-2026-53420","Zoom Communications","Zoom Workplace","Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthentic","HIGH",8,"2026-10-13",0],["CVE-2026-102603","gotify","server","Gotify: Insufficiently Protected Password Change endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-65200","Huawei","openBMC","Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short M","LOW",3.5,"2026-10-13",0],["CVE-2026-65199","Huawei","openBMC","Huawei openUBMC low-privilege SNMP to administrator privilege escalation","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-65198","Huawei","openUBMC","Huawei Default SNMPv3 USM key","HIGH",8.6,"2026-10-13",0],["CVE-2026-65197","H3C","HDM Family-A G5","H3C G3/G5 HDM Firmware Verification Key Replacement","LOW",3.1,"2026-10-13",0],["CVE-2026-107460","Apache Software Foundation","Apache Fesod (Incubating)","Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-53418","Zoom Communications","Zoom Workplace","Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android befo","HIGH",8.1,"2026-10-13",0],["CVE-2026-109521","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-12656","Rockwell Automation","1732E ArmorBlock® I/O","1732E ArmorBlock® - Multiple Vulnerabilities","HIGH",8.7,"2026-10-13",0],["CVE-2026-4869","Flexera","InstallShield","Potential Privilege Escalation in InstallShield","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-12655","Rockwell Automation","1732E ArmorBlock® I/O","1732E ArmorBlock® - Multiple Vulnerabilities","HIGH",8.8,"2026-10-13",0],["CVE-2026-0893","AMI","AptioV","Uncleared Password Keystrokes Vulnerability","MEDIUM",5.8,"2026-10-13",0],["CVE-2025-58774","AMI","AptioV","UEFI OOB Write and Buffer Overflow Vulnerabilities","HIGH",8.3,"2026-10-13",0],["CVE-2025-58773","AMI","AptioV","UEFI OOB Write and Buffer Overflow Vulnerabilities","HIGH",7.1,"2026-10-13",0],["CVE-2025-58772","AMI","AptioV","UEFI OOB Write and Buffer Overflow Vulnerabilities","HIGH",8.2,"2026-10-13",0],["CVE-2025-58771","AMI","AptioV","UEFI OOB Write and Buffer Overflow Vulnerabilities","HIGH",7.1,"2026-10-13",0],["CVE-2026-77361","The-40-Thieves","obsidian-tc","obsidian-tc symlink path mismatch bypasses read ACL restrictions","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-109967","marcopiovanello","yt-dlp-web-ui","yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats","HIGH",8.7,"2026-10-13",0],["CVE-2026-109965","oraios","serena","Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root","HIGH",8.4,"2026-10-13",0],["CVE-2026-109966","marcopiovanello","yt-dlp-web-ui","yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109520","Colorful","iGameCenter","Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-77362","The-40-Thieves","obsidian-tc","obsidian-tc bridge tools expose data outside the read ACL","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-93907","IBM","WebSphere Application Server","IBM WebSphere Application Server is affected by a bypass authentication vulnerability","HIGH",8.1,"2026-10-13",0],["CVE-2026-95680","IBM","WebSphere Application Server","IBM WebSphere Application Server is affected by an authorization bypass","HIGH",8,"2026-10-13",0],["CVE-2026-103499","IBM","WebSphere Application Server - Liberty","IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by ","HIGH",7.5,"2026-10-13",0],["CVE-2026-109519","","YouTransfer","YouTransfer Template Rendering template path traversal","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109964","ImageMagick","ImageMagick","ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-109410","macrozheng","mall","macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calcu","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-93347","Wazuh","wazuh-manager","Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-74047","Wazuh","wazuh-manager","Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint","HIGH",7.1,"2026-10-13",0],["CVE-2026-93346","Wazuh","wazuh-manager","Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-74045","Wazuh","wazuh-manager","Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder","HIGH",7.1,"2026-10-13",0],["CVE-2026-74041","Wazuh","wazuh-manager","Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-74043","Wazuh","wazuh-manager","Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions","HIGH",8.5,"2026-10-13",0],["CVE-2026-74040","Wazuh","wazuh-manager","Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-74036","Wazuh","wazuh-agent","Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies","HIGH",8.6,"2026-10-13",0],["CVE-2026-74037","Wazuh","wazuh-manager","Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token","HIGH",8.6,"2026-10-13",0],["CVE-2026-74034","Wazuh","wazuh-manager","Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command","HIGH",8.7,"2026-10-13",0],["CVE-2026-74035","Wazuh","wazuh-manager","Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user","HIGH",8.6,"2026-10-13",0],["CVE-2026-74033","Wazuh","wazuh-manager","Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers","HIGH",8.4,"2026-10-13",0],["CVE-2026-74031","Wazuh","wazuh-manager","Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers","HIGH",7,"2026-10-13",0],["CVE-2026-74032","Wazuh","wazuh-manager","Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-74030","Wazuh","wazuh-agent","Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109962","froxlor","froxlor","Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109963","froxlor","froxlor","Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109961","froxlor","froxlor","Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members","HIGH",8.4,"2026-10-13",0],["CVE-2026-109959","espocrm","espocrm","EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109960","froxlor","froxlor","Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value","HIGH",8.7,"2026-10-13",0],["CVE-2026-109958","espocrm","espocrm","EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109956","nltk","nltk","NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path","HIGH",8.3,"2026-10-13",0],["CVE-2026-109957","espocrm","espocrm","EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109954","parse-community","parse-server","Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference","HIGH",8.3,"2026-10-13",0],["CVE-2026-109955","honojs","hono","Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109953","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin","MEDIUM",6,"2026-10-13",0],["CVE-2026-109951","FreeRDP","FreeRDP","FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109952","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response","MEDIUM",6,"2026-10-13",0],["CVE-2026-109950","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109948","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109949","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard","HIGH",7.1,"2026-10-13",0],["CVE-2026-109947","FreeRDP","FreeRDP","FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read","HIGH",7.1,"2026-10-13",0],["CVE-2026-109945","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmi","MEDIUM",6,"2026-10-13",0],["CVE-2026-109946","FreeRDP","FreeRDP","FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width","HIGH",7.1,"2026-10-13",0],["CVE-2026-109944","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle","HIGH",7.1,"2026-10-13",0],["CVE-2026-109942","FreeRDP","FreeRDP","FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet","HIGH",7.1,"2026-10-13",0],["CVE-2026-109943","FreeRDP","FreeRDP","FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order","HIGH",7.1,"2026-10-13",0],["CVE-2026-109940","FreeRDP","FreeRDP","FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109941","FreeRDP","FreeRDP","FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response","HIGH",7.1,"2026-10-13",0],["CVE-2026-109939","FreeRDP","FreeRDP","FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order","HIGH",7.1,"2026-10-13",0],["CVE-2026-109680","FreeRDP","FreeRDP","FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username","MEDIUM",6,"2026-10-13",0],["CVE-2026-109938","FreeRDP","FreeRDP","FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update","HIGH",7.1,"2026-10-13",0],["CVE-2026-109679","FreeRDP","FreeRDP","FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response","MEDIUM",6,"2026-10-13",0],["CVE-2026-109677","FreeRDP","FreeRDP","FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler","HIGH",7.1,"2026-10-13",0],["CVE-2026-109678","FreeRDP","FreeRDP","FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA","HIGH",7.1,"2026-10-13",0],["CVE-2026-109676","FreeRDP","FreeRDP","FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect","HIGH",8.7,"2026-10-13",0],["CVE-2026-107832","fastify","fastify","fastify vulnerable to header validation bypass via case-sensitive propertyNames","LOW",3.7,"2026-10-13",0],["CVE-2026-109409","HBAI-Ltd","Toonflow-app","HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command inject","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-65180","NVIDIA","Megatron-LM","NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may ca","HIGH",7.8,"2026-10-13",0],["CVE-2026-65104","NVIDIA","Megatron-LM","NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attac","HIGH",7.1,"2026-10-13",0],["CVE-2026-65110","NVIDIA","Megatron-LM","NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could","HIGH",7.8,"2026-10-13",0],["CVE-2026-65131","NVIDIA","NVSentinel","NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component,","MEDIUM",6,"2026-10-13",0],["CVE-2026-65172","NVIDIA","AIStore framework","NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in ","HIGH",8.6,"2026-10-13",0],["CVE-2026-65164","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extr","HIGH",8.1,"2026-10-13",0],["CVE-2026-65173","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revo","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-65101","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where ","HIGH",8.6,"2026-10-13",0],["CVE-2026-65170","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an ","HIGH",8.6,"2026-10-13",0],["CVE-2026-65162","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec ini","CRITICAL",10,"2026-10-13",0],["CVE-2026-65161","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthentica","HIGH",7.5,"2026-10-13",0],["CVE-2026-65103","NVIDIA","AIStore framework","NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object","HIGH",8.1,"2026-10-13",0],["CVE-2026-109407","macrozheng","mall","macrozheng mall Coupon Redemption generateOrder race condition","LOW",2.3,"2026-10-13",0],["CVE-2026-109406","macrozheng","mall","macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-67456","NVIDIA","Warp","NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer ove","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-65148","NVIDIA","DALI","NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer ov","HIGH",7.3,"2026-10-13",0],["CVE-2026-65150","NVIDIA","DALI","NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-","HIGH",7.3,"2026-10-13",0],["CVE-2026-65149","NVIDIA","DALI","NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-","HIGH",7.3,"2026-10-13",0],["CVE-2026-65147","NVIDIA","DALI","NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-","HIGH",7.3,"2026-10-13",0],["CVE-2026-65141","NVIDIA","Isaac Lab","NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection.","HIGH",7.8,"2026-10-13",0],["CVE-2026-109405","conductor-oss","conductor","conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request f","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109782","Mozilla","Firefox","Mitigation bypass in the File Handling component","","","2026-10-13",0],["CVE-2026-109783","Mozilla","Firefox","Mitigation bypass in the File Handling component","","","2026-10-13",0],["CVE-2026-109778","Mozilla","Firefox","Privilege escalation in the WebExtensions component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109779","Mozilla","Firefox","Race condition in the Networking: DNS component","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-109780","Mozilla","Firefox","Mitigation bypass in the DOM: Core & HTML component","","","2026-10-13",0],["CVE-2026-109781","Mozilla","Firefox","Denial-of-service in the Printing: Output component","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109773","Mozilla","Firefox","Denial-of-service in the Sync component","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109774","Mozilla","Firefox","Invalid pointer, undefined behavior in the DOM: Notifications component","","","2026-10-13",0],["CVE-2026-109775","Mozilla","Firefox","Denial-of-service in the WebRTC component","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109776","Mozilla","Firefox","Race condition in the XPCOM component","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-109777","Mozilla","Firefox","Information disclosure in the Storage: IndexedDB component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109768","Mozilla","Firefox","Denial-of-service in the Site Reports component","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109769","Mozilla","Firefox","Information disclosure in the Networking: Cache component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109770","Mozilla","Firefox","Spoofing issue in the DOM: Web Serial component","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-109771","Mozilla","Firefox","Information disclosure in the WebRTC: Networking component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109772","Mozilla","Firefox","Same-origin policy bypass in the DevTools component","","","2026-10-13",0],["CVE-2026-109764","Mozilla","Firefox","Mitigation bypass in the Enterprise Policies component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109765","Mozilla","Firefox","Race condition, use-after-free in the Graphics: Text component","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-109766","Mozilla","Firefox","Mitigation bypass in the Enterprise Policies component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109767","Mozilla","Firefox","Information disclosure in the Networking component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109760","Mozilla","Firefox","Mitigation bypass in the Networking: HTTP component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109761","Mozilla","Firefox","Use-after-free in the JavaScript: WebAssembly component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109762","Mozilla","Firefox","Incorrect boundary conditions in the SVG component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109763","Mozilla","Firefox","Mitigation bypass in the File Handling component","","","2026-10-13",0],["CVE-2026-109755","Mozilla","Firefox","Sandbox escape in the DOM: Content Processes component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109756","Mozilla","Firefox","Privilege escalation in the DOM: Navigation component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109757","Mozilla","Firefox","Sandbox escape due to race condition in the Networking component","HIGH",8.3,"2026-10-13",0],["CVE-2026-109759","Mozilla","Firefox","Site isolation issue in the Networking component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109751","Mozilla","Firefox","Information disclosure in the Networking component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109752","Mozilla","Firefox","Use-after-free in the DOM: Workers component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109754","Mozilla","Firefox","Incorrect boundary conditions in the DOM: Editor component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109748","Mozilla","Firefox","Use-after-free in the JavaScript: WebAssembly component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109749","Mozilla","Firefox","Use-after-free in the JavaScript: WebAssembly component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109750","Mozilla","Firefox","Site isolation issue in the DOM: Web Authentication component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109744","Mozilla","Firefox","Other issue in the DOM: File component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109745","Mozilla","Firefox","Sandbox escape due to uninitialized memory in the DOM: Web Serial component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109746","Mozilla","Firefox","Mitigation bypass in the DOM: Security component","HIGH",7.3,"2026-10-13",0],["CVE-2026-109747","Mozilla","Firefox","Other issue in the Address Bar component","HIGH",7.3,"2026-10-13",0],["CVE-2026-109740","Mozilla","Firefox","Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109741","Mozilla","Firefox","Use-after-free in the Storage: Bucket File System component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109742","Mozilla","Firefox","Information disclosure in the PDF Viewer component","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109743","Mozilla","Firefox","Privilege escalation in the Panning and Zooming component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109736","Mozilla","Firefox","Frame poisoning in the Layout component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109737","Mozilla","Firefox","Mitigation bypass in the Enterprise Policies component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109738","Mozilla","Firefox","Use-after-free in the Audio/Video: Playback component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109739","Mozilla","Firefox","Privilege escalation in the WebExtensions component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109723","Mozilla","Firefox","Integer overflow in the Layout: Text and Fonts component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109724","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109731","Mozilla","Firefox","Incorrect boundary conditions in the Graphics: Canvas2D component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109734","Mozilla","Firefox","Mitigation bypass in the DOM: Security component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109735","Mozilla","Firefox","Use-after-free in the DOM: Animation component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109714","Mozilla","Firefox","Incorrect boundary conditions in the Layout component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109717","Mozilla","Firefox","Use-after-free in the DOM: Bindings (WebIDL) component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109720","Mozilla","Firefox","JIT miscompilation in the JavaScript: WebAssembly component","HIGH",7.1,"2026-10-13",0],["CVE-2026-109721","Mozilla","Firefox","Incorrect boundary conditions in the JavaScript Engine: JIT component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109707","Mozilla","Firefox","Sandbox escape due to use-after-free in the Networking component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109708","Mozilla","Firefox","Sandbox escape due to incorrect boundary conditions in the Networking component","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109709","Mozilla","Firefox","Information disclosure, privilege escalation in the Security: Process Sandboxing component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109711","Mozilla","Firefox","Use-after-free in the Graphics: Canvas2D component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109713","Mozilla","Firefox","Use-after-free in the Crash Reporting component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109704","Mozilla","Firefox","Privilege escalation in the Application Update component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109705","Mozilla","Firefox","Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free ","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-109733","Mozilla","Firefox","JIT miscompilation in the JavaScript Engine: JIT component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109753","Mozilla","Firefox","Incorrect boundary conditions in the Layout component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109727","Mozilla","Firefox","Use-after-free in the Audio/Video component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109728","Mozilla","Firefox","Use-after-free in the DOM: Animation component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109729","Mozilla","Firefox","Use-after-free in the JavaScript Engine: JIT component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109730","Mozilla","Firefox","Integer overflow in the Graphics component","HIGH",8.8,"2026-10-13",0],["CVE-2026-109732","Mozilla","Firefox","Use-after-free in the DOM: Streams component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109719","Mozilla","Firefox","Race condition, use-after-free in the Graphics: CanvasWebGL component","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-109722","Mozilla","Firefox","JIT miscompilation in the JavaScript Engine: JIT component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109725","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109726","Mozilla","Firefox","Use-after-free in the SVG component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109712","Mozilla","Firefox","Sandbox escape due to uninitialized memory in the Graphics component","HIGH",7.1,"2026-10-13",0],["CVE-2026-109715","Mozilla","Firefox","Incorrect boundary conditions in the JavaScript Engine component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109716","Mozilla","Firefox","Incorrect boundary conditions in the JavaScript Engine component","HIGH",8.1,"2026-10-13",0],["CVE-2026-109718","Mozilla","Firefox","Use-after-free in the XML component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109706","Mozilla","Firefox","Use-after-free in the Storage: IndexedDB component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109710","Mozilla","Firefox","Use-after-free in the Graphics: Text component","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-109976","Red Hat","Red Hat Enterprise Linux 10","Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-109404","conductor-oss","conductor","conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request f","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109833","Red Hat","Red Hat Enterprise Linux 10","Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer han","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-109403","conductor-oss","conductor","conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109402","conductor-oss","conductor","conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side reque","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-94410","Bender","Customer&Partner","Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109832","Red Hat","Red Hat Enterprise Linux 10","Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_int","HIGH",7.5,"2026-10-13",0],["CVE-2026-109190","conductor-oss","conductor","conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.star","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89279","AuthTake Technology Inc.","authtake","Active Directory Password Change CSRF in AuthTake Technology's authtake","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109189","fit2cloud","MeterSphere","fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinitio","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63316","Payload","Payload CMS","SQL Injection in Payload CMS","HIGH",8.7,"2026-10-13",0],["CVE-2026-109160","","PublicCMS","PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109157","TRENDnet","TEW-432BRP","TRENDnet TEW-432BRP formTcpipSetup stack-based overflow","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-109156","SeldonIO","MLServer","SeldonIO MLServer environment_tarball env.py _extract_env path traversal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109155","","DeepPavlov","DeepPavlov Model Download untar path traversal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109153","MosaicML","Composer","MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109152","jbardin","scp.py","jbardin scp.py SCP Receive _recv_pushd path traversal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109149","beautifier","js-beautify","beautifier js-beautify memory allocation","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109162","TYPO3","TYPO3 CMS","TYPO3 CMS - Security Misconfiguration in Form Framework","MEDIUM",6.3,"2026-10-13",0],["CVE-2026-102076","Siemens","APOGEE MBC (PPC) (BACnet)","A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MB","HIGH",8.7,"2026-10-13",0],["CVE-2026-102075","Siemens","APOGEE MBC (PPC) (BACnet)","A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MB","HIGH",8.7,"2026-10-13",0],["CVE-2026-102074","Siemens","APOGEE MBC (PPC) (BACnet)","A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MB","HIGH",8.7,"2026-10-13",0],["CVE-2026-102073","Siemens","APOGEE MBC (PPC) (BACnet)","A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MB","HIGH",8.8,"2026-10-13",0],["CVE-2026-89208","Siemens","Capital Embedded AR Classic 431-422","A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions),","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-89206","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89205","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89204","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89203","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89202","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",7.1,"2026-10-13",0],["CVE-2026-89201","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",7.7,"2026-10-13",0],["CVE-2026-89200","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",8.4,"2026-10-13",0],["CVE-2026-89199","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",8.7,"2026-10-13",0],["CVE-2026-89198","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",8.7,"2026-10-13",0],["CVE-2026-89197","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",8.7,"2026-10-13",0],["CVE-2026-89196","Siemens","RUGGEDCOM CROSSBOW","A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected ","HIGH",8.7,"2026-10-13",0],["CVE-2026-85115","Siemens",".NET Client Library for SIMATIC S7 Webserver API","A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (A","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-85114","Siemens",".NET Client Library for SIMATIC S7 Webserver API","A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (A","HIGH",8.7,"2026-10-13",0],["CVE-2026-78557","Siemens","Industrial Edge App Publisher","A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27","HIGH",7.7,"2026-10-13",0],["CVE-2026-78556","Siemens","Industrial Edge App Publisher","A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27","HIGH",7.6,"2026-10-13",0],["CVE-2026-72895","Siemens","SIMATIC IPC BX-21A","A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMA","HIGH",8.4,"2026-10-13",0],["CVE-2026-63357","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly sanitize calculated signal data contained in imported cal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63356","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly sanitize calculated signal names contained in imported CS","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63355","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly sanitize signal names contained in imported CSV trace fil","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63354","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly validate and sanitize visual marker data contained in imp","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-63353","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly sanitize comment fields contained in imported trace files","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-63352","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly sanitize calculated signal data contained in imported CSV","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63351","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly validate and sanitize visual properties of calculated sig","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-63350","Siemens","SIMATIC Drive Controller CPU 1504D TF","Affected devices do not properly restrict executable content contained in imported trace f","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-59241","Siemens","SIMATIC WinCC V7.5","A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8","HIGH",8.7,"2026-10-13",0],["CVE-2026-44415","Siemens","Industrial Edge Device Kit - arm64 V1.10","Affected systems do not properly restrict access to internal APIs and paths for authentica","HIGH",8.9,"2026-10-13",0],["CVE-2026-44414","Siemens","Industrial Edge Cloud Device (IECD)","A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edg","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109854","Red Hat","Red Hat Enterprise Linux 10","M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding","LOW",2.5,"2026-10-13",0],["CVE-2026-109144","wbond","certvalidator","wbond certvalidator Certificate Path Builder resource consumption","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109143","calcom","cal.com","calcom cal.com/cal.diy Credentials delete credentials.delete privileges management","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109699","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-108487","Hossni Mubarak","Books Gallery","WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-106598","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109687","Link Whisper INC","Link Whisper Free","WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability","HIGH",7.6,"2026-10-13",0],["CVE-2026-105881","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109116","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108179","PluginUs.Net","WOLF","WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability","HIGH",7.6,"2026-10-13",0],["CVE-2026-108489","PluginUs.Net","Active Products Tables for WooCommerce","WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-103076","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerabil","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-108174","PluginUs.Net","FOX","WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-106597","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109697","Brainstorm Force","SureCart","WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-96535","YouMind","YouMind web application","Cross-Site Scripting in the YouMind web application","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-101020","Hammock Corporation","AssetView","An incorrect permission assignment for critical resource issue exists in AssetView, AssetV","HIGH",8.5,"2026-10-13",0],["CVE-2026-109691","BdThemes","Prime Slider – Addons For Elementor","WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS)","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-89309","JTL SW GmbH","JTL-WMS","Missing Authentication Vulnerability in JTL-WMS","CRITICAL",10,"2026-10-13",0],["CVE-2026-108488","IdeaBox Creations","PowerPack Addons for Elementor","WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vuln","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-13138","Divasoft Software and E-Commerce Inc.","Biletiva Ticketing Platform","Improper Authorization in Divasoft Software's Biletiva Ticketing Platform","HIGH",8.6,"2026-10-13",0],["CVE-2026-109696","WP ManageNinja LLC","FluentBoards","WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-108490","LeapWorx","Premium Addons for Elementor","WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vul","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109684","TMS","Amelia","WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108496","WP User Manager","WP User Manager","WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108493","Karolína Vyskočilová","Pay for Payment for WooCommerce","WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerab","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108495","Brainstorm Force","SureForms","WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-109115","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108492","Fullworks Plugins","Quick Paypal Payments","WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109114","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109110","Wavlink","WL-WN592AX6","Wavlink WL-WN592AX6 wmapd system os command injection","CRITICAL",10,"2026-10-13",0],["CVE-2026-14308","Zohocorp","ManageEngine Malware Protection Plus","Insufficient Signature Validation","MEDIUM",4.9,"2026-10-13",0],["CVE-2026-102007","bitpressadmin","Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification","HIGH",7.2,"2026-10-13",0],["CVE-2026-102562","acyba","AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Par","HIGH",7.2,"2026-10-13",0],["CVE-2026-15399","wpmart","Animated Number Counters","Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Pa","MEDIUM",4.9,"2026-10-13",0],["CVE-2026-89097","spacetime","Ad Inserter – Ad Manager & AdSense Ads","Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'a","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-109109","Wavlink","WL-WN530BE1-A","Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflo","CRITICAL",10,"2026-10-13",0],["CVE-2026-109703","WPGraphQL","WPGraphQL","WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109108","Wavlink","WL-WN530BE1-A","Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-67165","HCLSoftware","Connections","HCL Connections is vulnerable to cross-site scripting (XSS)","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-103417","Mozilla","Firefox for iOS","Saved credentials can be autofilled after cross-origin navigation","MEDIUM",5.5,"2026-10-13",0],["CVE-2026-103418","Mozilla","Firefox for iOS","Universal XSS via the HTML language attribute in Translation Services","HIGH",8.8,"2026-10-13",0],["CVE-2026-109107","Wavlink","WL-WN592AX6","Wavlink WL-WN592AX6 upload.cgi main null pointer dereference","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109106","Polaris","Office App","Polaris Office App Document Intake com.infraware.service.m.n.a path traversal","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-75826","Teltonika Networks","RUT","Teltonika Command Injection in Backup function","HIGH",8.5,"2026-10-13",0],["CVE-2026-108975","SourceCodester","Library Management System","SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upl","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108974","SourceCodester","E-Learning System","SourceCodester E-Learning System Users.php save_users unrestricted upload","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108973","SourceCodester","Contact Tracing System","SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-103316","Logius","DigiD for macOS","The macOS version of the DigiD app is not signed with Hardened Runtime","HIGH",7.1,"2026-10-13",0],["CVE-2026-108972","SourceCodester","Human Resource Management System","SourceCodester Human Resource Management System Employee Endpoint employee.php session_sta","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-89269","","WP Testimonials","WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode","MEDIUM",6.8,"2026-10-13",0],["CVE-2026-89271","","WP-BusinessDirectory","WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-54867","Griden","Responsive Slider","WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-54868","FolioVision","FV Simpler SEO","WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-54869","IDX Broker","IMPress for IDX Broker","WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilit","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-54870","wpweaver","Weaver Xtreme Theme Support","WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-108971","D-Link","DCS-930L","D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature","CRITICAL",9.4,"2026-10-13",0],["CVE-2026-108970","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql inj","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108969","itsmeravitejak","Online-Examination-System","itsmeravitejak Online-Examination-System Session session.php checkLogin comparison","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108968","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System sales_history.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108967","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System edit_credit.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108966","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System product.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108965","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System edit_quantity.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109758","Perforce","Helix Authentication Service","Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SC","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-108964","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System addproduct.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108962","storyicon","comfyui_segment_anything","storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108961","PaddlePaddle","PaddleX","PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108960","Tiiny-AI","PowerInfer","Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bou","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-108959","itsourcecode","Online Cake Ordering System","itsourcecode Online Cake Ordering System addtransacdetail.php sql injection","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109786","fail2ban","fail2ban","In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.con","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108958","","TensorLayer","TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108957","TinyLLaVA","TinyLLaVA_Factory","TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config c","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108956","code-projects","Online Reviewer System","code-projects Online Reviewer System User Update btn_functions.php sql injection","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108955","Tiiny-AI","PowerInfer","Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-35001","OpenS100 Project","OpenS100","OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow","HIGH",7.1,"2026-10-13",0],["CVE-2026-108954","k2-fsa","sherpa-onnx","k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-sear","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-108948","code-projects","Online Reviewer System","code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-det","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-5954","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-6567","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-7767","GitLab","GitLab","URL Redirection to Untrusted Site ('Open Redirect') in GitLab","MEDIUM",5.8,"2026-10-13",0],["CVE-2026-9268","GitLab","GitLab","Incorrect Authorization in GitLab","LOW",2.7,"2026-10-13",0],["CVE-2026-14210","GitLab","GitLab","Insufficient Granularity of Access Control in GitLab","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-14552","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-14814","GitLab","GitLab","Permissive Regular Expression in GitLab","HIGH",8.2,"2026-10-13",0],["CVE-2026-16275","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-16301","GitLab","GitLab","Incorrect Authorization in GitLab","HIGH",8.5,"2026-10-13",0],["CVE-2026-78335","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-81839","GitLab","GitLab","Incorrect Authorization in GitLab","HIGH",7.7,"2026-10-13",0],["CVE-2026-82632","GitLab","GitLab","Incorrect Authorization in GitLab","LOW",3.1,"2026-10-13",0],["CVE-2026-84284","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-85529","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-92528","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-92883","GitLab","GitLab","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi","HIGH",8.7,"2026-10-13",0],["CVE-2026-97229","GitLab","GitLab","Integer Overflow or Wraparound in GitLab","CRITICAL",10,"2026-10-13",0],["CVE-2026-96893","GitLab","GitLab","Improper Neutralization of Input Used for LLM Prompting in GitLab","HIGH",7.3,"2026-10-13",0],["CVE-2026-100104","GitLab","GitLab","Server-Side Request Forgery (SSRF) in GitLab","LOW",3.5,"2026-10-13",0],["CVE-2026-100755","GitLab","GitLab","Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab","MEDIUM",4.6,"2026-10-13",0],["CVE-2026-101168","GitLab","GitLab","Insertion of Sensitive Information into Log File in GitLab","MEDIUM",6.2,"2026-10-13",0],["CVE-2026-103549","GitLab","GitLab","Incorrect Authorization in GitLab","LOW",2.7,"2026-10-13",0],["CVE-2026-104661","GitLab","GitLab","Incorrect Privilege Assignment in GitLab","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-105458","GitLab","GitLab","Reliance on Untrusted Inputs in a Security Decision in GitLab","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-108947","yoshitomo-matsubara","torchdistill","yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-87689","Rapid7","Metasploit Framework","Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-108945","iMoonLab","yolov13","iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-108944","repository","RAE","repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code inje","LOW",2.4,"2026-10-13",0],["CVE-2026-89124","SAP_SE","SAP HANA (Display Product Catalog Based on Customs Declaration)","Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-89122","SAP_SE","SAP NetWeaver Enterprise Portal","Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-89121","SAP_SE","SAP S/4HANA (Linear Asset Management RAP Business Object)","Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)","MEDIUM",4.7,"2026-10-13",0],["CVE-2026-89120","SAP_SE","SAP ABAP Platform","Missing authorization check in SAP ABAP Platform","HIGH",7.1,"2026-10-13",0],["CVE-2026-89118","SAP_SE","SAP NetWeaver Enterprise Portal","Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-89117","SAP_SE","SAP NetWeaver Enterprise Portal","Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-89116","SAP_SE","SAP yeoman-ui","OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-89113","SAP_SE","SAP Commerce Cloud (OOTB Code)","SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)","HIGH",8.8,"2026-10-13",0],["CVE-2026-89112","SAP_SE","CLA-Assistant","Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-89111","SAP_SE","SAP Cloud","OAuth2 SSRF vulnerability in SAP Cloud SDK for Python","CRITICAL",10,"2026-10-13",0],["CVE-2026-89110","SAP_SE","SAP NetWeaver Visual Composer","Broken Access Control in SAP NetWeaver Visual Composer","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-89108","SAP_SE","SAP Manufacturing Integration and Intelligence (Configuration Service)","Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-89107","SAP_SE","SAP S/4HANA (Manage Substitution/Validation Rules)","Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-89106","SAP_SE","SAPUI5","Cross Site Scripting (XSS) vulnerability in SAPUI5","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-89105","SAP_SE","SAP/cloud-security-services-integration-library","Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra","MEDIUM",4.2,"2026-10-13",0],["CVE-2026-76976","SAP_SE","SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)","Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-76975","SAP_SE","SAPUI5 (Support Assistant Overlay)","Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-76972","SAP_SE","SAP Manufacturing Integration and Intelligence","Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-58249","SAP_SE","SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)","Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic","HIGH",7.5,"2026-10-13",0],["CVE-2026-58242","SAP_SE","SAP Cloud Connector","Improper Authorization check in SAP Cloud Connector","LOW",3.5,"2026-10-13",0],["CVE-2026-108943","ModelTC","LightX2V","ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-108942","philz1337x","clarity-upscaler","philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html","MEDIUM",5.1,"2026-10-13",0],["CVE-2024-34319","","","A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v20","MEDIUM",6.5,"2026-10-13",0],["CVE-2024-34320","","","ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control ","CRITICAL",9.8,"2026-10-13",0],["CVE-2024-34321","","","ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip","MEDIUM",6.1,"2026-10-13",0],["CVE-2024-34323","","","ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Re","CRITICAL",10,"2026-10-13",0],["CVE-2024-34324","","","An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hija","CRITICAL",9.1,"2026-10-13",0],["CVE-2024-34326","","","ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-104584","","","reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-104585","","","Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_d","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-104587","","","blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerab","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-37107","","","An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-52394","","","DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.","CRITICAL",9.1,"2026-10-13",0],["CVE-2026-78799","","","Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd I","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-78802","","","An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-95114","","","libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser ","HIGH",7.5,"2026-10-13",0],["CVE-2026-95115","","","Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to c","HIGH",7.5,"2026-10-13",0],["CVE-2026-95117","","","Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to","","","2026-10-13",0],["CVE-2026-95121","","","An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::R","HIGH",7.8,"2026-10-13",0],["CVE-2026-95122","","","mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks()","HIGH",7.5,"2026-10-13",0],["CVE-2026-95124","","","Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to","HIGH",7.5,"2026-10-13",0],["CVE-2026-95127","","","An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ","","","2026-10-13",0],["CVE-2026-108941","Linketic","CityGaussian","Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection","LOW",2.4,"2026-10-13",0],["CVE-2026-108940","EricLBuehler","Mistral.rs","EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-17484","IBM","i","IBM i is Information Disclosure","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-17487","IBM","i","IBM i is Information Disclosure","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-18318","IBM","i","IBM i Information Disclosure","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-18343","IBM","i","IBM i is Affected By An Improper Privilege Management Vulnerability","MEDIUM",4.4,"2026-10-13",0],["CVE-2026-81858","IBM","i","IBM i is Affected By A Denial of Service Vulnerability in Host Servers","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-93886","IBM","i","IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Admi","HIGH",8.3,"2026-10-13",0],["CVE-2026-96119","IBM","i","IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server A","CRITICAL",9.9,"2026-10-13",0],["CVE-2026-19938","zephyrproject","zephyr","Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Co","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-19937","zephyrproject","zephyr","Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all mo","MEDIUM",5.7,"2026-10-13",0],["CVE-2026-19936","zephyrproject","zephyr","Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer d","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-108939","EricLBuehler","mistral.rs","EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108938","code-projects","Matrimonial System","code-projects Matrimonial System matrimony.sql file access","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-75076","IBM","Aspera Enterprise WebApps","IBM Aspera Enterprise Webapps Information Disclosure","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-75095","IBM","Aspera Enterprise WebApps","IBM Aspera Enterprise Webapps Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-75621","IBM","Aspera Enterprise WebApps","IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges","MEDIUM",6.2,"2026-10-13",0],["CVE-2026-75782","IBM","Aspera Enterprise WebApps","IBM Aspera Enterprise Webapps Untrusted Search Path","HIGH",7.8,"2026-10-13",0],["CVE-2026-92832","IBM","Aspera Enterprise WebApps","IBM Aspera Enterprise Webapps Information Disclosure","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-93891","IBM","TRIRIGA Application Platform","Security Vulnerability identified in IBM TRIRIGA - XXE","HIGH",7.6,"2026-10-13",0],["CVE-2026-93892","IBM","TRIRIGA Application Platform","Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console","HIGH",8.1,"2026-10-13",0],["CVE-2026-102627","IBM","TRIRIGA Application Platform","Security Vulnerability identified in IBM TRIRIGA - Zip Slip","HIGH",8.8,"2026-10-13",0],["CVE-2026-108937","code-projects","Online Ticket Reservation System","code-projects Online Ticket Reservation System medallion.sql file information disclosure","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-17475","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",7.1,"2026-10-13",0],["CVE-2026-18541","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","MEDIUM",6.4,"2026-10-13",0],["CVE-2026-19620","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",8.8,"2026-10-13",0],["CVE-2026-19622","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",8.8,"2026-10-13",0],["CVE-2026-75063","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","MEDIUM",5.4,"2026-10-13",0],["CVE-2026-75061","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",7.5,"2026-10-13",0],["CVE-2026-19627","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",8.2,"2026-10-13",0],["CVE-2026-85457","IBM","Planning Analytics","IBM Planning Analytics Local is affected by security vulnerabilities","HIGH",8.1,"2026-10-13",0],["CVE-2026-108936","Edimax","BR-6208AC","Edimax BR-6208AC QoS Page formQoS cross site scripting","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-82101","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Path Traversal","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-82103","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Information Disclosure","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-82110","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Path Traversal","CRITICAL",9.6,"2026-10-13",0],["CVE-2026-82096","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Command Injection","HIGH",8.8,"2026-10-13",0],["CVE-2026-82108","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Code Injection","HIGH",8.8,"2026-10-13",0],["CVE-2026-84418","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data Improper Certificate Validation","HIGH",7.4,"2026-10-13",0],["CVE-2026-109674","frappe","erpnext","Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109675","frappe","suite","Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109673","frappe","erpnext","Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names","HIGH",8.5,"2026-10-13",0],["CVE-2026-109671","frappe","erpnext","Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages","HIGH",8.5,"2026-10-13",0],["CVE-2026-109672","frappe","erpnext","Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109670","frappe","erpnext","Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109668","frappe","erpnext","Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109669","frappe","erpnext","Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modificati","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109667","frappe","erpnext","Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation","HIGH",8.7,"2026-10-13",0],["CVE-2026-109665","frappe","erpnext","Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109666","frappe","erpnext","Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109664","frappe","erpnext","Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109662","frappe","erpnext","Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109663","frappe","erpnext","Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters","HIGH",7.1,"2026-10-13",0],["CVE-2026-109661","frappe","erpnext","Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109659","frappe","erpnext","Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109660","frappe","erpnext","Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109657","frappe","erpnext","Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109658","frappe","erpnext","Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109656","frappe","erpnext","Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access","HIGH",7.1,"2026-10-13",0],["CVE-2026-109654","frappe","erpnext","Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109655","frappe","erpnext","Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109653","frappe","erpnext","Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover","HIGH",8.5,"2026-10-13",0],["CVE-2026-109651","frappe","erpnext","Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109652","frappe","erpnext","Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields","HIGH",8.7,"2026-10-13",0],["CVE-2026-109650","frappe","erpnext","Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109648","frappe","erpnext","Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109649","frappe","erpnext","Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests","HIGH",7.1,"2026-10-13",0],["CVE-2026-109647","frappe","erpnext","Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109645","frappe","erpnext","Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization","HIGH",7.1,"2026-10-13",0],["CVE-2026-109646","frappe","erpnext","Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109644","frappe","erpnext","Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109642","frappe","erpnext","Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109643","frappe","erpnext","Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109640","frappe","erpnext","Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio","HIGH",7.2,"2026-10-13",0],["CVE-2026-109641","frappe","erpnext","Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109639","frappe","erpnext","Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests","HIGH",7.1,"2026-10-13",0],["CVE-2026-109637","frappe","erpnext","Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification","HIGH",7.1,"2026-10-13",0],["CVE-2026-109638","frappe","erpnext","Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109636","frappe","erpnext","Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109634","frappe","erpnext","Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109635","frappe","erpnext","Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109633","frappe","erpnext","Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page","HIGH",8.6,"2026-10-13",0],["CVE-2026-109631","frappe","erpnext","Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109632","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109629","frappe","erpnext","Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109630","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109628","frappe","erpnext","Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization","HIGH",7.1,"2026-10-13",0],["CVE-2026-109626","frappe","erpnext","Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109627","frappe","erpnext","Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109625","frappe","erpnext","Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109623","frappe","erpnext","Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorizatio","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109624","frappe","erpnext","Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109622","frappe","erpnext","Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorizatio","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109617","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109621","frappe","erpnext","Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass","HIGH",7.1,"2026-10-13",0],["CVE-2026-109616","frappe","erpnext","Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification","HIGH",7.1,"2026-10-13",0],["CVE-2026-109614","frappe","erpnext","Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data","HIGH",7.1,"2026-10-13",0],["CVE-2026-109615","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints","HIGH",7.1,"2026-10-13",0],["CVE-2026-109613","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati","HIGH",7.1,"2026-10-13",0],["CVE-2026-109611","frappe","erpnext","Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109612","frappe","erpnext","Frappe ERPNext before 15.120.0 Stored XSS via Report View","HIGH",8.5,"2026-10-13",0],["CVE-2026-109610","frappe","erpnext","Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modifica","HIGH",7.1,"2026-10-13",0],["CVE-2026-109608","frappe","erpnext","Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input","HIGH",8.7,"2026-10-13",0],["CVE-2026-109609","frappe","erpnext","Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation","HIGH",7.1,"2026-10-13",0],["CVE-2026-109604","frappe","erpnext","ERPNext before 15.112.0 Stored XSS via Tool View Record Names","HIGH",8.5,"2026-10-13",0],["CVE-2026-109602","frappe","frappe","Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109603","frappe","frappe","Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-109601","frappe","frappe","Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML","HIGH",7.1,"2026-10-13",0],["CVE-2026-109599","frappe","frappe","Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109600","frappe","frappe","Frappe before 16.31.0 Improper Access Control in Document Follow Notifications","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-109598","frappe","frappe","Frappe before 16.33.0 Broken Authorization via send_sms Endpoint","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-109596","gohugoio","hugo","Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-109597","gohugoio","hugo","Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-109574","gohugoio","hugo","Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-109595","gohugoio","hugo","Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver","MEDIUM",6.7,"2026-10-13",0],["CVE-2026-109573","thorsten","phpMyFAQ","phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint","CRITICAL",9.2,"2026-10-13",0],["CVE-2026-109572","open-webui","open-webui","Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy","HIGH",7.2,"2026-10-13",0],["CVE-2025-71431","frappe","frappe","Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters","MEDIUM",6.3,"2026-10-13",0],["CVE-2025-71432","frappe","erpnext","Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover","HIGH",8.6,"2026-10-13",0],["CVE-2025-71430","frappe","frappe","Frappe before 15.91.1 Stored XSS via Leaderboard User Names","MEDIUM",5.1,"2026-10-13",0],["CVE-2024-58391","frappe","frappe","Frappe before 15.4.0 XSS via Printview Parameters","MEDIUM",5.3,"2026-10-13",0],["CVE-2024-58390","frappe","frappe","Frappe before 15.41.0 Privilege Escalation via Document Action","HIGH",8.7,"2026-10-13",0],["CVE-2023-54412","frappe","frappe","Frappe before 13.46.3 Improper Access Control for Email Templates","HIGH",7.1,"2026-10-13",0],["CVE-2023-54410","frappe","frappe","Frappe before 13.22.0 Improper Authorization via Document Rename","MEDIUM",5.3,"2026-10-13",0],["CVE-2023-54411","frappe","frappe","Frappe before 13.32.0 Weak Authentication via Print View Key","HIGH",8.2,"2026-10-13",0],["CVE-2023-54409","frappe","frappe","Frappe before 13.46.1 XSS via html2text Weak Sanitization","MEDIUM",5.9,"2026-10-13",0],["CVE-2023-54407","frappe","frappe","Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks","MEDIUM",6.9,"2026-10-13",0],["CVE-2023-54408","frappe","frappe","Frappe before 14.31.0 HTML Injection via Weak Escaping","MEDIUM",5.1,"2026-10-13",0],["CVE-2023-54406","frappe","frappe","Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts","MEDIUM",6.9,"2026-10-13",0],["CVE-2026-108935","Edimax","BR-6208AC","Edimax BR-6208AC Port Forwarding formPortFw cross site scripting","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-108934","Edimax","BR-6208AC","Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-102596","NangoHQ","nango","Nango: Production flow RBAC bypass on private flow-read routes","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-44828","Qexo","Qexo","Qexo initialization endpoint can reset setup state and expose stored credentials","CRITICAL",9.3,"2026-10-13",0],["CVE-2026-54459","error311","FileRise","FileRise: Missing CSRF enforcement for file creation and share-link creation","MEDIUM",4.3,"2026-10-13",0],["CVE-2026-104140","qgis","QGIS","QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values","MEDIUM",6.1,"2026-10-13",0],["CVE-2026-108933","Edimax","BR-6208AC","Edimax BR-6208AC formFilter cross site scripting","MEDIUM",4.8,"2026-10-13",0],["CVE-2026-90911","IBM","Maximo AI Service","Maximo AI Service Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-90912","IBM","Maximo AI Service","Maximo AI Service Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-90920","IBM","Maximo AI Service","Maximo AI Service Code Injection","CRITICAL",9.8,"2026-10-13",0],["CVE-2026-90921","IBM","Maximo AI Service","Maximo AI Service Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-92876","IBM","Maximo Application Suite - IoT Component","IBM Maximo Application Suite - IoT Component Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-49484","codefori","vscode-ibmi","Code for IBM i: Temporary files are visible to all users","MEDIUM",5.1,"2026-10-13",0],["CVE-2026-49483","codefori","vscode-ibmi","Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution","HIGH",8.9,"2026-10-13",0],["CVE-2026-53922","openwrt","odhcpd","odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canar","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-108932","Netcore","NR268","Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-41210","moonlight-stream","moonlight-qt","Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-103658","GNU","Aspell","GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer o","MEDIUM",5.9,"2026-10-13",0],["CVE-2026-102539","super-productivity","super-productivity","Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plainte","MEDIUM",5.7,"2026-10-13",0],["CVE-2026-84312","0xJacky","nginx-ui","Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)","HIGH",7.1,"2026-10-13",0],["CVE-2026-84360","0xJacky","nginx-ui","Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools","HIGH",8.1,"2026-10-13",0],["CVE-2026-84316","0xJacky","nginx-ui","Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line","HIGH",8.8,"2026-10-13",0],["CVE-2026-84319","0xJacky","nginx-ui","Nginx UI: MCP configuration tools bypass restricted directive validation and allow seconda","HIGH",8.3,"2026-10-13",0],["CVE-2026-18513","IBM","Maximo Application Suite - Location Service for Esri Component","IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Mana","HIGH",7.2,"2026-10-13",0],["CVE-2026-18517","IBM","Maximo Application Suite - Location Service for Esri Component","IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control","HIGH",7.7,"2026-10-13",0],["CVE-2026-18529","IBM","Maximo Application Suite - Location Service for Esri Component","IBM Maximo Application Suite - Location Service for Esri Component Code Execution","HIGH",8.7,"2026-10-13",0],["CVE-2026-18533","IBM","Maximo Application Suite - Location Service for Esri Component","IBM Maximo Application Suite - Location Service for Esri Component Code Execution","MEDIUM",6.5,"2026-10-13",0],["CVE-2026-18537","IBM","Maximo Application Suite - Location Service for Esri Component","IBM Maximo Application Suite - Location Service for Esri Component Code Execution","HIGH",8.7,"2026-10-13",0],["CVE-2026-75881","IBM","Maximo Application Suite - IoT Component","IBM Maximo Application Suite - IoT Component Denial of Service","HIGH",7.5,"2026-10-13",0],["CVE-2026-78673","IBM","Maximo AI Service","Maximo AI Service Improper Input Validation","HIGH",7.5,"2026-10-13",0],["CVE-2026-105052","IBM","Maximo Application Suite","IBM Maximo Application Suite Information Disclosure","HIGH",7.5,"2026-10-13",0],["CVE-2026-108931","Netcore","NR268","Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting","MEDIUM",5.3,"2026-10-13",0],["CVE-2026-84317","0xJacky","nginx-ui","Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx dir","HIGH",8.8,"2026-10-12",0],["CVE-2026-109571","Fire-Boltt","BSW013","Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE","LOW",2.3,"2026-10-12",0],["CVE-2026-109570","Fire-Boltt","BSW013","Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109568","MarceauKa","Shaark","Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes","HIGH",7.1,"2026-10-12",0],["CVE-2026-109569","Th0rgal","sandboxed.sh","sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace","CRITICAL",9.3,"2026-10-12",0],["CVE-2026-109567","zofe","rapyd-admin","Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component","HIGH",8.6,"2026-10-12",0],["CVE-2026-109566","zofe","rapyd-admin","Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder","CRITICAL",9.3,"2026-10-12",0],["CVE-2026-109565","zofe","rapyd-admin","Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109564","learnhouse","LearnHouse","LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint","LOW",2.3,"2026-10-12",0],["CVE-2026-109562","snapotter-hq","SnapOtter","SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109563","rdfjs","N3.js","N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex","HIGH",8.7,"2026-10-12",0],["CVE-2026-109561","aaif-goose","goose","goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations","LOW",2.3,"2026-10-12",0],["CVE-2026-109559","tianma-if","EdgeEver","EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate","HIGH",8.4,"2026-10-12",0],["CVE-2026-109560","continuedev","continue","Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining","HIGH",7.7,"2026-10-12",0],["CVE-2026-109557","tianma-if","EdgeEver","EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview","HIGH",8.4,"2026-10-12",0],["CVE-2026-109558","tianma-if","EdgeEver","EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview","HIGH",8.5,"2026-10-12",0],["CVE-2026-109556","tianma-if","EdgeEver","EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC","HIGH",7.3,"2026-10-12",0],["CVE-2026-109379","cockpit-hq","cockpit","Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109380","ayuhito","modern-tar","modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field","HIGH",8.7,"2026-10-12",0],["CVE-2026-109378","SPIP","SPIP","SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109376","Frappe","ERPNext","ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109377","Frappe","ERPNext","ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109375","Vercel","deepsec","Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extractio","MEDIUM",4.9,"2026-10-12",0],["CVE-2024-58389","HoloViz","Panel","HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter","MEDIUM",5.1,"2026-10-12",0],["CVE-2025-71429","RVC-Boss","GPT-SoVITS","GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py","CRITICAL",9.3,"2026-10-12",0],["CVE-2022-51020","mher","flower","Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints","MEDIUM",6,"2026-10-12",0],["CVE-2021-48011","lukejacksonn","servor","Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments","HIGH",8.7,"2026-10-12",0],["CVE-2021-48012","Gin-Quin","fast-toml","fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML","HIGH",8.8,"2026-10-12",0],["CVE-2020-37280","PelionIoT","cbor-sync","cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths","HIGH",8.7,"2026-10-12",0],["CVE-2020-37279","karuppiah7890","easy-pdf-merge","easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-16678","IBM","Virtualization Management Interface","IBM Power Systems Firmware Denial of Service","MEDIUM",4.5,"2026-10-12",0],["CVE-2026-96261","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Buffer Overflow","HIGH",7.3,"2026-10-12",0],["CVE-2026-96262","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Buffer Overflow","HIGH",8.2,"2026-10-12",0],["CVE-2026-96263","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Buffer Overflow","HIGH",8.2,"2026-10-12",0],["CVE-2026-96264","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Buffer Overflow","HIGH",8.2,"2026-10-12",0],["CVE-2026-96265","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Improper Memory Buffer Restriction","HIGH",8.2,"2026-10-12",0],["CVE-2026-96266","IBM","PowerVM Hypervisor","IBM Power Systems Firmware Buffer Overflow","HIGH",8.2,"2026-10-12",0],["CVE-2026-84313","0xJacky","nginx-ui","Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent acco","HIGH",8.8,"2026-10-12",0],["CVE-2026-84321","0xJacky","nginx-ui","Nginx UI: Standalone short tokens survive administrative revocation in cache and authentic","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-53997","NetHerman","Portal del Hermano (portaldelhermano.es)","Netherman Portal del Hermano Account Takeover via Password Reset Oracle","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-84314","0xJacky","nginx-ui","Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint","HIGH",8.7,"2026-10-12",0],["CVE-2026-108930","Netcore","NR268","Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-84320","0xJacky","nginx-ui","Nginx UI: Auto backup name allows path traversal outside validated storage path","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109427","weebzone","Telegram-Stremio","Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs","HIGH",7.1,"2026-10-12",0],["CVE-2026-109426","weebzone","Telegram-Stremio","Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string","HIGH",8.2,"2026-10-12",0],["CVE-2026-108929","Netcore","NR268","Netcore NR268 DDNS DDNSset.cgi execvp argument injection","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-84318","0xJacky","nginx-ui","Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE","HIGH",8.8,"2026-10-12",0],["CVE-2026-108928","itsourcecode","Online Admission System","itsourcecode Online Admission System sum.php sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-97691","get-convex","convex-backend","Convex: Unauthorized data access","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-106495","backstage","backstage","Backstage: Improper access control in backend action invocation","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-92120","Apache Software Foundation","Apache Allura","Apache Allura: Oauth1 Replay Attack","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-92119","Apache Software Foundation","Apache Allura","Apache Allura: REST API Mass Assignment","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-84315","0xJacky","nginx-ui","Nginx UI OTP secure-session step-up is missing on sensitive mutation routes","HIGH",8.3,"2026-10-12",0],["CVE-2026-92116","Apache Software Foundation","Apache Allura","Apache Allura: OAuth1 missing callback validation","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-41508","corazawaf","coraza","OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) v","MEDIUM",5.8,"2026-10-12",0],["CVE-2026-108927","itsourcecode","Baptism Information Management System","itsourcecode Baptism Information Management System pbaptism.php sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-41504","corazawaf","coraza","OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via reques","MEDIUM",5.8,"2026-10-12",0],["CVE-2026-104774","corazawaf","coraza","OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass","MEDIUM",5.8,"2026-10-12",0],["CVE-2026-41510","corazawaf","coraza","OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rul","HIGH",7.2,"2026-10-12",0],["CVE-2026-109425","tink-crypto","tink-go","Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-95838","containerd","containerd","containerd: Unpack DoS via repeated opaque whiteouts","MEDIUM",4.6,"2026-10-12",0],["CVE-2026-108926","itsourcecode","Baptism Information Management System","itsourcecode Baptism Information Management System ebaptism.php sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-95837","containerd","containerd","containerd CRI plugin: Checkpoint restore bypasses destination security context","HIGH",7.8,"2026-10-12",0],["CVE-2026-109424","NetEase","NetEase Cloud Music for Windows","NetEase Cloud Music Weak Encryption via eapi/xeapi","HIGH",8.2,"2026-10-12",0],["CVE-2026-109423","NetEase","NetEase Cloud Music for Windows","NetEase Cloud Music TLS Certificate Validation Bypass","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-109422","NetEase","NetEase Cloud Music for Windows","NetEase Cloud Music RCE via os.navigateExternal IPC","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-109575","HAProxy","Data Plane API EE","In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releas","CRITICAL",9.8,"2026-10-12",0],["CVE-2026-96012","IBM","Db2 Mirror for i","IBM Db2 Mirror for i Privilege Escalation","CRITICAL",9.9,"2026-10-12",0],["CVE-2026-108924","getkirby","Kirby","getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-104364","IBM","Db2","IBM® Db2® Denial of Service","LOW",3.3,"2026-10-12",0],["CVE-2026-104332","IBM","Db2","IBM® Db2® Denial of Service","MEDIUM",5.5,"2026-10-12",0],["CVE-2026-108923","1024-lab","smart-admin","1024-lab smart-admin Support Config Query queryByKey access control","MEDIUM",5.3,"2026-10-12",0],["CVE-2025-27895","IBM","DB2 Recovery Expert for Linux, UNIX and Windows","DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting","MEDIUM",6.1,"2026-10-12",0],["CVE-2025-27896","IBM","DB2 Recovery Expert for Linux, UNIX and Windows","IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-108361","Privasys","ra-tls-clients","Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks","HIGH",7.2,"2026-10-12",0],["CVE-2026-108362","Privasys","ra-tls-clients","Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)","CRITICAL",9.1,"2026-10-12",0],["CVE-2025-27897","IBM","DB2 Recovery Expert for Linux, UNIX and Windows","IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting","MEDIUM",6.1,"2026-10-12",0],["CVE-2025-27902","IBM","DB2 Recovery Expert for Linux, UNIX and Windows","IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-108922","KusalkaSilva","Learning-Management-System","KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-65954","PHPCSStandards","PHPCSUtils","PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualAr","HIGH",8.6,"2026-10-12",0],["CVE-2026-83535","Red Hat","Red Hat OpenStack Platform 18.0","Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-ti","HIGH",7.4,"2026-10-12",0],["CVE-2026-83536","Red Hat","Red Hat OpenStack Platform 18.0","Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-85471","Red Hat","mirror registry for Red Hat OpenShift","Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable","MEDIUM",6.4,"2026-10-12",0],["CVE-2026-102663","OpenListTeam","OpenList","OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Sea","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-57118","MervinPraison","PraisonAI","PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation end","CRITICAL",9.8,"2026-10-12",0],["CVE-2026-57143","MervinPraison","praisonaiagents","PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-c","HIGH",8.8,"2026-10-12",0],["CVE-2026-18166","IBM","Db2","IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allow","HIGH",7.7,"2026-10-12",0],["CVE-2026-105464","IBM","Db2","IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated priv","HIGH",8.8,"2026-10-12",0],["CVE-2026-108921","KusalkaSilva","Learning-Management-System","KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php ","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-89140","Temporal Technologies, Inc.","Temporal Server","Temporal Server internal completion callbacks are not bound to their namespace, allowing c","MEDIUM",6,"2026-10-12",0],["CVE-2026-104355","Temporal Technologies, Inc.","Temporal Server","Temporal Server applies inbound namespace replication from a connected peer cluster to loc","HIGH",7,"2026-10-12",0],["CVE-2026-105466","IBM","Db2","IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML column","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-87744","Red Hat","Red Hat build of Quarkus 3.27.6.redhat","Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest ","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-105465","IBM","Db2","IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instan","HIGH",8.8,"2026-10-12",0],["CVE-2026-78404","IBM","Db2","IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-59976","C4illin","ConvertX","ConvertX: Path Traversal vulnerability leading to Arbitrary File Write","HIGH",8.1,"2026-10-12",0],["CVE-2026-59977","C4illin","ConvertX","ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction","HIGH",8.1,"2026-10-12",0],["CVE-2026-107226","AsyncHttpClient","async-http-client","AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secur","MEDIUM",6.8,"2026-10-12",0],["CVE-2026-104102","9001","copyparty","copyparty FTP: upload outside defined volumes (limited path traversal)","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108920","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site s","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-103061","Gleam","Gleam","Path traversal in Gleam via unvalidated package application names","MEDIUM",5.9,"2026-10-12",0],["CVE-2026-108919","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Student Registration add_student.php cross site ","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108918","Edimax","BR-6208AC","Edimax BR-6208AC formWlanMP command injection","CRITICAL",10,"2026-10-12",0],["CVE-2026-77366","The-40-Thieves","obsidian-tc","obsidian-tc tokens can access arbitrary configured vaults","CRITICAL",9.9,"2026-10-12",0],["CVE-2026-77364","The-40-Thieves","obsidian-tc","obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-61994","RocketGeek","WP-Members","WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-42689","Pixelite","Events Manager","WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","LOW",3.7,"2026-10-12",0],["CVE-2026-77363","The-40-Thieves","obsidian-tc","obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access","HIGH",8.8,"2026-10-12",0],["CVE-2026-108917","Edimax","BR-6208AC","Edimax BR-6208AC formAutoFWupgrade command injection","CRITICAL",10,"2026-10-12",0],["CVE-2026-109448","PostgreSQL","psqlODBC","psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters","MEDIUM",5.9,"2026-10-12",0],["CVE-2026-108479","Patreon","Patreon WordPress","WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerabi","HIGH",8.1,"2026-10-12",0],["CVE-2026-108481","Patreon","Patreon WordPress","WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerabi","HIGH",7.4,"2026-10-12",0],["CVE-2026-103080","VillaTheme","Salevo","WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108916","Edimax","BR-6208AC","Edimax BR-6208AC formAccept command injection","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-6232","Semtech","LR1110 Transceiver","Out-of-bounds write in LR11xx Transceiver","MEDIUM",5.2,"2026-10-12",0],["CVE-2026-108915","Edimax","BR-6208AC","Edimax BR-6208AC formWlanMP buffer overflow","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-108482","LeapWorx","Premium Addons for Elementor","WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vul","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-107862","ExpressTech","Quiz And Survey Master","WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerabili","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108486","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107418","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-108478","BdThemes","Element Pack Elementor Addons","WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulne","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108475","VideoWhisper.com","Broadcast Live Video","WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-108476","VideoWhisper.com","Paid Videochat Turnkey Site","WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerabili","MEDIUM",5,"2026-10-12",0],["CVE-2026-84286","Turboderp-org","ExLlamaV3","OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table","CRITICAL",9.8,"2026-10-12",0],["CVE-2026-108914","Edimax","BR-6208AC","Edimax BR-6208AC formWlSiteSurvey buffer overflow","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-85976","Progress Software Corporation","MarkLogic Server","HTTP response splitting in Progress MarkLogic Server Query Console","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-85975","Progress Software Corporation","MarkLogic Server","Cleartext transmission in Progress MarkLogic Server Amazon S3 connections","HIGH",7.5,"2026-10-12",0],["CVE-2026-85974","Progress Software Corporation","MarkLogic Server","Improper TLS hostname verification in Progress MarkLogic Server","HIGH",7.4,"2026-10-12",0],["CVE-2026-85973","Progress Software Corporation","MarkLogic Server","Cleartext transmission in Progress MarkLogic Server cluster join operations","HIGH",7.4,"2026-10-12",0],["CVE-2026-108909","Netcore","NR268","Netcore NR268 CGI Endpoint cross-site request forgery","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-105274","erlang","rebar3","hex_core decompresses registry and Erlang term API responses without size limits","LOW",2.1,"2026-10-12",0],["CVE-2026-85972","Progress Software Corporation","MarkLogic Server","Improper Kerberos server verification in Progress MarkLogic Server","HIGH",7.4,"2026-10-12",0],["CVE-2026-85971","Progress Software Corporation","MarkLogic Server","Incorrect log file permissions in Progress MarkLogic Server","HIGH",7.1,"2026-10-12",0],["CVE-2026-85970","Progress Software Corporation","MarkLogic Server","Improper XML external entity restriction in Progress MarkLogic Server","HIGH",7.1,"2026-10-12",0],["CVE-2026-85969","Progress Software Corporation","MarkLogic Server","Out-of-bounds write in Progress MarkLogic Server","HIGH",7.1,"2026-10-12",0],["CVE-2026-85968","Progress Software Corporation","MarkLogic Server","Out-of-bounds read in Progress MarkLogic Server","HIGH",7.1,"2026-10-12",0],["CVE-2026-75888","Red Hat","Red Hat OpenShift Container Platform 4.14","Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch","HIGH",7.7,"2026-10-12",0],["CVE-2026-85967","Progress Software Corporation","MarkLogic Server","Cross-site scripting in Progress MarkLogic Server","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-108477","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-85966","Progress Software Corporation","MarkLogic Server","Exposure of sensitive information in Progress MarkLogic Server","HIGH",7.7,"2026-10-12",0],["CVE-2026-108908","Netcore","NR268","Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-85965","Progress Software Corporation","MarkLogic Server","Use-after-free in Progress MarkLogic Server JavaScript engine integration","HIGH",8,"2026-10-12",0],["CVE-2026-85964","Progress Software Corporation","MarkLogic Server","Path traversal in Progress MarkLogic Server Query Console","HIGH",7.7,"2026-10-12",0],["CVE-2026-85963","Progress Software Corporation","MarkLogic Server","Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector","HIGH",7.5,"2026-10-12",0],["CVE-2026-94451","Red Hat","Red Hat build of Quarkus 3.27.6.redhat","Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: informat","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108907","Netcore","NR268","Netcore NR268 CGI Execution user_ok improper authentication","CRITICAL",10,"2026-10-12",0],["CVE-2026-85962","Progress Software Corporation","MarkLogic Server","Improper authentication in Progress MarkLogic Server SAML processing","HIGH",7.5,"2026-10-12",0],["CVE-2026-85961","Progress Software Corporation","MarkLogic Server","Sensitive information exposure in Progress MarkLogic Server Azure deployments","HIGH",7.5,"2026-10-12",0],["CVE-2026-85960","Progress Software Corporation","MarkLogic Server","Cross-site request forgery in Progress MarkLogic Server Query Console","HIGH",7.5,"2026-10-12",0],["CVE-2026-85959","Progress Software Corporation","MarkLogic Server","Insufficient authentication logging in Progress MarkLogic Server","HIGH",7.5,"2026-10-12",0],["CVE-2026-109374","zitadel","zitadel","ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-109373","zitadel","zitadel","ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-109371","zitadel","zitadel","ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1","HIGH",8.8,"2026-10-12",0],["CVE-2026-109372","zitadel","zitadel","ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion","CRITICAL",9.3,"2026-10-12",0],["CVE-2026-109366","ZcashFoundation","zebra","Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109364","ZcashFoundation","zebra","Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109365","ZcashFoundation","zebra","Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109363","ZcashFoundation","zebra","Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction","HIGH",8.7,"2026-10-12",0],["CVE-2026-109361","Project-MONAI","MONAI","MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_fi","HIGH",7,"2026-10-12",0],["CVE-2026-109362","heymrun","heym","Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109360","Project-MONAI","MONAI","MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP","HIGH",7.7,"2026-10-12",0],["CVE-2026-109358","edgelesssys","contrast","Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege E","HIGH",8.5,"2026-10-12",0],["CVE-2026-109359","edgelesssys","contrast","Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery","HIGH",8.7,"2026-10-12",0],["CVE-2026-109356","librenms","librenms","LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109357","librenms","librenms","LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Heade","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-109355","librenms","librenms","LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109353","librenms","librenms","LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php","HIGH",7.1,"2026-10-12",0],["CVE-2026-109354","librenms","librenms","LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109352","librenms","librenms","LibreNMS before 26.9.0 Stored XSS via wireless sensor description","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109350","GitoxideLabs","gix-pack","Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance","HIGH",7.1,"2026-10-12",0],["CVE-2026-109351","GitoxideLabs","gix-pack","Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count","HIGH",7.1,"2026-10-12",0],["CVE-2026-109349","GitoxideLabs","gix-pack","gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header","HIGH",7.1,"2026-10-12",0],["CVE-2026-109347","vrana","adminer","Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass","HIGH",8.6,"2026-10-12",0],["CVE-2026-109348","GitoxideLabs","gix-mailmap","Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109346","better-auth","better-auth","better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device","HIGH",8.5,"2026-10-12",0],["CVE-2026-109344","cure53","DOMPurify","DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-109345","cure53","DOMPurify","DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-109343","surrealdb","surrealdb","SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement","HIGH",8.6,"2026-10-12",0],["CVE-2026-109341","surrealdb","surrealdb","SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations","HIGH",7.1,"2026-10-12",0],["CVE-2026-109342","surrealdb","surrealdb","SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109340","surrealdb","surrealdb","SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109338","surrealdb","surrealdb","SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values","HIGH",7.1,"2026-10-12",0],["CVE-2026-109339","surrealdb","surrealdb","SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109337","surrealdb","surrealdb","SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109335","surrealdb","surrealdb","SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields","HIGH",7.1,"2026-10-12",0],["CVE-2026-109336","surrealdb","surrealdb","SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109334","surrealdb","surrealdb","SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use","HIGH",8.6,"2026-10-12",0],["CVE-2026-109332","Jovancoding","Network-AI","Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport","LOW",2.3,"2026-10-12",0],["CVE-2026-109333","surrealdb","surrealdb","SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH","HIGH",7.1,"2026-10-12",0],["CVE-2026-109331","Jovancoding","Network-AI","Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget","HIGH",7.5,"2026-10-12",0],["CVE-2026-109329","Admidio","admidio","Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Byp","HIGH",8.5,"2026-10-12",0],["CVE-2026-109330","Jovancoding","Network-AI","Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109328","Admidio","admidio","Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109326","getgrav","grav","Grav before 2.1.7 Information Disclosure via Nested .git Directories","HIGH",8.7,"2026-10-12",0],["CVE-2026-109327","Admidio","admidio","Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.ph","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-109325","getgrav","grav","Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy","HIGH",8.7,"2026-10-12",0],["CVE-2026-109324","getgrav","grav","Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms","HIGH",7.1,"2026-10-12",0],["CVE-2026-109322","getgrav","grav-plugin-guestbook","Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109323","getgrav","grav-plugin-star-ratings","Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109321","getgrav","grav-plugin-login-oauth","Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass","CRITICAL",9.3,"2026-10-12",0],["CVE-2026-109319","getgrav","grav-plugin-guestbook","Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109320","getgrav","grav-plugin-api","Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109318","trilbymedia","grav-plugin-git-sync","Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author","HIGH",8.7,"2026-10-12",0],["CVE-2026-109316","getgrav","grav-plugin-data-manager","Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109317","getgrav","grav-plugin-api","Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants","HIGH",8.6,"2026-10-12",0],["CVE-2026-109315","getgrav","grav","Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox","HIGH",7.1,"2026-10-12",0],["CVE-2026-109313","getgrav","grav-plugin-login","Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie","HIGH",8.6,"2026-10-12",0],["CVE-2026-109314","getgrav","grav-plugin-login","Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page","HIGH",8.5,"2026-10-12",0],["CVE-2026-109312","getgrav","grav-plugin-login","Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form","HIGH",8.6,"2026-10-12",0],["CVE-2026-109310","siyuan-note","siyuan","SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template","HIGH",7.1,"2026-10-12",0],["CVE-2026-109311","vllm-project","vllm","vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload","HIGH",7.1,"2026-10-12",0],["CVE-2026-109309","siyuan-note","siyuan","SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109307","craftcms","cms","Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification","LOW",2.1,"2026-10-12",0],["CVE-2026-109308","craftcms","cms","Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior","HIGH",8.7,"2026-10-12",0],["CVE-2026-109306","craftcms","cms","Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition","MEDIUM",6,"2026-10-12",0],["CVE-2026-109305","craftcms","cms","Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every","HIGH",8.7,"2026-10-12",0],["CVE-2026-109303","parse-community","parse-server","Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Rel","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109304","craftcms","cms","Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109302","parse-community","parse-server","Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosur","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109300","open-webui","open-webui","Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-109301","parse-community","parse-server","Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Poin","HIGH",8.2,"2026-10-12",0],["CVE-2026-109299","open-webui","open-webui","Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation","HIGH",7.1,"2026-10-12",0],["CVE-2026-109297","open-webui","open-webui","Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules","HIGH",7.1,"2026-10-12",0],["CVE-2026-109298","open-webui","open-webui","Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex","HIGH",7.1,"2026-10-12",0],["CVE-2026-109296","open-webui","open-webui","Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109294","open-webui","open-webui","Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image","HIGH",7.1,"2026-10-12",0],["CVE-2026-109295","open-webui","open-webui","Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109293","open-webui","open-webui","Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint","HIGH",7.1,"2026-10-12",0],["CVE-2026-109291","open-webui","open-webui","Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url","HIGH",8.5,"2026-10-12",0],["CVE-2026-109292","open-webui","open-webui","Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections","HIGH",7.6,"2026-10-12",0],["CVE-2026-109289","open-webui","open-webui","Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109290","open-webui","open-webui","Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview","HIGH",8.4,"2026-10-12",0],["CVE-2026-109288","open-webui","open-webui","Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links","HIGH",7.2,"2026-10-12",0],["CVE-2026-109287","open-webui","open-webui","Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109286","open-webui","open-webui","Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal","HIGH",8.6,"2026-10-12",0],["CVE-2026-109285","open-webui","open-webui","Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata","LOW",2.3,"2026-10-12",0],["CVE-2026-109283","open-webui","open-webui","Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109284","open-webui","open-webui","Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109282","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and ","LOW",2,"2026-10-12",0],["CVE-2026-109280","ImageMagick","ImageMagick","ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option","LOW",2,"2026-10-12",0],["CVE-2026-109281","ImageMagick","ImageMagick","ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-109279","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent S","LOW",2,"2026-10-12",0],["CVE-2026-109277","ImageMagick","ImageMagick","ImageMagick before 7.1.2-32 Policy Bypass via -script Operation","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-109278","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operat","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109276","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109274","ImageMagick","ImageMagick","ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script","LOW",2,"2026-10-12",0],["CVE-2026-109275","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109273","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript ","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109271","ImageMagick","ImageMagick","ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109272","ImageMagick","ImageMagick","ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109270","ImageMagick","ImageMagick","ImageMagick before 7.1.2-32 Memory Leak via -process Option","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-109268","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109269","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decod","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109267","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109266","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP Encoder","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109264","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109265","ImageMagick","ImageMagick","ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109263","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109261","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109262","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109260","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-109259","ImageMagick","ImageMagick","ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109257","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure","HIGH",8.2,"2026-10-12",0],["CVE-2026-109258","ImageMagick","ImageMagick","ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation","LOW",2,"2026-10-12",0],["CVE-2026-109256","FreeRDP","FreeRDP","FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion","MEDIUM",6,"2026-10-12",0],["CVE-2026-109254","FreeRDP","FreeRDP","FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path","MEDIUM",6,"2026-10-12",0],["CVE-2026-109255","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-109253","FreeRDP","FreeRDP","FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read","MEDIUM",6,"2026-10-12",0],["CVE-2026-109251","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry","MEDIUM",6,"2026-10-12",0],["CVE-2026-109252","FreeRDP","FreeRDP","FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAM","MEDIUM",6,"2026-10-12",0],["CVE-2026-109250","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()","HIGH",7,"2026-10-12",0],["CVE-2026-109248","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109249","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing","MEDIUM",6.8,"2026-10-12",0],["CVE-2026-109246","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU","HIGH",7.1,"2026-10-12",0],["CVE-2026-109247","FreeRDP","FreeRDP","FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName","LOW",2.1,"2026-10-12",0],["CVE-2026-109245","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request","HIGH",7.4,"2026-10-12",0],["CVE-2026-109244","FreeRDP","FreeRDP","FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert","MEDIUM",6.8,"2026-10-12",0],["CVE-2026-109242","FreeRDP","FreeRDP","FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive","HIGH",7.1,"2026-10-12",0],["CVE-2026-109243","FreeRDP","FreeRDP","FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File","MEDIUM",4.1,"2026-10-12",0],["CVE-2026-109240","FreeRDP","FreeRDP","FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer","LOW",2.3,"2026-10-12",0],["CVE-2026-109241","FreeRDP","FreeRDP","FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel","LOW",2.3,"2026-10-12",0],["CVE-2026-109239","unclecode","crawl4ai","Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109237","unclecode","crawl4ai","Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables","HIGH",8.6,"2026-10-12",0],["CVE-2026-109238","unclecode","crawl4ai","Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-85958","Progress Software Corporation","MarkLogic Server","Improper OAuth token validation in Progress MarkLogic Server","HIGH",7.5,"2026-10-12",0],["CVE-2026-85957","Progress Software Corporation","MarkLogic Server","Improper XML external entity restriction in Progress MarkLogic Server SAML processing","HIGH",7.5,"2026-10-12",0],["CVE-2026-85956","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server backup and restore operations","CRITICAL",9.6,"2026-10-12",0],["CVE-2026-108906","Netcore","NR268","Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds","HIGH",8.6,"2026-10-12",0],["CVE-2026-85955","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server xdmp:eval-in","CRITICAL",9.9,"2026-10-12",0],["CVE-2026-85954","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server higher-order XQuery functions","HIGH",8.6,"2026-10-12",0],["CVE-2026-85953","Progress Software Corporation","MarkLogic Server","Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio","HIGH",8.5,"2026-10-12",0],["CVE-2026-85952","Progress Software Corporation","MarkLogic Server","Server-side request forgery in Progress MarkLogic Server Linux cloud deployments","HIGH",8.5,"2026-10-12",0],["CVE-2026-85951","Progress Software Corporation","MarkLogic Server","Server-side request forgery in Progress MarkLogic Server Azure deployments","HIGH",8.5,"2026-10-12",0],["CVE-2026-81856","hexpm","hex","Terminal escape sequence injection in Hex via unneutralized server-supplied output","LOW",2.3,"2026-10-12",0],["CVE-2026-108901","Shenzhen HCC Technology","MPOS M6 PLUS","Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-103060","erlang","rebar3","Path traversal in rebar3 via unvalidated dependency app names","HIGH",7.5,"2026-10-12",0],["CVE-2026-85950","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server REST extensions","HIGH",8.4,"2026-10-12",0],["CVE-2026-96612","hexpm","hex","Path traversal in Hex via unvalidated dependency app names","HIGH",7.5,"2026-10-12",0],["CVE-2026-85949","Progress Software Corporation","MarkLogic Server","Sensitive information exposure in Progress MarkLogic Server trace logs","HIGH",8.1,"2026-10-12",0],["CVE-2026-85948","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server Management API","CRITICAL",9.9,"2026-10-12",0],["CVE-2026-85947","Progress Software Corporation","MarkLogic Server","Improper privilege management in Progress MarkLogic Server forest operations","CRITICAL",9.9,"2026-10-12",0],["CVE-2026-9191","Progress Software Corporation","MarkLogic Server","Insufficient isolation of user-supplied code in Progress MarkLogic Server","CRITICAL",9.6,"2026-10-12",0],["CVE-2026-105668","hexpm","hex","Hex release-age cooldown is lifted package-wide when the locked release is retired","HIGH",7.1,"2026-10-12",0],["CVE-2026-108900","Exponent","CMS","Exponent CMS XML-RPC xmlrpc.php userLogin sql injection","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-105280","hexpm","hex","Hex writes unverified package tarballs to standard output in mix hex.package fetch","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-96618","hexpm","hex","Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror","LOW",2.1,"2026-10-12",0],["CVE-2026-109194","Red Hat","Red Hat Quay 3","Quay: build trigger uuid idor in quay api","MEDIUM",6.4,"2026-10-12",0],["CVE-2026-109195","Red Hat","Red Hat Quay 3","Quay: repository auto-prune policy uuid idor in quay api","LOW",3.1,"2026-10-12",0],["CVE-2026-103503","hexpm","hex","Hex trusts its bundled CA certificates when cacerts_path is set","MEDIUM",5.9,"2026-10-12",0],["CVE-2026-109399","sbabic","swupdate","SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-109397","Thelia","Thelia","Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space","HIGH",8.6,"2026-10-12",0],["CVE-2026-109398","gumlet","php-image-resize","Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs","HIGH",8.7,"2026-10-12",0],["CVE-2026-109394","thirty bees","thirty bees","Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-109396","Thelia","Thelia","Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports","LOW",2.3,"2026-10-12",0],["CVE-2026-109393","Webkul","QloApps","QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109391","Square","Squash","Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolicatio","CRITICAL",9.2,"2026-10-12",0],["CVE-2026-109392","Pimcore","Pimcore","Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108899","tobychui","zoraxy","tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authoriza","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-92681","Neo4j","@neo4j/graphql","@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cyp","CRITICAL",9.3,"2026-10-12",0],["CVE-2026-92682","Neo4j","@neo4j/graphql","@neo4j/graphql: authorization relationship and connection filters invert the \"none\" quanti","HIGH",8.6,"2026-10-12",0],["CVE-2026-107248","Thelia","Thelia","CVE-2026-107248","HIGH",8.8,"2026-10-12",0],["CVE-2026-108898","Netis","WF2409E","Netis WF2409E Wireless Settings cross site scripting","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-103537","Thelia","Thelia","CVE-2026-103537","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-103535","Thelia","Thelia","CVE-2026-103535","HIGH",8.8,"2026-10-12",0],["CVE-2026-103529","Thelia","Thelia","CVE-2026-103529","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-103528","Thelia","Thelia","CVE-2026-103528","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-103527","Thelia","Thelia","CVE-2026-103527","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-103526","Thelia","Thelia","CVE-2026-103526","LOW",3.7,"2026-10-12",0],["CVE-2026-103524","Thelia","Thelia","CVE-2026-103524","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-103523","Thelia","Thelia","CVE-2026-103523","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-103522","Thelia","Thelia","CVE-2026-103522","HIGH",7.2,"2026-10-12",0],["CVE-2026-103521","Thelia","Thelia","CVE-2026-103521","HIGH",7.2,"2026-10-12",0],["CVE-2026-108897","Smart Media4U Technology","SHAREit App","Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108094","Red Hat","Red Hat Enterprise Linux 10","Mutter: mutter: client-triggered use-after-free in wayland color-management icc image desc","HIGH",7.8,"2026-10-12",0],["CVE-2026-109390","AnyDesk","AnyDesk","AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via","CRITICAL",9.8,"2026-10-12",0],["CVE-2026-108896","Linksys","E1700","Linksys E1700 setLinksysIpv6 os command injection","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-92877","Eclipse Foundation","jaxb-ri (core)","The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prev","HIGH",8.3,"2026-10-12",0],["CVE-2026-108895","Linksys","E1700","Linksys E1700 setDMZ os command injection","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-109228","sgl-project","sglang","SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters","HIGH",8.7,"2026-10-12",0],["CVE-2026-109229","sgl-project","sglang","SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor","HIGH",8.7,"2026-10-12",0],["CVE-2026-109227","sgl-project","sglang","SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing","HIGH",8.7,"2026-10-12",0],["CVE-2026-109226","sgl-project","sglang","SGLang through 0.5.21 Audio Decompression Amplification via load_audio","HIGH",8.7,"2026-10-12",0],["CVE-2026-109225","sgl-project","sglang","SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload","HIGH",8.7,"2026-10-12",0],["CVE-2026-12613","Ministry of Justice General Directorate of Information Technology","UYAP Document Editor","Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Do","HIGH",8.8,"2026-10-12",0],["CVE-2026-108894","Linksys","E1700","Linksys E1700 Static Route addStaticRoute os command injection","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-18390","Ministry of Justice General Directorate of Information Technology","UYAP Document Editor","Command Injection in Ministry of Justice's UYAP Document Editor","HIGH",7.8,"2026-10-12",0],["CVE-2026-108893","Linksys","E1700","Linksys E1700 setVlan stack-based overflow","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-109205","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via Upload","HIGH",8.7,"2026-10-12",0],["CVE-2026-109206","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109203","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet","HIGH",7.1,"2026-10-12",0],["CVE-2026-109204","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Tic","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109202","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet","HIGH",7.1,"2026-10-12",0],["CVE-2026-109200","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109201","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService","HIGH",8.7,"2026-10-12",0],["CVE-2026-109199","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template","HIGH",8.7,"2026-10-12",0],["CVE-2026-109169","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter","HIGH",7.1,"2026-10-12",0],["CVE-2026-109170","LogicalDOC","LogicalDOC Community Edition","LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter","HIGH",7.1,"2026-10-12",0],["CVE-2026-108892","Linksys","E1700","Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow","CRITICAL",10,"2026-10-12",0],["CVE-2026-103502","hexpm","hex_core","hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25","MEDIUM",5.9,"2026-10-12",0],["CVE-2026-108890","BlackBeltTechnology","pi-agent-dashboard","BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn ","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109188","jishenghua","jshERP","jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109187","jishenghua","jshERP","jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey","HIGH",7.1,"2026-10-12",0],["CVE-2026-109186","jishenghua","jshERP","jshERP through 3.6 Mass Assignment via PUT /user/update","HIGH",8.7,"2026-10-12",0],["CVE-2026-109184","jishenghua","jshERP","jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109185","jishenghua","jshERP","jshERP through 3.6 Privilege Escalation via PUT /user/updateUser","HIGH",8.7,"2026-10-12",0],["CVE-2026-109183","jishenghua","jshERP","jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109182","jishenghua","jshERP","jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109181","jishenghua","jshERP","jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109179","jishenghua","jshERP","jshERP through 3.6 Missing Authorization via /log/list and /log/info","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109180","jishenghua","jshERP","jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109178","jishenghua","jshERP","jshERP through 3.6 Missing Authorization via /log Audit Endpoints","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109176","moxi624","MoguBlog","MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109177","moxi624","MoguBlog","MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109175","moxi624","MoguBlog","MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109174","moxi624","MoguBlog","MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig","HIGH",7.1,"2026-10-12",0],["CVE-2026-109172","guchengwuyue","yshop-crm","yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109173","guchengwuyue","yshop-crm","yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109171","guchengwuyue","yshop-crm","yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109167","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /u","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-109168","dromara","lamp-cloud","lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId","HIGH",7.1,"2026-10-12",0],["CVE-2026-109166","dromara","lamp-cloud","lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById","HIGH",7.1,"2026-10-12",0],["CVE-2026-109164","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in P","HIGH",7.1,"2026-10-12",0],["CVE-2026-109165","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /u","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-105081","ImageMagick","ImageMagick","ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName","LOW",2,"2026-10-12",0],["CVE-2026-108889","Yungengxin","Cloud Billing","Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed i","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-93695","Progress","ShareFile Storage Zones Controller","Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones C","HIGH",7.4,"2026-10-12",0],["CVE-2026-93694","Progress","ShareFile Storage Zones Controller","Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in","MEDIUM",4,"2026-10-12",0],["CVE-2026-93693","Progress","ShareFile Storage Zones Controller","Unauthenticated queue manipulation through connector SSRF and response injection in Progre","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108836","","Ollama","Ollama Pull API name.go IsValid server-side request forgery","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108835","Yungengxin","Yun Jia Security Guard","Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-52903","ManageIQ","ManageIQ","YAML safe_load production fallback to unsafe_load enables RCE via deserialization","HIGH",8.8,"2026-10-12",0],["CVE-2026-108834","Cairo-dock","Glx-Dock","Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108953","cfdude","mac-shell-mcp","mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments","HIGH",8.5,"2026-10-12",0],["CVE-2026-108951","lavalite","cms","LavaLite CMS through 10.1.2 Authorization Bypass via User Update API","HIGH",7.1,"2026-10-12",0],["CVE-2026-108952","RT-Thread","rt-thread","RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108950","opensource-socialnetwork","opensource-socialnetwork","Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Route","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108831","meetecho","janus-gateway","meetecho janus-gateway Admin API admin.js hard-coded credentials","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108830","meetecho","janus-gateway","meetecho janus-gateway VideoRoom janus_videoroom.c race condition","LOW",2.3,"2026-10-12",0],["CVE-2026-108829","","Zen Cart","Zen Cart Module Configuration modules.php sql injection","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-105283","ash-project","ash_typescript","Internal error terms inspected into AshTypescript RPC error responses","MEDIUM",6.3,"2026-10-12",0],["CVE-2026-108828","","Zen Cart","Zen Cart Admin Panel configuration.php eval sql injection","LOW",2.1,"2026-10-12",0],["CVE-2026-85499","Apache Software Foundation","Apache SkyWalking BanyanDB","Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /mon","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-108827","","Zen Cart","Zen Cart Administrative Module Management general.php zen_call_function code injection","LOW",2.1,"2026-10-12",0],["CVE-2026-105412","Dassault Systèmes","Tuleap Enterprise Edition","SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5","HIGH",7.1,"2026-10-12",0],["CVE-2026-105411","Dassault Systèmes","Tuleap Enterprise Edition","Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise","HIGH",8.1,"2026-10-12",0],["CVE-2026-108826","","Zen Cart","Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-105410","Dassault Systèmes","Tuleap Enterprise Edition","Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 1","HIGH",8.7,"2026-10-12",0],["CVE-2026-105409","Dassault Systèmes","Tuleap Enterprise Edition","Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 1","HIGH",8.7,"2026-10-12",0],["CVE-2026-105408","Dassault Systèmes","Tuleap Enterprise Edition","Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 1","HIGH",8.7,"2026-10-12",0],["CVE-2026-105407","Dassault Systèmes","Tuleap Enterprise Edition","OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 1","HIGH",8.8,"2026-10-12",0],["CVE-2026-103903","MikroTik","RouterOS","MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation","HIGH",8.7,"2026-10-12",0],["CVE-2026-108825","yangzongzhuan","RuoYi","yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-103902","DigiDoc","libdigidocpp","DigiDoc improper signature verification","HIGH",7.5,"2026-10-12",0],["CVE-2026-108824","","DataEase","DataEase Utils.java Utils.buildCalcField sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108822","","Kamailio","Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108821","Tencent","WeKnora","Tencent WeKnora SQL Validator inject.go validateSubquery sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108820","agno-agi","agno","agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108819","agno-agi","agno","agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-107864","Igor Funa","Ad Inserter","WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-107865","Crocoblock","JetMenu","WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108818","agno-agi","agno","agno-agi agno auth.py get_authentication_dependency missing authentication","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-107866","Crocoblock","JetElements For Elementor","WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108817","agno-agi","agno","agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-1907","Kong","Kong Enterprise Gateway","SQL Injection in Clustering Communication (Hybrid Mode)","HIGH",7.5,"2026-10-12",0],["CVE-2026-108816","agno-agi","agno","agno-agi agno PythonTools python.py run_python_code code injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107423","WP User Manager","WP User Manager","WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-107869","WP Desk","Flexible Subscriptions","WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-107863","Codection","Products Restricted Users for WooCommerce","WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control ","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108168","DLX Plugins","Custom Query Blocks","WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-12",0],["CVE-2023-25996","Pluggabl LLC.","Booster Elite for WooCommerce","WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108815","","idcCMS","idcCMS member_deal.php cross site scripting","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108814","","SEMCMS","SEMCMS SEMCMS_Banner.php sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107432","NOUS Ouvert Utile et Simple","Event post","WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-103356","VillaTheme","TMDS","WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-107430","VideoWhisper.com","VideoWhisper Site Manager for ChatGPT, Claude, Codex","WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken A","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-108813","","SEMCMS","SEMCMS SEMCMS_Download.php sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107429","VideoWhisper.com","Paid Videochat Turnkey Site","WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerab","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-107427","NOUS Ouvert Utile et Simple","Event post","WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerabil","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-106605","WP Desk","Flexible Quantity – Measurement Price Calculator for WooCommerce","WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.2","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108812","","SEMCMS","SEMCMS SEMCMS_User.php user improper authorization","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108811","","WMCMS","WMCMS index.php information disclosure","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108810","tsi-coop","tsi-dpdp-cms","tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-93582","OTRS GmbH (former OTRS AG)","OTRS","Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication","CRITICAL",9.4,"2026-10-12",0],["CVE-2026-93581","OTRS GmbH (former OTRS AG)","OTRS","Insufficient Neutralization of Formula Elements in CSV Exports","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-78359","OTRS GmbH (former OTRS AG)","OTRS","Duplicate Identity / Identity Shadowing across CustomerUser backends","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-78358","OTRS GmbH (former OTRS AG)","OTRS","Cross-Site Request Forgery in Administrative Actions","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-78357","OTRS GmbH (former OTRS AG)","OTRS","Insufficient Session Revocation for JWT Authentication","CRITICAL",9.1,"2026-10-12",0],["CVE-2026-78356","OTRS GmbH (former OTRS AG)","OTRS","Unauthenticated Disclosure of Agent Frontend Configuration","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-78355","OTRS GmbH (former OTRS AG)","OTRS","Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory","HIGH",8.7,"2026-10-12",0],["CVE-2026-48212","OTRS GmbH (former OTRS AG)","OTRS","Stored XSS in external pages","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-48211","OTRS GmbH (former OTRS AG)","OTRS","Cross-Site Request Forgery in Import/Export Admin console","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-108809","Eleveo","Call Recording Software","Eleveo Call Recording Software logout session expiration","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108808","Eleveo","Call Recording Software","Eleveo Call Recording Software JWT Token logout get request method with sensitive query st","LOW",2.1,"2026-10-12",0],["CVE-2026-109082","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for pub","MEDIUM",6.8,"2026-10-12",0],["CVE-2026-108807","krupalshah","EmployeeRecruitmentSystem","krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql inject","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108806","krupalshah","EmployeeRecruitmentSystem","krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql in","MEDIUM",6.9,"2026-10-12",0],["CVE-2025-15703","","HireZoot","WP Job Openings < 4.0.0 - Admin+ Stored XSS","LOW",3.5,"2026-10-12",0],["CVE-2026-107791","","WP Comment Cleaner","WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_commen","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-84166","","Hotel Booking","Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-84167","","Hotel Booking","Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR","MEDIUM",4.3,"2026-10-12",0],["CVE-2026-98385","Linux","Linux","sched/cache: Decouple sched_cache_group from mm to fix UAF","HIGH",7.8,"2026-10-12",0],["CVE-2026-108805","krupalshah","EmployeeRecruitmentSystem","krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-109080","Flock","Night Shift","SQL injection in Night Shift bulk license plate search allows cross-organization data acce","HIGH",7.1,"2026-10-12",0],["CVE-2026-108804","TRENDnet","TEW-751DR","TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os com","CRITICAL",10,"2026-10-12",0],["CVE-2026-108803","y_project","RuoYi","y_project RuoYi Disable API add changeStatus session expiration","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107203","Red Hat","Red Hat Satellite 6","Foreman: domain and subnet interface api skips host search filters","MEDIUM",5.4,"2026-10-12",0],["CVE-2026-107193","Red Hat","Red Hat Satellite 6","Foreman: api filter lookup ignores a search-limited filter permission","MEDIUM",6.5,"2026-10-12",0],["CVE-2026-108802","y_project","RuoYi","y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21139","Samsung Mobile","Samsung Continuity Service for windows","Improper access control in Samsung Continuity Service for windows prior to version 4.6.121","HIGH",7.3,"2026-10-12",0],["CVE-2026-21138","Samsung Mobile","Smart Switch","Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 all","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-21137","Samsung Mobile","Smart Switch","Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21136","Samsung Mobile","Smart Switch","Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers t","MEDIUM",6.8,"2026-10-12",0],["CVE-2026-21135","Samsung Mobile","Samsung Internet","Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attacke","MEDIUM",5.9,"2026-10-12",0],["CVE-2026-21134","Samsung Mobile","Samsung Flow","Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attacker","MEDIUM",6.1,"2026-10-12",0],["CVE-2026-21133","Samsung Mobile","Samsung Flow","Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access ","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21132","Samsung Mobile","Samsung Internet","Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote att","MEDIUM",6,"2026-10-12",0],["CVE-2026-21131","Samsung Mobile","Samsung Flow","Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attack","LOW",2.1,"2026-10-12",0],["CVE-2026-21130","Samsung Mobile","Samsung Checkout","Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to versi","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21129","Samsung Mobile","Samsung Checkout","Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to ","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21128","Samsung Mobile","Samsung Checkout","Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to versi","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21127","Samsung Mobile","Samsung Account","Improper export of android application components in Samsung Account prior to version 15.7","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-21126","Samsung Mobile","Samsung Mobile Devices","Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prio","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-21125","Samsung Mobile","Samsung Mobile Devices","Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to ","HIGH",8.6,"2026-10-12",0],["CVE-2026-21124","Samsung Mobile","Samsung Mobile Devices","Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prio","HIGH",8.6,"2026-10-12",0],["CVE-2026-21123","Samsung Mobile","Samsung Mobile Devices","Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local","MEDIUM",6.7,"2026-10-12",0],["CVE-2026-21122","Samsung Mobile","Samsung Mobile Devices","Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attac","HIGH",7,"2026-10-12",0],["CVE-2026-21121","Samsung Mobile","Samsung Mobile Devices","Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 al","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-21120","Samsung Mobile","Samsung Mobile Devices","Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to po","HIGH",8.9,"2026-10-12",0],["CVE-2026-21119","Samsung Mobile","Samsung Mobile Devices","Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Releas","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-21118","Samsung Mobile","Samsung Mobile Devices","Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local a","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-21117","Samsung Mobile","Samsung Mobile Devices","Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21116","Samsung Mobile","Samsung Mobile Devices","Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local at","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21115","Samsung Mobile","Samsung Mobile Devices","Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows loc","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-21114","Samsung Mobile","Samsung Mobile Devices","Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local at","HIGH",7,"2026-10-12",0],["CVE-2026-87690","Rapid7","Metasploit Framework","Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and C","HIGH",8.8,"2026-10-12",0],["CVE-2026-108801","prasathmani","TinyFileManager","prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108800","yangzongzhuan","RuoYi","yangzongzhuan RuoYi cross-site request forgery","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108799","jackq","XCMS","jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql ","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108798","ZKTeco","BioTime","ZKTeco BioTime hard-coded key","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108797","ZKTeco","BioTime","ZKTeco BioTime Employee REST API employees authorization","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108796","ZKTeco","BioTime","ZKTeco BioTime Biometric Data Endpoint finger_data authorization","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108795","ZKTeco","BioTime","ZKTeco BioTime System Settings API systemSettings access control","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108985","sahlberg","libnfs","ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to ","HIGH",7.1,"2026-10-12",0],["CVE-2026-108794","ZKTeco","BioTime","ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-107437","GeoVision Inc.","GV-E-map Server","Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A","MEDIUM",6.2,"2026-10-12",0],["CVE-2026-108791","westboy","CicadasCMS","westboy CicadasCMS Template Management input TemplateController.input path traversal","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108982","IDRIX","VeraCrypt","VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted ","HIGH",7.2,"2026-10-12",0],["CVE-2026-108790","westboy","CicadasCMS","westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108981","denji","ngx_cache_purge","ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situa","LOW",3.6,"2026-10-12",0],["CVE-2026-108789","deepseek-ai","deepseek-harness","deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow","MEDIUM",5.1,"2026-10-12",0],["CVE-2026-108788","deepseek-ai","deepseek-harness","deepseek-ai deepseek-harness Sandbox spawn sandbox","MEDIUM",4.8,"2026-10-12",0],["CVE-2026-108980","Blinko","Blinko","Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via in","HIGH",8.8,"2026-10-12",0],["CVE-2026-108787","houtini-ai","voice-analyser-mcp","houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108786","houtini-ai","seo-crawler-mcp","houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request ","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-66086","Unisoc (Shanghai) Technologies Co., Ltd.","Modem","Stack-based Buffer Overflow in Modem","HIGH",8.3,"2026-10-12",0],["CVE-2026-66085","Unisoc (Shanghai) Technologies Co., Ltd.","Modem","Information Disclosure in Modem","MEDIUM",5.5,"2026-10-12",0],["CVE-2026-87765","Unisoc (Shanghai) Technologies Co., Ltd.","kernel","Improper Input Validation in Kernel APsys DVFS","MEDIUM",5.5,"2026-10-12",0],["CVE-2026-108785","macrozheng","mall","macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken se","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108784","macrozheng","mall","macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108783","PRVTPRO","Amnezia-Web-Panel","PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108782","erzhongxmu","JEEWMS","erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql in","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108781","erzhongxmu","JEEWMS","erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql inject","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108779","erzhongxmu","JEEWMS","erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108778","erzhongxmu","JEEWMS","erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list ","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108777","erzhongxmu","JEEWMS","erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108775","erzhongxmu","JEEWMS","erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql inje","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108774","erzhongxmu","JEEWMS","erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108773","erzhongxmu","JEEWMS","erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108772","bleenco","abstruse","bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108770","","Appwrite","Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery","MEDIUM",6.9,"2026-10-12",0],["CVE-2026-108769","zhayujie","CowAgent","zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service","MEDIUM",5.3,"2026-10-12",0],["CVE-2026-108978","Samsung Opensource","rlottie","Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overf","MEDIUM",5.5,"2026-10-12",0],["CVE-2026-108976","GNU","Emacs","GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename","HIGH",7.8,"2026-10-11",0],["CVE-2026-108963","David-Crty","databasement","databasement before 1.8.2 allows remote code execution because it runs certain commands (e","HIGH",8.8,"2026-10-11",0],["CVE-2026-108768","zhayujie","CowAgent","zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108925","Cohesity","NetBackup Administration Console web interface","Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basi","MEDIUM",6.1,"2026-10-11",0],["CVE-2026-59508","Interuse","i-Bos","Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ","MEDIUM",5.9,"2026-10-11",0],["CVE-2026-19740","zephyrproject","zephyr","Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p","MEDIUM",6.5,"2026-10-11",0],["CVE-2026-19739","zephyrproject","zephyr","Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives","MEDIUM",6.5,"2026-10-11",0],["CVE-2026-19738","zephyrproject","zephyr","Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedure","MEDIUM",6.5,"2026-10-11",0],["CVE-2026-19935","zephyrproject","zephyr","Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i","HIGH",7.5,"2026-10-11",0],["CVE-2026-19737","zephyrproject","zephyr","NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction","MEDIUM",5.5,"2026-10-11",0],["CVE-2026-18418","zephyrproject","zephyr","Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's chan","LOW",3.4,"2026-10-11",0],["CVE-2026-19736","zephyrproject","zephyr","Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng","HIGH",7.8,"2026-10-11",0],["CVE-2026-19735","zephyrproject","zephyr","Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil","MEDIUM",4.8,"2026-10-11",0],["CVE-2026-19577","zephyrproject","zephyr","Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad","HIGH",7.1,"2026-10-11",0],["CVE-2026-19576","zephyrproject","zephyr","Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated ","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-19669","zephyrproject","zephyr","Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overfl","HIGH",7.8,"2026-10-11",0],["CVE-2026-108913","Omarchy","Omarchy","omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme ","HIGH",7.1,"2026-10-11",0],["CVE-2026-107761","GitroomHQ","postiz-app","Channel tokens and organization API key exposed in API responses","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108904","ph7software","ph7builder","pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController","HIGH",7.1,"2026-10-11",0],["CVE-2026-108905","ph7software","ph7builder","pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header","HIGH",8.7,"2026-10-11",0],["CVE-2026-108903","ph7software","ph7builder","pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108902","ph7software","ph7builder","pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link","HIGH",7.2,"2026-10-11",0],["CVE-2026-108684","erzhongxmu","Jeewms","erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108891","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108888","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108886","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108887","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108885","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108884","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108882","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108883","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig","HIGH",7.1,"2026-10-11",0],["CVE-2026-108881","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108879","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108880","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108878","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108877","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108876","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108874","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108875","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108873","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108871","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108872","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108870","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108868","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108869","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108867","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108866","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108683","zhayujie","CowAgent","zhayujie CowAgent Media Download memory allocation","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108682","zhayujie","CowAgent","zhayujie CowAgent Web Console upload read denial of service","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108864","iflytek","astron-agent","iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint","LOW",2.3,"2026-10-11",0],["CVE-2026-108865","AmoyLab","Unla","AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize","HIGH",8.8,"2026-10-11",0],["CVE-2026-108863","Katanemo","Plano","Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface","HIGH",8.7,"2026-10-11",0],["CVE-2026-108861","erpipe-org","Odoo MCP","Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108862","APIParkLab","APIPark","APIPark through 1.9.7-beta IDOR via application authorization endpoints","MEDIUM",6,"2026-10-11",0],["CVE-2026-108860","SciSharp","BotSharp","BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key","CRITICAL",9.3,"2026-10-11",0],["CVE-2026-108859","mark3labs","mcp-go","mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering","HIGH",8.7,"2026-10-11",0],["CVE-2026-108857","Hugging Face","Text Embeddings Inference","Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging","MEDIUM",4.8,"2026-10-11",0],["CVE-2026-108858","Predibase","LoRAX","Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-108856","UnicomAI","Wanwu","UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting","LOW",2.3,"2026-10-11",0],["CVE-2026-108854","UnicomAI","Wanwu","Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108855","UnicomAI","Wanwu","UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108852","OvidijusParsiunas","Deep Chat","Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass","LOW",2.1,"2026-10-11",0],["CVE-2026-108853","UnicomAI","Wanwu","UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app","HIGH",7.2,"2026-10-11",0],["CVE-2026-108851","thorsten","phpMyFAQ","phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool","MEDIUM",4.8,"2026-10-11",0],["CVE-2026-108839","thClaws","thClaws","thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs","LOW",2.3,"2026-10-11",0],["CVE-2026-108850","guy-hartstein","company-research-agent","Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108699","hyper-mcp-rs","hyper-mcp","hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins","HIGH",8.3,"2026-10-11",0],["CVE-2026-108697","CoreShop","CoreShop","CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108698","hyper-mcp-rs","hyper-mcp","hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition","HIGH",8.3,"2026-10-11",0],["CVE-2026-108681","zhayujie","CowAgent","zhayujie CowAgent Web Console web_channel.py denial of service","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108584","FunnyWolf","Viper","FunnyWolf Viper config hard-coded credentials","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108578","Neterbit","NW-431F","Neterbit NW-431F Embedded Web Server sms.json information disclosure","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108577","Konstanty Bialkowski","libmodplug","Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource cons","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108760","llama-farm","llamafarm","LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces","HIGH",7.2,"2026-10-11",0],["CVE-2026-108759","EricLBuehler","mistral.rs","mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec","HIGH",7.6,"2026-10-11",0],["CVE-2026-108757","Nexting","pinclaw","Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send","HIGH",7.1,"2026-10-11",0],["CVE-2026-108758","alextselegidis","easyappointments","Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint","HIGH",8.8,"2026-10-11",0],["CVE-2026-108756","Abilityai","trinity","Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108754","tbphp","gpt-load","GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger","MEDIUM",4.8,"2026-10-11",0],["CVE-2026-108755","hatchet-dev","hatchet","Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108753","agnaistic","agnai","Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose","CRITICAL",9.3,"2026-10-11",0],["CVE-2026-108751","modu-ai","moai-adk","MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer","MEDIUM",4.8,"2026-10-11",0],["CVE-2026-108752","jupyterhub","jupyterhub","JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen","LOW",2.3,"2026-10-11",0],["CVE-2026-108750","OpenDocMan","OpenDocMan","OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108748","quarkiverse","quarkus-langchain4j","Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108746","Vearch","vearch","Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources","HIGH",8.7,"2026-10-11",0],["CVE-2026-108747","Lightdash","lightdash","Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion","LOW",2.3,"2026-10-11",0],["CVE-2026-108745","DBeaver","CloudBeaver","CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet","LOW",2.3,"2026-10-11",0],["CVE-2026-108742","DBeaver","CloudBeaver","CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108744","MinaSaad1","pbi-cli","pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync","HIGH",7.3,"2026-10-11",0],["CVE-2026-108741","shepherd-agents","Shepherd","Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker","LOW",2.3,"2026-10-11",0],["CVE-2026-108739","openagents-org","OpenAgents","OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/","HIGH",8.7,"2026-10-11",0],["CVE-2026-108740","arp242","GoatCounter","GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment","HIGH",7.2,"2026-10-11",0],["CVE-2026-108738","Traccar","Traccar","Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback","LOW",2.3,"2026-10-11",0],["CVE-2026-108736","alexjustesen","speedtest-tracker","Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing","MEDIUM",6.3,"2026-10-11",0],["CVE-2026-108737","Traccar","Traccar","Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion","HIGH",7.6,"2026-10-11",0],["CVE-2026-108734","frappe","crm","Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108735","miniflux","miniflux","Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108733","frappe","hrms","Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108732","frappe","hrms","Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108731","The-Commit-Company","raven","Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108729","cortezaproject","corteza","Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoin","HIGH",8.2,"2026-10-11",0],["CVE-2026-108730","The-Commit-Company","raven","Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108728","flyteorg","flyte","Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook","HIGH",7.1,"2026-10-11",0],["CVE-2026-108726","glpi-project","GLPI","GLPI through 12.0.0 Missing Authorization via ajax/map.php","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108727","tianma-if","EdgeEver","EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108725","cheshire-cat-ai","core","Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin","MEDIUM",5.1,"2026-10-11",0],["CVE-2026-108723","QingYunA","answer-me-with-html","answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding","LOW",2,"2026-10-11",0],["CVE-2026-108724","Sylius","Sylius","Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108722","e2b-dev","open-computer-use","open-computer-use through commit 610bac8 Stored XSS via log.html Session Log","LOW",2.3,"2026-10-11",0],["CVE-2026-108720","phpipam","phpipam","phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108721","iFurySt","open-computer-use","Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID","MEDIUM",5.8,"2026-10-11",0],["CVE-2026-108718","Rill Data","rill","Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration","HIGH",8.6,"2026-10-11",0],["CVE-2026-108719","theopenco","LLMGateway","LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108717","Combodo","iTop","Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108716","punkpeye","mcp-remote","mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth ","MEDIUM",6,"2026-10-11",0],["CVE-2026-108714","modelcontextprotocol","kotlin-sdk","MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket","HIGH",8.7,"2026-10-11",0],["CVE-2026-108715","librenms","librenms","LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108712","SuiteCRM","SuiteCRM","SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108713","SuiteCRM","SuiteCRM","SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTempla","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108711","Plastic Labs","honcho","Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108710","orneryd","NornicDB","NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints","HIGH",7.1,"2026-10-11",0],["CVE-2026-108576","TOZED","X300","TOZED X300 IPPingDiagnostics process_ping os command injection","CRITICAL",10,"2026-10-11",0],["CVE-2026-108575","BerriAI","LiteLLM","BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108574","BerriAI","LiteLLM","BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs au","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108573","Open Asset Import Library","Assimp","Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds","MEDIUM",5.1,"2026-10-11",0],["CVE-2026-108572","","Casdoor","Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108571","Xinhu","Rainrock RockOA","Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108570","Furion",".NET Framework","Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108569","Furion",".NET Framework","Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108568","InstantSoft","icms2","InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108567","InstantSoft","icms2","InstantSoft icms2 Image image.php files_delete_file path traversal","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108566","InstantSoft","icms2","InstantSoft icms2 Private Message index.tpl.php index cross site scripting","MEDIUM",5.1,"2026-10-11",0],["CVE-2026-108544","Lippu","Docx Reader Office Viewer App","Lippu Docx Reader Office Viewer App path traversal","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108543","ag2ai","ag2","ag2ai ag2 UserProxyAgent os.path.join path traversal","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108542","021is","elvix-sdk","021is elvix-sdk MCP Request index.ts server-side request forgery","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108541","highwarden","Super Store Finder","highwarden Super Store Finder index.php sql injection","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-91829","","Subscribe to Comments","Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter","HIGH",7.1,"2026-10-11",0],["CVE-2026-93550","","Veeqo for WooCommerce","Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connect","MEDIUM",4.3,"2026-10-11",0],["CVE-2026-96227","","Piotnet Forms","Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload","HIGH",8.8,"2026-10-11",0],["CVE-2026-97183","","WP-Invoice","WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers","MEDIUM",4.3,"2026-10-11",0],["CVE-2026-89287","","ASPL Product Quotation","ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89297","","Loja Automática","Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89299","","WP Verify API","WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89302","","Post Voting System","Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89304","","paymendo","Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_com","MEDIUM",6.5,"2026-10-11",0],["CVE-2026-89305","","paymendo","Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter","MEDIUM",6.5,"2026-10-11",0],["CVE-2026-89213","","Llavero.io","Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89214","","WpCues Basic Quiz","WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission","HIGH",8.6,"2026-10-11",0],["CVE-2026-89232","","Recordbrowser","RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89234","","WP-Partner","WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-89283","","WP Posts Password Batch Manager","WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite","HIGH",8.6,"2026-10-11",0],["CVE-2026-89285","","Datalist it","Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action","HIGH",8.6,"2026-10-11",0],["CVE-2026-108540","OpenSpug","Spug","OpenSpug File Transfer transfer os command injection","CRITICAL",9.4,"2026-10-11",0],["CVE-2026-88827","","Disable Users","Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Applicatio","HIGH",8.8,"2026-10-11",0],["CVE-2026-88903","","Topcontent","Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook","HIGH",8.8,"2026-10-11",0],["CVE-2026-88905","","KeyWord Collector","KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSet","HIGH",8.8,"2026-10-11",0],["CVE-2026-88930","","Social Web Suite","Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret","HIGH",8.6,"2026-10-11",0],["CVE-2026-89195","","Site Setup Wizard","Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists","HIGH",8.6,"2026-10-11",0],["CVE-2026-87760","","Web Vitals Tracking","Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name","HIGH",8.8,"2026-10-11",0],["CVE-2026-87761","","Adwised Web Push Notification","Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings","HIGH",8,"2026-10-11",0],["CVE-2026-87762","","Adwised Web Push Notification","Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Ju","HIGH",8.8,"2026-10-11",0],["CVE-2026-87764","","BuddyPress Instant Chat","BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message","HIGH",8.8,"2026-10-11",0],["CVE-2026-88785","","Simple Membership","Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query Stri","MEDIUM",4.7,"2026-10-11",0],["CVE-2026-88826","","SmugMug Embed","SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums","HIGH",8.8,"2026-10-11",0],["CVE-2026-85121","","Insurify","Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtem","CRITICAL",9.1,"2026-10-11",0],["CVE-2026-85126","","Crowdfundly","Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation","HIGH",7.2,"2026-10-11",0],["CVE-2026-86706","","Quick quotes","Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update","CRITICAL",9.1,"2026-10-11",0],["CVE-2026-86717","","Insurify","Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup","CRITICAL",9.1,"2026-10-11",0],["CVE-2026-86798","","HootBoard","HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint","HIGH",8.8,"2026-10-11",0],["CVE-2026-84259","","click5 CRM add-on to WPForms","click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications","HIGH",8.8,"2026-10-11",0],["CVE-2026-84260","","click5 CRM add-on to Gravity Forms","click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifica","HIGH",8.8,"2026-10-11",0],["CVE-2026-84261","","click5 CRM add-on to Contact Form 7","click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notific","HIGH",8.8,"2026-10-11",0],["CVE-2026-84734","","Mindstien Quick Login","Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pas","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84737","","Freeton WP","Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-85118","","AI Content Generator Marketing","AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitra","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84251","","click5 CRM add-on to Ninja Forms","click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84252","","click5 CRM add-on to WPForms","click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84253","","click5 CRM add-on to Gravity Forms","click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84254","","click5 CRM add-on to Contact Form 7","click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-84258","","click5 CRM add-on to Ninja Forms","click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notificati","HIGH",8.8,"2026-10-11",0],["CVE-2026-81420","","Tcard WP","Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-81649","","Fundiin cho WooCommerce","Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosu","CRITICAL",9.1,"2026-10-11",0],["CVE-2026-107694","","Dokan: AI Powered WooCommerce Multivendor Marketplace Solution","Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST En","LOW",2.7,"2026-10-11",0],["CVE-2026-14854","","WooCommerce Bookings","WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service","HIGH",7.5,"2026-10-11",0],["CVE-2026-81153","","Robo Gallery","Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-81154","","Robo Gallery","Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-81155","","Robo Gallery","Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-81156","","Robo Gallery","Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-104680","","Envira Gallery","Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboa","HIGH",7.2,"2026-10-11",0],["CVE-2026-104681","","Envira Gallery","Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery","LOW",2.7,"2026-10-11",0],["CVE-2026-104682","","Envira Gallery","Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route","LOW",2.7,"2026-10-11",0],["CVE-2026-104684","","Envira Gallery","Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode","LOW",2.7,"2026-10-11",0],["CVE-2026-106029","","WeddingCity Lite","WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion","HIGH",7.5,"2026-10-11",0],["CVE-2026-107507","","Squadeno","Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit","LOW",2.7,"2026-10-11",0],["CVE-2026-103305","","Prenotazioni","Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update","HIGH",8.8,"2026-10-11",0],["CVE-2026-103694","","Mobile builder","Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin","HIGH",8.8,"2026-10-11",0],["CVE-2026-103695","","Mobile builder","Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter","HIGH",8.6,"2026-10-11",0],["CVE-2026-104028","","Anton Extensions","Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE","CRITICAL",9.8,"2026-10-11",0],["CVE-2026-12980","","Post Snippets","Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable","MEDIUM",6.8,"2026-10-11",0],["CVE-2026-94235","","MemberHero","Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_t","MEDIUM",4.3,"2026-10-11",0],["CVE-2026-108539","","GPAC","GPAC MP4Box filter_queue.c gf_fq_pop use after free","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108538","","GPAC","GPAC MP4Box os_thread.c gf_mx_v use after free","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108523","Studio-Saelix","Sencho","Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108522","Studio-Saelix","Sencho","Studio-Saelix Sencho Login Endpoint login improper authentication","MEDIUM",6.9,"2026-10-11",0],["CVE-2026-108521","Studio-Saelix","Sencho","Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-si","MEDIUM",5.1,"2026-10-11",0],["CVE-2026-108696","CoreUnion","CoreShop","CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReshi","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108694","C4illin","ConvertX","ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter","HIGH",7.1,"2026-10-11",0],["CVE-2026-108695","multivendorx","MultiVendorX","MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint","HIGH",7.1,"2026-10-11",0],["CVE-2026-108693","ImageMagick","ImageMagick","ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delega","HIGH",7.3,"2026-10-11",0],["CVE-2026-108708","WuKongOpenSource","Wukong_HRM","Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUti","HIGH",8.7,"2026-10-11",0],["CVE-2026-108706","elunez","eladmin","eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108707","WuKongOpenSource","Wukong_HRM","Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect","CRITICAL",9.3,"2026-10-11",0],["CVE-2026-108705","1Panel-dev","CordysCRM","CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108703","1Panel-dev","CordysCRM","CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108704","1Panel-dev","CordysCRM","CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108702","1Panel-dev","CordysCRM","CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108700","1Panel-dev","CordysCRM","1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title","HIGH",7.1,"2026-10-11",0],["CVE-2026-108701","1Panel-dev","CordysCRM","1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108692","1Panel-dev","CordysCRM","1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints","HIGH",7.1,"2026-10-11",0],["CVE-2026-108691","gz-yami","mall4j","mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCa","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108689","WuKongOpenSource","Wukong AICRM","Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST ","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108690","gz-yami","mall4j","mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCa","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108688","elunez","eladmin","Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108680","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108679","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108677","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName","HIGH",7.1,"2026-10-11",0],["CVE-2026-108678","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108676","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108674","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108675","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108673","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108671","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById","HIGH",7.1,"2026-10-11",0],["CVE-2026-108672","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108669","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108670","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108668","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108667","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108665","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108666","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108663","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108664","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108662","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108660","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108661","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant","HIGH",7.1,"2026-10-11",0],["CVE-2026-108659","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108658","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108656","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108657","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply","HIGH",8.6,"2026-10-11",0],["CVE-2026-108655","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108653","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108654","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108652","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108650","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108651","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108649","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108648","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint","HIGH",7.1,"2026-10-11",0],["CVE-2026-108646","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108647","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108645","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108643","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108644","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108642","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108641","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108639","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108640","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108638","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108636","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108637","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108635","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108633","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108634","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108632","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108630","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108631","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108629","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108627","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108628","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint","HIGH",8.6,"2026-10-11",0],["CVE-2026-108626","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108624","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108625","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108623","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch","HIGH",7.1,"2026-10-11",0],["CVE-2026-108621","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108622","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108620","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108618","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108619","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108617","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108615","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108616","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108614","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108612","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108613","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108611","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108609","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108610","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108608","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108606","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108607","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-108605","jeecgboot","JeecgBoot","JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint","MEDIUM",5.3,"2026-10-11",0],["CVE-2026-103685","VillaTheme","ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce","WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.","MEDIUM",4.3,"2026-10-10",0],["CVE-2026-108604","TabularisDB","tabularis","Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification","MEDIUM",5.8,"2026-10-10",0],["CVE-2026-108602","Helicone","helicone","Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-108603","addsumtech","slide-maker","slide-maker through 5.8.0 Path Traversal via generate_images_openai.py","MEDIUM",4.8,"2026-10-10",0],["CVE-2026-27350","Builderius.io","Builderius","WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability","HIGH",7.2,"2026-10-10",0],["CVE-2026-97853","ericmj","decimal","Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-66480","YITH","YITH WooCommerce Product Add-Ons","WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vuln","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-57742","ThemeREX Group","Kids Planet","WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-107434","videowhisper","MicroPayments","WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-107420","Narinder Singh","Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway","WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-81797","ThemeRex","Buzz Stone | Magazine & Viral Blog WordPress Theme","WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object I","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-78535","ThemeRex","Photolia","WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-78534","Keen IT Solutions","Educavo","WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-78532","designthemes","LMS","WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-78533","AncoraThemes","Qwery","WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-78531","ThemeREX","Jacqueline","WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-78529","ThemeREX","Alliance","WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-78530","Chimpstudio","FoodBakery","WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability","HIGH",7.7,"2026-10-10",0],["CVE-2026-66569","axiomthemes","Kicker","WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66568","axiomthemes","Original","WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66566","Elated-Themes","Ambient","WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-66567","AncoraThemes","Anesta","WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66565","axiomthemes","FC United","WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66564","ThemeREX","ShiftCV","WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66483","ThemeREX","Education Center","WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66563","ThemeREX","Windsor","WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66482","AncoraThemes","Drone Media","WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-66481","Presto Player","Presto Player Pro","WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability","MEDIUM",6.8,"2026-10-10",0],["CVE-2026-62130","Amir Helzer","WooCommerce Multilingual & Multicurrency","WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection ","HIGH",7.2,"2026-10-10",0],["CVE-2026-65459","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability","HIGH",7.5,"2026-10-10",0],["CVE-2026-62129","WPFunnels","Creator LMS","WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-10",0],["CVE-2026-62125","ThemeREX","Asia Garden","WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62123","ThemeREX","Invetex","WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62124","ThemeREX","N7 | Golf Club Sports & Events","WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerabilit","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62120","ThemeREX","Law Office","WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62118","Dmitry V.","Barcode Scanner with Inventory & Order Manager","WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access ","HIGH",7.3,"2026-10-10",0],["CVE-2026-62117","Dmitry V.","Barcode Scanner with Inventory & Order Manager","WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection ","HIGH",8.5,"2026-10-10",0],["CVE-2026-62116","Dmitry V.","Barcode Scanner with Inventory & Order Manager","WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scr","HIGH",7.1,"2026-10-10",0],["CVE-2026-62100","kutethemes","KuteShop","WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62115","kutethemes","KuteShop","WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62099","kutethemes","Boutique","WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62098","kutethemes","Boutique","WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-62095","kutethemes","Biolife","WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62096","kutethemes","Biolife","WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62094","kutethemes","TechOne","WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62093","kutethemes","TechOne","WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62091","kutethemes","Armania","WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62092","kutethemes","Armania","WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62090","ThemeREX","WineShop","WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62087","ThemeREX","Equadio","WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62082","An-Themes","Pin WP","WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62086","ThemeREX","Juno","WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62077","BoldThemes","Avala","WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62075","Mymoun","Backhoe","WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62076","The4","Kalles","WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62074","ThemeREX","Ozeum","WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62070","CKThemes","Flipmart","WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62068","CocoBasic","Teoro","WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62069","CocoBasic","Fabius","WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62067","CocoBasic","Kaven","WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62066","CocoBasic","Volos","WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62064","Bracketweb","Ambed","WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62065","CocoBasic","Cardea","WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-62054","ThemeREX","Yacht Rental","WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62053","ThemeREX","Wine House","WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62052","ThemeREX","Tipsy","WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62050","ThemeREX","Splendour","WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62051","ThemeREX","Stargaze","WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62043","sevenspark","Contact Form 7 – Dynamic Text Extension","WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposur","HIGH",7.5,"2026-10-10",0],["CVE-2026-62038","DigitalME","eRoom","WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability","HIGH",7.3,"2026-10-10",0],["CVE-2026-62035","upcasted","AWS S3 for WordPress Plugin – Upcasted","WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control v","MEDIUM",6.3,"2026-10-10",0],["CVE-2026-62037","bPlugins","Document Embedder","WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62034","bPlugins","Before After Image Comparison – Image comparison for WP","WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross","HIGH",7.1,"2026-10-10",0],["CVE-2026-62033","Stylemix","uListing","WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability","HIGH",7.6,"2026-10-10",0],["CVE-2026-62031","Stylemix","uListing","WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-10",0],["CVE-2026-62032","Designinvento","DirectoryPress","WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62030","bPlugins","StreamCast","WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability","HIGH",7.2,"2026-10-10",0],["CVE-2026-62027","bPlugins","Team Section Block","WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-62024","CodeBard","CodeBard Help Desk","WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-10",0],["CVE-2026-62025","Tailored Media","Tailored Tools","WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability","CRITICAL",9,"2026-10-10",0],["CVE-2026-62022","Select-Themes","Tonda Membership","WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62021","rascals","Angio","WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-10",0],["CVE-2026-62020","Mikado-Themes","TouchUp","WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-48194","kutethemes","DukaMarket","WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-48193","kutethemes","Uminex","WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-45440","Smackcoders Inc.","WP Ultimate CSV Importer","WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability","HIGH",7.6,"2026-10-10",0],["CVE-2026-42724","AncoraThemes","CleanSkin","WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-42777","Edge-Themes","Aalto","WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-42723","AncoraThemes","CleanSkin","WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-42722","Shabti Kaplan","Frontend Admin by DynamiApps","WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability","HIGH",7.6,"2026-10-10",0],["CVE-2026-42718","Pluggabl","Booster for WooCommerce","WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-42719","Sarah Giles","Dynamic User Directory","WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-42717","VaultDweller","Leyka","WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability","HIGH",7.6,"2026-10-10",0],["CVE-2026-42715","10Web","Photo Gallery by 10Web","WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabili","HIGH",7.1,"2026-10-10",0],["CVE-2026-42716","payever","Payever - WooCommerce Gateway","WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerabili","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-42712","QODE","Qode Tours","WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability","HIGH",8.5,"2026-10-10",0],["CVE-2026-42711","10Web","Slider by 10Web","WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42706","ThemeGoods","DK","WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-10",0],["CVE-2026-42709","RadiusTheme","Food Menu – Restaurant Menu & Online Ordering for WooCommerce","WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - ","HIGH",7.1,"2026-10-10",0],["CVE-2026-42705","ThemeGoods","Grand News","WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-10",0],["CVE-2026-42704","axiomthemes","Kids Care","WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-42699","FolioVision","FV Player 8","WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42702","Themeum","Tutor LMS","WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42697","Inisev","Social Share Icons & Social Share Buttons","WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting","HIGH",7.1,"2026-10-10",0],["CVE-2026-42696","Royal Plugins","SiteVault – Backup, Restore, Migration &amp; Cloning","WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code ","CRITICAL",10,"2026-10-10",0],["CVE-2026-42633","Marcus","Events Manager","WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","HIGH",8.5,"2026-10-10",0],["CVE-2026-42693","TieLabs","Jannah","WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42632","QODE","Qode Real Estate","WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42631","QODE","Qode Music","WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-42630","Web Plura","Web Plura Backup &amp; Restore Manager","WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vu","HIGH",7.5,"2026-10-10",0],["CVE-2026-40808","Automattic","Jetpack VideoPress","WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-42419","SwishFolio","Swish Migrate and Backup","WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability","MEDIUM",5.9,"2026-10-10",0],["CVE-2026-40805","PeepSo","PeepSo","WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability","HIGH",7.7,"2026-10-10",0],["CVE-2026-40802","pubjet","Pubjet | پاب‌جت","WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability","HIGH",7.6,"2026-10-10",0],["CVE-2026-40803","Jotform","Jotform &#8211; AI Chatbot","WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-40801","Wordable","Wordable","WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-40800","ELEXtensions","ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes","WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.","CRITICAL",9.3,"2026-10-10",0],["CVE-2026-40777","Rashid","WPSection","WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-39801","Sergey","AIWU","WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-39802","everestthemes","Everest Backup","WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability","HIGH",8.1,"2026-10-10",0],["CVE-2026-39800","Anton Bond","Additional Order Filters for WooCommerce","WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (","HIGH",7.1,"2026-10-10",0],["CVE-2026-39799","Joomunited","WP File Download","WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-108600","open-multi-agent","open-multi-agent","open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink","MEDIUM",5.7,"2026-10-10",0],["CVE-2026-108599","pulseaiclub","phi","Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass","MEDIUM",5.7,"2026-10-10",0],["CVE-2026-108597","cohere-ai","cohere-python","Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction","MEDIUM",5.9,"2026-10-10",0],["CVE-2026-108598","floci-io","floci","Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates","CRITICAL",9.3,"2026-10-10",0],["CVE-2026-108596","openlit","openlit","OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header","MEDIUM",6,"2026-10-10",0],["CVE-2026-94590","CodePeople2","Sell Downloads","WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-57806","drfuri","Martfury - WooCommerce Marketplace WordPress Theme","WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cr","HIGH",7.1,"2026-10-10",0],["CVE-2026-108595","pulseaiclub","phi","Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir","MEDIUM",6,"2026-10-10",0],["CVE-2026-108593","decolua","9router","9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint","HIGH",7.3,"2026-10-10",0],["CVE-2026-108594","mealie-recipes","mealie","Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch","LOW",2.3,"2026-10-10",0],["CVE-2026-108592","SWE-agent","mini-swe-agent","mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment","MEDIUM",6,"2026-10-10",0],["CVE-2026-108591","innocommerce","InnoShop","InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool","MEDIUM",5.9,"2026-10-10",0],["CVE-2026-106610","miniOrange","miniorange otp verification","WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-96341","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability","HIGH",8.2,"2026-10-10",0],["CVE-2026-105892","rtCamp Inc.","rtMedia for WordPress, BuddyPress and bbPress","WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File ","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-103071","VillaTheme","Thank You Page Customizer for WooCommerce","WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vu","HIGH",7.5,"2026-10-10",0],["CVE-2026-103357","VillaTheme","GIFT4U","WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-104398","VillaTheme","AFFI – Affiliate Marketing for WooCommerce","WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injecti","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-105889","Tickera","Tickera","WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-10",0],["CVE-2026-106608","Automattic","WooCommerce","WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerabili","HIGH",7.2,"2026-10-10",0],["CVE-2026-106609","Web Impian","Bayarcash WooCommerce","WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-10",0],["CVE-2026-62044","bPlugins","Super Video Player","WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-10",0],["CVE-2026-94160","themeStek","ThemeStek Extras for LabtechCO Theme","WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Script","HIGH",7.1,"2026-10-10",0],["CVE-2026-108586","1mcp-app","@1mcp/agent","1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-108585","argoproj-labs","argocd-mcp","argocd-mcp through 0.9.0 Path Traversal via delete_application Tool","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-108583","54yyyu","zotero-mcp","zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool","LOW",2.3,"2026-10-10",0],["CVE-2026-108582","genspark-ai","GenOffice","GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store","MEDIUM",6.8,"2026-10-10",0],["CVE-2026-108580","phoenixthrush","AniWorld Downloader","AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-108581","TencentCloud","Octop","Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers","HIGH",7.1,"2026-10-10",0],["CVE-2026-108579","Openpanel-dev","openpanel","OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export","LOW",2.3,"2026-10-10",0],["CVE-2026-108554","PDFMathTranslate","PDFMathTranslate","PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-108555","schlagmichdoch","PairDrop","PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header","LOW",2.3,"2026-10-10",0],["CVE-2026-108553","OpenRefine","OpenRefine","OpenRefine through 3.10.1 CSRF to RCE via get-rows Command","HIGH",7.7,"2026-10-10",0],["CVE-2026-108551","ferdikoomen","openapi-typescript-codegen","openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates","CRITICAL",9.3,"2026-10-10",0],["CVE-2026-108549","chenhg5","cc-connect","cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing","CRITICAL",9.2,"2026-10-10",0],["CVE-2026-108550","iflytek","skillhub","SkillHub before 0.2.22 Account Takeover via Account Merge Flow","HIGH",8.7,"2026-10-10",0],["CVE-2026-108547","iflytek","astron-rpa","AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var","HIGH",7.1,"2026-10-10",0],["CVE-2026-108548","iflytek","astron-rpa","AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-108545","SillyTavern","SillyTavern","SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing","HIGH",8.2,"2026-10-10",0],["CVE-2026-108546","spotweb","spotweb","Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration","HIGH",7.7,"2026-10-10",0],["CVE-2026-108115","kortix-ai","suna","Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses","LOW",2.3,"2026-10-10",0],["CVE-2026-108114","strapi","strapi","Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-66435","Devin Walker","WP Rollback","WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability","MEDIUM",5.9,"2026-10-10",0],["CVE-2026-97264","Greg Winiarski","WPAdverts","WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-94676","Tainacan Community","Tainacan","WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-10",0],["CVE-2026-97263","Greg Winiarski","WPAdverts","WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-102388","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-105885","10Web","Slider by 10Web","WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-10",0],["CVE-2026-108165","immich-app","immich","Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-108163","smp46","pingvin-share-x","Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-108164","opensource-socialnetwork","opensource-socialnetwork","Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route","HIGH",7.1,"2026-10-10",0],["CVE-2026-108162","smp46","pingvin-share-x","Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For","MEDIUM",6.9,"2026-10-10",0],["CVE-2026-108161","fusionpbx","fusionpbx","FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download","HIGH",7.7,"2026-10-10",0],["CVE-2026-107794","","ExtUtils-Typemaps-Default","ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an ","HIGH",7.5,"2026-10-10",0],["CVE-2013-10076","","ExtUtils-Typemaps-Default","ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on a","HIGH",7.5,"2026-10-10",0],["CVE-2026-107373","","ExtUtils-Typemaps-Default","ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may rea","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-103636","Apache Software Foundation","Apache DataSketches","Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization ","HIGH",7.5,"2026-10-10",0],["CVE-2026-103635","Apache Software Foundation","Apache DataSketches","Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserial","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-103513","Apache Software Foundation","Apache DataSketches","Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch dese","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-103501","Apache Software Foundation","Apache DataSketches","Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allo","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-106139","Progress Software","Kendo UI for Vue","Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-106138","Progress Software","KendoReact","Cross-Site Scripting via Chart Tooltip in KendoReact","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-108506","ZTE","Z80 Ultra","Unauthorized access vulnerability in ZTE Z80 Ultra product","MEDIUM",5.5,"2026-10-10",0],["CVE-2026-108505","ZTE","Z80 Ultra","Information disclosure vulnerability in ZTE Z80 Ultra product","LOW",3.3,"2026-10-10",0],["CVE-2026-107657","hivepress","HivePress – Business Directory, Listings & Classified Ads Plugin","HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribut","HIGH",7.2,"2026-10-10",0],["CVE-2026-104722","webilia","Listdom: AI-powered Business Directory with Classifieds Ads Listings","Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authentica","MEDIUM",4.9,"2026-10-10",0],["CVE-2026-4791","peprodev","PeproDev Ultimate Profile Solutions","PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-91136","Divi Essential","Divi Plus","Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter","HIGH",7.5,"2026-10-10",0],["CVE-2026-93951","Bracketweb","Zeinet","WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-103478","codename065","Premium Packages – Sell Digital Products Securely","Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'c","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-93746","webtoffee","WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0","HIGH",7.5,"2026-10-10",0],["CVE-2026-97340","ThemeFusion","Avada | Website Builder For WordPress & WooCommerce","Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-102291","themeum","Kirki – Freeform Page Builder, Website Builder & Customizer","Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subs","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-104759","wpo365","WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthentic","HIGH",8.1,"2026-10-10",0],["CVE-2026-102774","brainstormforce","SureDash – Community, Courses & Member Dashboard","SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-104728","rubengc","AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Info","MEDIUM",4.3,"2026-10-10",0],["CVE-2026-96653","wpdirectorykit","WP Directory Kit","WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' P","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-100178","gwin","WPAdverts – Classifieds Plugin","WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Pa","HIGH",7.2,"2026-10-10",0],["CVE-2026-96765","wpo365","WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthentic","HIGH",7.2,"2026-10-10",0],["CVE-2026-97396","retainful","Email Marketing for WordPress and WooCommerce – Retainful","Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stor","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-101921","smub","WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More","WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe sr","MEDIUM",4.7,"2026-10-10",0],["CVE-2026-104803","whyun","WPCOM Member","WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Param","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-100147","teamfunnelkit","FunnelKit – Funnel Builder for WooCommerce Checkout","FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (ship","HIGH",7.2,"2026-10-10",0],["CVE-2026-101920","molongui","Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress","Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via ","HIGH",7.2,"2026-10-10",0],["CVE-2026-96662","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_i","HIGH",7.5,"2026-10-10",0],["CVE-2026-96278","opajaap","WP Photo Album Plus","WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUES","HIGH",7.2,"2026-10-10",0],["CVE-2026-96563","stylemix","Motors – Car Dealership & Classified Listings Plugin","Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-108504","ZTE","Z80 Ultra","Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product","MEDIUM",5.5,"2026-10-10",0],["CVE-2026-62045","ThemeREX Group","Booklovers","WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-62046","ThemeREX Group","Gutentype","WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93942","ThemeREX Group","Dwell","WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93943","ThemeREX Group","Convex","WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93944","ThemeREX Group","Camelia","WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93945","Axiomthemes","Balance","WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93937","ThemeREX Group","Hygia","WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93938","ThemeREX Group","Hogwords","WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93940","ThemeREX Group","Greeny","WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93941","ThemeREX Group","Edema","WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93934","ThemeREX Group","Partiso","WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93935","ThemeREX Group","Let's Play","WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93936","ThemeREX Group","IPharm","WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93930","ThemeREX Group","Tantra","WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93931","ThemeREX Group","Smash","WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93932","ThemeREX Group","Smart Casa","WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93933","ThemeREX Group","Rosalinda","WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93927","Axiomthemes","Veto","WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93929","ThemeREX Group","Travesia","WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-93949","Omegathemes","Grocery Shopping Store","WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability","HIGH",7.1,"2026-10-10",0],["CVE-2026-93950","StylemixThemes","Motors","WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-10",0],["CVE-2026-106606","YITH","YITH WooCommerce Affiliates","WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerabilit","HIGH",7.2,"2026-10-10",0],["CVE-2026-108503","ZTE","Z80 Ultra","Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product","LOW",3.3,"2026-10-10",0],["CVE-2026-103427","wpinsider-1","Simple Membership","Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via C","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-96572","aguidrevitch","WP Meteor Website Speed Optimization Addon","WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site S","HIGH",7.2,"2026-10-10",0],["CVE-2026-104006","softaculous","SpeedyCache – Cache, Optimization, Performance","SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache C","LOW",3.7,"2026-10-10",0],["CVE-2026-107742","10web","10Web Booster – Website speed optimization, Cache & Page Speed optimizer","10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author N","HIGH",7.2,"2026-10-10",0],["CVE-2026-3717","bestwpdeveloper","WP CV Builder","CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthen","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-100196","wp_media","LazyLoad Plugin – Lazy Load Images, Videos, and Iframes","LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content","HIGH",7.2,"2026-10-10",0],["CVE-2026-102402","techlabpro1","Team – Team Members Showcase Plugin","Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_t","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-107712","murgroland","WP Booking System – Booking Calendar","WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_mont","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-5725","archetyped","Favicon Rotator","Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix","MEDIUM",6.1,"2026-10-10",0],["CVE-2026-6243","shabti","Frontend Admin by DynamiApps","Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site S","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-100161","villatheme","Photo Reviews for WooCommerce","Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scri","HIGH",7.2,"2026-10-10",0],["CVE-2026-94538","JoomUnited","WP File Download","WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary","HIGH",8.1,"2026-10-10",0],["CVE-2026-103897","dfactory","Responsive Lightbox & Gallery","Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripti","MEDIUM",4.4,"2026-10-10",0],["CVE-2026-104801","themeisle","PPOM – Product Addons & Custom Fields for WooCommerce","PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-89100","paymentplugins","Payment Plugins for Stripe WooCommerce","Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scriptin","MEDIUM",6.1,"2026-10-10",0],["CVE-2026-12626","ladela","Online Scheduling and Appointment Booking System – Bookly","Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Obj","HIGH",7.2,"2026-10-10",0],["CVE-2026-97348","gpriday","SiteOrigin Widgets Bundle","SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-95684","e4jvikwp","VikBooking Hotel Booking Engine & PMS","VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Script","HIGH",7.2,"2026-10-10",0],["CVE-2026-96574","wedevs","User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpu","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-96840","wpxpo","Post Grid Gutenberg Blocks – PostX","Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via disp","HIGH",7.2,"2026-10-10",0],["CVE-2026-15178","wpmanageninja","Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Ex","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-96558","expresstech","Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scrip","HIGH",7.2,"2026-10-10",0],["CVE-2026-108502","ZTE","Z80 Ultra","Information disclosure vulnerability in ZTE Z80 Ultra product","LOW",3.3,"2026-10-10",0],["CVE-2026-94256","","SMS Alert","SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP","HIGH",8.1,"2026-10-10",0],["CVE-2026-94257","","SMS Alert","SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Rese","HIGH",8.1,"2026-10-10",0],["CVE-2026-107120","","Contest Gallery","Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable R","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-107321","","W3 Total Cache","W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-107323","","Gallery PhotoBlocks","Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS","MEDIUM",6.8,"2026-10-10",0],["CVE-2026-85571","","Tutor LMS","Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-87780","","LTL Freight Quotes","LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shippi","HIGH",8.8,"2026-10-10",0],["CVE-2026-87781","","LTL Freight Quotes","LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipp","HIGH",8.6,"2026-10-10",0],["CVE-2026-105976","","Portfolio Filter Gallery","Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Ac","MEDIUM",4.7,"2026-10-10",0],["CVE-2026-105977","","Portfolio Filter Gallery","Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion ","LOW",2.2,"2026-10-10",0],["CVE-2026-105989","","Accept PayPal Payments using Contact Form 7","Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status F","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-105990","","Accept PayPal Payments using Contact Form 7","Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via C","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-105995","","Booking Package","Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-104752","","Rank Math SEO","Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import","HIGH",7.2,"2026-10-10",0],["CVE-2026-104753","","Rank Math SEO","Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter","MEDIUM",4.1,"2026-10-10",0],["CVE-2026-104754","","Rank Math SEO","Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL","LOW",3.5,"2026-10-10",0],["CVE-2026-12054","codename065","Download Manager","Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via ","MEDIUM",6.1,"2026-10-10",0],["CVE-2026-14335","smub","Easy Digital Downloads – eCommerce Payments and Subscriptions made easy","Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal I","HIGH",7.2,"2026-10-10",0],["CVE-2026-17025","silverks","Graphene","Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fi","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-103912","jetmonsters","JetFormBuilder — Dynamic Blocks Form Builder","JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic","MEDIUM",4.7,"2026-10-10",0],["CVE-2026-14882","themefusecom","Brizy – Page Builder","Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-comp","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-103482","picocodes","Noptin – Newsletter, New Post Notifications & Email Automation","Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subsc","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-14877","supsysticcom","Data Tables Generator by Supsystic","Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-93775","eteubert","Podlove Podcast Publisher","Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Aupho","HIGH",7.2,"2026-10-10",0],["CVE-2026-104723","lifterlms","LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes","LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Dat","HIGH",8.8,"2026-10-10",0],["CVE-2026-97643","stellarwp","GiveWP – Donation Plugin and Fundraising Platform","GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_cam","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-104762","stellarwp","Kadence Blocks — Page Builder Toolkit for Gutenberg Editor","Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block F","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-92975","trainingbusinesspros","Groundhogg — CRM, Newsletters, and Marketing Automation","Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confus","HIGH",8.1,"2026-10-10",0],["CVE-2026-96682","2winfactor","Presto Player","Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content v","HIGH",7.2,"2026-10-10",0],["CVE-2026-104899","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter","HIGH",8.1,"2026-10-10",0],["CVE-2026-18558","awsmin","Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files","Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vi","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-77183","foosales","FooSales – Point of Sale (POS) for WooCommerce","FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_custom","HIGH",8.8,"2026-10-10",0],["CVE-2026-91862","jetmonsters","Getwid – Gutenberg Blocks","Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-94421","andy_moyle","Church Admin","Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-94375","webtoffee","Order Export & Order Import for WooCommerce","Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Expo","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-96667","rameez_iqbal","Real Estate Manager – Property Listing and Agent Management","Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' ","HIGH",7.2,"2026-10-10",0],["CVE-2026-103520","hivepress","HivePress – Business Directory, Listings & Classified Ads Plugin","HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-104725","trainingbusinesspros","Groundhogg — CRM, Newsletters, and Marketing Automation","Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter","HIGH",8.8,"2026-10-10",0],["CVE-2026-104763","wpazleen","Post Export Import with Media","Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to","MEDIUM",4.9,"2026-10-10",0],["CVE-2026-14379","rubengc","GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI","GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-16776","sonaar","MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar","MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-83526","foliovision","FV Player 8","FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_w","HIGH",8.8,"2026-10-10",0],["CVE-2026-104742","senols","AI Puffer – AI Chatbot, AI Writer & Automation","AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search","LOW",3.1,"2026-10-10",0],["CVE-2026-104766","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'set","HIGH",8.8,"2026-10-10",0],["CVE-2026-104023","supsysticcom","Smart Popup by Supsystic","Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sid","MEDIUM",4.9,"2026-10-10",0],["CVE-2026-104741","senols","AI Puffer – AI Chatbot, AI Writer & Automation","AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin S","LOW",3.1,"2026-10-10",0],["CVE-2026-78068","jonua","Table Field Add-on for ACF and SCF","Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-S","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-18496","wpdevelop","Booking Calendar","Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXT","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-91050","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (S","MEDIUM",4.3,"2026-10-10",0],["CVE-2026-89301","rtcamp","rtMedia for WordPress, BuddyPress and bbPress","rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthe","HIGH",7.5,"2026-10-10",0],["CVE-2026-104021","hostspa","Fastcache by Host.it","Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htacces","HIGH",7.2,"2026-10-10",0],["CVE-2026-97670","themefusion","Avada (Fusion) Builder","Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation v","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-103998","10web","Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder","Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Arr","MEDIUM",6.1,"2026-10-10",0],["CVE-2026-104724","fireplugins","FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment","FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Conditi","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-9696","codename065","Download Manager","Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-103424","cleantalk","Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA","Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment C","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-6723","croixhaug","Simply Schedule Appointments","Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sen","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-103964","codename065","Download Manager","Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure vi","MEDIUM",4.3,"2026-10-10",0],["CVE-2026-104735","themeisle","RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Script","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-87869","stepasyuk","Filter Everything — WordPress & WooCommerce Filters","Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Script","MEDIUM",6.1,"2026-10-10",0],["CVE-2026-102401","codename065","Download Manager","Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-5727","elemntor","Hello Plus","Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activ","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-97630","foliovision","FV Flowplayer Video Player","FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-101324","wpmanageninja","Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Par","MEDIUM",4.7,"2026-10-10",0],["CVE-2026-103889","expivi","3D Product configurator for WooCommerce","3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution ","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-104993","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Cont","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-96648","supsysticcom","Data Tables Generator by Supsystic","Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Si","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-108501","ZTE","ZTE Z80 Ultra","Unauthorized access vulnerability in ZTE Z80 Ultra product","MEDIUM",5.7,"2026-10-10",0],["CVE-2026-94589","htplugins","Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 ","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-103365","ladela","Online Scheduling and Appointment Booking System – Bookly","Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Infor","MEDIUM",5.3,"2026-10-10",0],["CVE-2026-104732","inilerm","Advanced IP Blocker","Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 ","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-104797","nasirahmed","Advanced Form Integration — Connect Forms to 300+ Apps","Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authent","HIGH",8.1,"2026-10-10",0],["CVE-2026-107645","creativethemeshq","Blocksy Companion","Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-96743","jonua","Table Field Add-on for ACF and SCF","Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-104898","ladela","Online Scheduling and Appointment Booking System – Bookly","Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Referenc","MEDIUM",6.8,"2026-10-10",0],["CVE-2026-101947","CellHubs","ExifTool for photo and video","ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during C","HIGH",8.4,"2026-10-10",0],["CVE-2026-104022","kodezen","Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning","Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endp","MEDIUM",5.4,"2026-10-10",0],["CVE-2026-93883","pluginsware","Advanced Classifieds & Directory Pro","Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site ","MEDIUM",6.4,"2026-10-10",0],["CVE-2026-104915","kodezen","Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning","Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy ","MEDIUM",6.5,"2026-10-10",0],["CVE-2026-108474","JetBrains","Exposed","In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string argument","CRITICAL",9.8,"2026-10-10",0],["CVE-2026-22061","NetApp","Trident","CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident","HIGH",8.2,"2026-10-10",0],["CVE-2026-108269","Privasys","ra-tls-clients","ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-108268","Privasys","enclave-os-virtual","enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-108267","Privasys","go","Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS sessi","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-108266","Privasys","rustls","Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS s","CRITICAL",9.1,"2026-10-10",0],["CVE-2026-108265","Privasys","enclave-os-mini","enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-108264","wizarrrr","wizarr","Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-62376","go-vikunja","vikunja","Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables acco","HIGH",8.1,"2026-10-09",0],["CVE-2026-62367","go-vikunja","vikunja","Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-accoun","HIGH",7.5,"2026-10-09",0],["CVE-2026-108263","iflytek","astron-agent","Astron Agent: Unsandboxed code-node leads to cross-tenant RCE","CRITICAL",9.9,"2026-10-09",0],["CVE-2026-57458","go-vikunja","vikunja","Vikunja: Scoped API token can mint unrestricted OAuth session credentials","HIGH",8.1,"2026-10-09",0],["CVE-2026-108261","tinacms","tinacms","TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-108260","tinacms","tinacms","@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without sc","HIGH",7.6,"2026-10-09",0],["CVE-2026-92705","TypesettingTools","Aegisub","Aegisub executes arbitrary code through automatically loaded Automation scripts","HIGH",7.8,"2026-10-09",0],["CVE-2026-108259","tinacms","tinacms","Tina: Code injection via unescaped Git branch name in generated client source","HIGH",8.2,"2026-10-09",0],["CVE-2026-108258","posit-dev","py-shiny","Shiny for Python - Path traversal in bookmark restore","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107857","dongdongbh","Mindwtr","Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile","MEDIUM",4.4,"2026-10-09",0],["CVE-2026-107856","civiform","civiform","CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email","MEDIUM",4.5,"2026-10-09",0],["CVE-2026-107854","Jexactyl","Jexactyl","Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missi","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-107852","Jexactyl","Jexactyl","Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full","HIGH",7.1,"2026-10-09",0],["CVE-2026-107851","contao","contao","Contao: Improper access control in the table access voter","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-107850","contao","contao","Contao: Improper access control in the preview links module","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-107848","contao","contao","Contao: Cross-site request forgery in custom backend actions","LOW",3.5,"2026-10-09",0],["CVE-2026-107845","contao","contao","Contao: Cross-site scripting in the comments bundle","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-107844","contao","contao","Contao: Path traversal in the images controller","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107843","contao","contao","Contao: The registration module re-sends activation mails on any unauthenticated POST, wit","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107842","contao","contao","Contao: Protected page content is disclosed to anonymous visitors after contao.search.inde","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107841","john-broadway","pacioli","pacioli: A submit consent marker licensed cancellation of caller-named pre-existing docume","MEDIUM",5.7,"2026-10-09",0],["CVE-2026-108096","AWS","aws-amplify/graphql-index-transformer","Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Categor","HIGH",7.1,"2026-10-09",0],["CVE-2026-107840","jhaals","yopass","yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded met","HIGH",7.5,"2026-10-09",0],["CVE-2026-107839","luskaner","ageLANServer","ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to","HIGH",7.5,"2026-10-09",0],["CVE-2026-107838","RIOT-OS","RIOT","RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable as","HIGH",7.5,"2026-10-09",0],["CVE-2026-107837","RIOT-OS","RIOT","RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling","HIGH",8.2,"2026-10-09",0],["CVE-2026-107836","RIOT-OS","RIOT","RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled b","HIGH",7.1,"2026-10-09",0],["CVE-2026-107835","corazawaf","coraza","OWASP Coraza WAF: Cookie Parser Confusion","MEDIUM",4,"2026-10-09",0],["CVE-2026-107824","duty1g","x64dbg-mcp-server","x64dbg-MCP Server exposes debugger operations to unauthenticated network clients","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-107820","duty1g","x64dbg-mcp-server","x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Lengt","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107834","corazawaf","coraza","OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart b","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107833","corazawaf","coraza","OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustio","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-107826","corazawaf","coraza","OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-dept","HIGH",7.5,"2026-10-09",0],["CVE-2026-107825","corazawaf","coraza","OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure","MEDIUM",4,"2026-10-09",0],["CVE-2026-107823","MariaDB","server","MariaDB: privilege escalation via incorrect view frm parsing","HIGH",7.2,"2026-10-09",0],["CVE-2026-107822","MariaDB","server","MariaDB: database privilege escalation via user / role name collision in the acl cache","MEDIUM",6.4,"2026-10-09",0],["CVE-2026-107821","MariaDB","server","MariaDB: insufficient validation of binary frm data when opening a table","HIGH",8,"2026-10-09",0],["CVE-2026-107819","MariaDB","server","MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verific","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-107818","MariaDB","server","MariaDB: environment injection via wsrep bootstrap in the mariadb.service file","HIGH",8.4,"2026-10-09",0],["CVE-2026-107817","MariaDB","server","MariaDB: mysql_json plugin OOB reads","MEDIUM",4.4,"2026-10-09",0],["CVE-2026-107816","MariaDB","server","MariaDB: `qc_info` plugin can do OOB reads if query contains \\0","MEDIUM",6.4,"2026-10-09",0],["CVE-2026-42695","FolioVision","FV Flowplayer Video Player","WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vu","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-108119","Red Hat","Red Hat Hardened Images","Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypass","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-108093","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite load","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-55797","argoproj","argo-cd","Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL","HIGH",8.8,"2026-10-09",0],["CVE-2026-75597","pyload","pyload","pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitiv","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-48484","pyload","pyload","pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termina","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-107815","MariaDB","server","MariaDB: one byte OOB write in DOS tables of the CONNECT engine","HIGH",8.5,"2026-10-09",0],["CVE-2026-108160","iflytek","astron-rpa","AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed","HIGH",7.7,"2026-10-09",0],["CVE-2026-108159","iflytek","astron-rpa","AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge","HIGH",7.7,"2026-10-09",0],["CVE-2026-108157","smp46","pingvin-share-x","Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking","CRITICAL",9.2,"2026-10-09",0],["CVE-2026-108158","mynaparrot","plugNmeet-server","plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert","HIGH",7.1,"2026-10-09",0],["CVE-2016-20098","toolbox-team","reddit-moderator-toolbox","Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-108156","netease-youdao","LobsterAI","LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107814","MariaDB","server","MariaDB: Insecure $HOME in MariaDB rpm packages","HIGH",8.4,"2026-10-09",0],["CVE-2026-107813","0xJacky","nginx-ui","Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in R","HIGH",8.8,"2026-10-09",0],["CVE-2026-107812","0xJacky","nginx-ui","Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE","HIGH",7.5,"2026-10-09",0],["CVE-2026-107783","AWS","aws-tools-for-powershell","Insertion of sensitive information into log file in AWS Tools for PowerShell","MEDIUM",6.7,"2026-10-09",0],["CVE-2026-107811","0xJacky","nginx-ui","0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation ","HIGH",8.8,"2026-10-09",0],["CVE-2026-107810","0xJacky","nginx-ui","Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path b","HIGH",8.1,"2026-10-09",0],["CVE-2026-90983","Hayat Health Facilities Inc. (Hayat Hospital)","Hayat Mobile","OTP Code Exposure in Hayat Hospital's Hayat Mobile","HIGH",8.2,"2026-10-09",0],["CVE-2026-107809","0xJacky","nginx-ui","Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs","HIGH",8.8,"2026-10-09",0],["CVE-2026-107808","0xJacky","nginx-ui","Nginx UI: Authentication bypass: password login does not enforce a passkey-only second fac","HIGH",8.1,"2026-10-09",0],["CVE-2026-104084","Smartertools","Smartermail","SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token","HIGH",8.7,"2026-10-09",0],["CVE-2026-102554","Google","Guava","Denial of Service via Eager Array Allocation During Deserialization in Guava","HIGH",8.2,"2026-10-09",0],["CVE-2026-104083","Smartertools","Smartermail","SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-104082","Smartertools","Smartermail","SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount","HIGH",8.6,"2026-10-09",0],["CVE-2026-108112","ageerle","ruoyi-ai","ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-108113","ILIAS-eLearning e.V.","ILIAS","ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import","HIGH",8.7,"2026-10-09",0],["CVE-2026-108111","ageerle","ruoyi-ai","ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-108110","himovo","MOVO","MOVO through 0.2.3 Authorization Bypass via Document Endpoints","HIGH",7.6,"2026-10-09",0],["CVE-2026-107807","0xJacky","nginx-ui","Nginx UI: Node Secret Credential Exposure via URL Query Parameter","HIGH",8.8,"2026-10-09",0],["CVE-2026-107806","0xJacky","nginx-ui","Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","CRITICAL",9.4,"2026-10-09",0],["CVE-2026-108125","","wp-post-author","WordPress Post Author Authenticated SQLi","HIGH",7.1,"2026-10-09",0],["CVE-2026-15340","Savannah","lwIP SMTP client","Savannah lwIP SMTP client Classic Buffer Overflow","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-108124","","wp-post-author","WordPress Post Author Authenticated SQLi","MEDIUM",4.9,"2026-10-09",0],["CVE-2026-107805","0xJacky","nginx-ui","Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage","HIGH",7.5,"2026-10-09",0],["CVE-2026-107804","0xJacky","nginx-ui","Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-95702","Google","gVisor","Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile","HIGH",8.5,"2026-10-09",0],["CVE-2026-33272","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Chann","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-39453","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Reachable Assertion","HIGH",8.5,"2026-10-09",0],["CVE-2026-29797","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check","HIGH",8.4,"2026-10-09",0],["CVE-2026-33367","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-28745","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-108109","hotspotbilling","phpnuxbill","PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-108108","hotspotbilling","phpnuxbill","PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()","HIGH",7.1,"2026-10-09",0],["CVE-2026-108107","hotspotbilling","phpnuxbill","PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-108106","xerial","snappy-java","Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service","HIGH",8.7,"2026-10-09",0],["CVE-2026-108104","xerial","snappy-java","Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFram","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-39460","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-104115","illumos","illumos-gate","Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-32645","Red Lion Controls","700 Series","Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials","CRITICAL",9.2,"2026-10-09",0],["CVE-2026-104114","illumos","illumos-gate","NULL pointer dereference in illumos nwamd door handler allows local users to crash the dae","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-104112","illumos","illumos-gate","Missing release of passed file descriptors in illumos nscd allows local users to exhaust k","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-104116","illumos","illumos-gate","Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enum","LOW",1.9,"2026-10-09",0],["CVE-2026-104113","OmniOS","OmniOS","Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-104117","illumos","illumos-gate","Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP grou","LOW",1.9,"2026-10-09",0],["CVE-2026-104081","kalcaddle","KodExplorer","KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction","HIGH",7.2,"2026-10-09",0],["CVE-2026-102916","illumos","illumos-gate","Reachable assertion in illumos bhyve REP string instruction emulation allows guest to pani","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-108105","open5gs","open5gs","Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request","HIGH",8.2,"2026-10-09",0],["CVE-2026-108103","open5gs","open5gs","Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-108102","open5gs","open5gs","Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-108101","danielbrendel","hortusfox-web","HortusFox through 6.3 Unrestricted File Upload via Plant Attachments","HIGH",7.7,"2026-10-09",0],["CVE-2026-108100","danielbrendel","hortusfox-web","HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter","HIGH",7.1,"2026-10-09",0],["CVE-2026-105278","Grid Protection Alliance","openPDC (Docker image)","Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-94063","ThemeREX","Education Center","WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerab","HIGH",7.1,"2026-10-09",0],["CVE-2026-94064","BuddhaThemes","Neo | Barber Shop WordPress Theme","WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerabil","HIGH",8.8,"2026-10-09",0],["CVE-2026-94065","BuddhaThemes","ColorFolio","WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-09",0],["CVE-2026-94066","SpabRice","Pond","WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94067","Fuelthemes","The Voux","WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-09",0],["CVE-2026-104629","Grid Protection Alliance","openPDC","Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to S","HIGH",7.7,"2026-10-09",0],["CVE-2026-101022","Grid Protection Alliance","openPDC","Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-85479","Grid Protection Alliance","openPDC","Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Fun","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-105281","Grid Protection Alliance","openPDC","Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Fun","HIGH",8.7,"2026-10-09",0],["CVE-2026-100730","Grid Protection Alliance","openPDC","Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-106581","Docker","Docker Desktop","Docker Desktop for Windows installer failed to verify external packages","HIGH",8.2,"2026-10-09",0],["CVE-2026-107803","ProcessMaker","processmaker","ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-108063","Red Hat","Red Hat Enterprise Linux 10","Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dicti","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-92085","TMT Machinery Industry and Trade Co. Ltd.","Talassoft Industrial Management Software","Stored XSS in TMT Machine's Talassoft Industrial Management Software","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-107785","Sirius Computer, Inc.","Crux Agent","Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-62026","MIGHTYminnow","Dashboard Notes","WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerabilit","HIGH",7.1,"2026-10-09",0],["CVE-2026-94058","Bracketweb","Treck","WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94059","Bracketweb","Ogency","WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94060","Bracketweb","Voldor","WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94061","Designthemes","Whistle - Sports Club","WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulner","HIGH",7.1,"2026-10-09",0],["CVE-2026-94062","Fuelthemes","Werkstatt","WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability","HIGH",8.1,"2026-10-09",0],["CVE-2026-103413","Apache Software Foundation","Apache Camel Karavan","Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes","HIGH",8.8,"2026-10-09",0],["CVE-2026-103412","Apache Software Foundation","Apache Camel Karavan","Apache Camel Karavan: project file name path traversal when committing a project to Git","HIGH",8.8,"2026-10-09",0],["CVE-2026-86405","Sipay Electronic Money and Payment Services Inc.","PrestaShop Virtual POS Module","Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-103220","canva","affinity","The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adeq","MEDIUM",4.5,"2026-10-09",0],["CVE-2026-101130","canva","affinity","The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adeq","LOW",3.6,"2026-10-09",0],["CVE-2026-101094","canva","affinity","The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly ha","LOW",3.6,"2026-10-09",0],["CVE-2026-96396","canva","affinity","The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not sa","MEDIUM",4.9,"2026-10-09",0],["CVE-2026-96395","canva","affinity","The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform ad","LOW",3.6,"2026-10-09",0],["CVE-2026-96394","canva","affinity","The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not va","LOW",2.9,"2026-10-09",0],["CVE-2026-96393","canva","affinity","The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bou","LOW",3.6,"2026-10-09",0],["CVE-2026-85531","Sipay Electronic Money and Payment Services Inc.","OpenCart Virtual POS Module","Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-62028","bPlugins","Before After Image Comparison – Image comparison for WP","WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broke","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-8374","SwitchBot","Lock Series Lock","Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication","HIGH",8.5,"2026-10-09",0],["CVE-2026-105883","ThemeHunk","Th Shop Mania","WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-106601","Automattic","Jetpack","WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-106602","Automattic","Jetpack","WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability","MEDIUM",4.8,"2026-10-09",0],["CVE-2026-104392","ExpressTech","Quiz And Survey Master","WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-09",0],["CVE-2026-105318","Datasolution","AcyMailing SMTP Newsletter","WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnera","HIGH",7.1,"2026-10-09",0],["CVE-2026-105870","Delight Star Inc.","WP Associate Post R2","WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-105872","mklacroix","Product Configurator for WooCommerce","WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vuln","HIGH",7.2,"2026-10-09",0],["CVE-2026-105877","QuarkA","QA Analytics","WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-104079","Syed Balkhi","Envira Gallery","Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-62029","WPFunnels Team","WPFunnels","WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-62036","AREOI","All Bootstrap Blocks","WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-39779","Asgaros","Asgaros Forum","WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-62039","bPlugins","Html5 Audio Player","WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-62040","DEV Institute","Restrict User Access – Membership Plugin with Force","WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Acc","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-62041","Ashok Dudhat","WP Event Manager","WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-62042","unFocus Projects","Scripts n Styles","WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107419","Cool Plugins","AI Translation for Polylang","WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerabilit","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-103329","","Super Payments","Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signatu","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-86851","","Livees Checkout","Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & ","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-87846","","Shipping for Nova Poshta","Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-85348","","GDPR Data Request Form","GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-89235","","Testimonials by BestWebSoft","Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-108039","Apache Software Foundation","Apache CXF","Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and","HIGH",7.5,"2026-10-09",0],["CVE-2026-107938","Apache Software Foundation","Apache CXF","Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-107937","Apache Software Foundation","Apache CXF","Apache CXF: The attachment header size and count limits can be bypassed, which allows deni","HIGH",7.5,"2026-10-09",0],["CVE-2026-100227","Apache Software Foundation","Apache CXF","Apache CXF: XML Signature wrapping in JAX-RS XML Security","HIGH",7.5,"2026-10-09",0],["CVE-2026-97791","Apache Software Foundation","Apache CXF","Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares valid","HIGH",7.5,"2026-10-09",0],["CVE-2026-97468","Apache Software Foundation","Apache CXF","Apache CXF: Authentication bypass via weak cache keys for validated STS tokens","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-86463","Apache Software Foundation","Apache CXF","Apache CXF: FIQL Query Parser Denial of Service","HIGH",7.5,"2026-10-09",0],["CVE-2026-79650","Apache Software Foundation","Apache CXF","Apache CXF: OIDC RP Open Redirect","MEDIUM",6.1,"2026-10-09",0],["CVE-2026-78384","Apache Software Foundation","Apache CXF","Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompres","HIGH",7.5,"2026-10-09",0],["CVE-2026-73179","Apache Software Foundation","Apache CXF","Apache CXF: JPA authorization-code consume is non-atomic","HIGH",8.1,"2026-10-09",0],["CVE-2026-71575","Apache Software Foundation","Apache CXF","Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFil","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-93947","Shinetheme","Traveler","WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-94158","bkninja","Gloria Admin Panel","WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerab","HIGH",7.1,"2026-10-09",0],["CVE-2026-94159","KlbTheme","Total Donations","WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94161","ThemeGoods","Grand Restaurant","WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerabi","HIGH",7.1,"2026-10-09",0],["CVE-2026-94167","Extend Themes","Kubio AI Page Builder","WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94170","Heateor Support","Sassy Social Share","WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94503","PX-lab","Zombify","WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability","CRITICAL",10,"2026-10-09",0],["CVE-2026-96334","ThemeGrill","User Registration","WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability","MEDIUM",5.6,"2026-10-09",0],["CVE-2026-94664","add-ons.org","PDF for Contact Form 7","WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability","HIGH",7.5,"2026-10-09",0],["CVE-2026-94666","ZealousWeb","Generate PDF using Contact Form 7","WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vuln","HIGH",7.5,"2026-10-09",0],["CVE-2026-96332","yalla ya!","Simple Payment","WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96607","Basix","NEX-Forms","WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94661","Crocoblock","JetBlog","WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94663","Metagauss","ProfileGrid","WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability","HIGH",8.5,"2026-10-09",0],["CVE-2026-94665","Mamunur Rashid","Classified Listing","WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-94667","Crocoblock","JetReviews","WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-94668","Dimitri Grassi","Salon booking system","WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerabilit","HIGH",7.1,"2026-10-09",0],["CVE-2026-95589","Magepeople inc.","Deposits and Partial Payments for WooCommerce","WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Co","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-94415","Muffingroup","Betheme","WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-94632","Stiofan","BlockStrap Page Builder - Bootstrap Blocks","WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripti","HIGH",7.1,"2026-10-09",0],["CVE-2026-94641","Stiofan","UsersWP","WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96809","MultiNet Interactive AB","EduAdmin Booking","WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-94166","UpSolution","UpSolution Core","WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96761","Welcart","Welcart e-Commerce","WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96331","wpdreams","Ajax Search Pro","WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-96671","fifu.app","Featured Image from URL","WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vuln","HIGH",8.8,"2026-10-09",0],["CVE-2026-95598","codepeople","Search in Place","WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-95599","Taskbuilder","Taskbuilder","WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability","HIGH",8.5,"2026-10-09",0],["CVE-2026-95609","David Lingren","Media LIbrary Assistant","WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilit","HIGH",7.1,"2026-10-09",0],["CVE-2026-96328","jegtheme","JNews - Pay Writer","WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-96329","tagDiv","tagDiv Opt-In Builder","WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","HIGH",8.5,"2026-10-09",0],["CVE-2026-96330","tagDiv","tagDiv Opt-In Builder","WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-94568","WP Hosting AS","Pay with Vipps for WooCommerce","WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerabil","HIGH",7.2,"2026-10-09",0],["CVE-2026-95591","e4jvikwp","VikBooking Hotel Booking Engine & PMS","WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (X","HIGH",7.1,"2026-10-09",0],["CVE-2026-95596","Mamunur Rashid","ShopBuilder – Elementor WooCommerce Builder Addons","WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site ","HIGH",7.1,"2026-10-09",0],["CVE-2026-95597","codemstory","워드프레스 결제 심플페이","WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-95607","VibeThemes","WPLMS","WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability","HIGH",8.5,"2026-10-09",0],["CVE-2026-95608","PluginUs.Net","HUSKY","WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96327","VibeThemes","WPLMS","WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-95610","UpSolution","UpSolution Core","WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability","HIGH",8.5,"2026-10-09",0],["CVE-2026-96461","TMS","Amelia","WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-09",0],["CVE-2026-96333","Liquid Web / StellarWP","GiveWP","WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability","HIGH",7.5,"2026-10-09",0],["CVE-2026-96337","properfraction","ProfilePress","WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-96518","properfraction","ProfilePress","WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-96539","Ultimate Member","Ultimate Member","WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","MEDIUM",5.6,"2026-10-09",0],["CVE-2026-96553","Damian Góra","FiboSearch","WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-09",0],["CVE-2026-96336","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability","HIGH",7.5,"2026-10-09",0],["CVE-2026-78341","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-78340","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-71884","Legion of the Bouncy Castle Inc.","BC-LTS-JAVA","Packet CTR reports a full success length after the counter is exhausted","HIGH",8.2,"2026-10-09",0],["CVE-2026-78339","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-78027","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",5.8,"2026-10-09",0],["CVE-2026-78026","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-62049","Crocoblock","JetBlocks For Elementor","WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerabi","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-78025","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.5,"2026-10-09",0],["CVE-2026-78024","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.7,"2026-10-09",0],["CVE-2026-78023","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.1,"2026-10-09",0],["CVE-2026-107935","Red Hat","Red Hat Build of Podman Desktop","Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-78022","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-107655","Red Hat","Red Hat Hardened Images","Cups: null pointer dereference via embedded job ticket comments allows remote denial of se","MEDIUM",4,"2026-10-09",0],["CVE-2026-78021","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3.7,"2026-10-09",0],["CVE-2026-78020","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.5,"2026-10-09",0],["CVE-2026-78019","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.5,"2026-10-09",0],["CVE-2026-78018","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.3,"2026-10-09",0],["CVE-2026-78017","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3.8,"2026-10-09",0],["CVE-2026-78016","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3.1,"2026-10-09",0],["CVE-2026-78015","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3.7,"2026-10-09",0],["CVE-2026-78013","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",5.2,"2026-10-09",0],["CVE-2026-76779","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.4,"2026-10-09",0],["CVE-2026-104635","elixir-protobuf","protobuf","Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messa","HIGH",8.2,"2026-10-09",0],["CVE-2026-76769","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-84220","","Kirki","Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection","MEDIUM",4.8,"2026-10-09",0],["CVE-2026-84224","","Kirki","Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL","MEDIUM",4.1,"2026-10-09",0],["CVE-2026-97075","WP Media","WP Rocket","WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-4264","BeeTienda","eCommerce Platform","Reflected Cross-Site Scripting in BeeTienda eCommerce platform","MEDIUM",5.1,"2026-10-09",0],["CVE-2025-14123","davidanderson","Redux Framework","Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Ext","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-98384","Linux","Linux","bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()","","","2026-10-09",0],["CVE-2026-98383","Linux","Linux","bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL","HIGH",7.8,"2026-10-09",0],["CVE-2026-98381","Linux","Linux","veth: manage XDP program pointers during channel resize","HIGH",7.8,"2026-10-09",0],["CVE-2026-98382","Linux","Linux","bpf: Reject dev-bound-only programs on other devices","HIGH",7.8,"2026-10-09",0],["CVE-2026-98380","Linux","Linux","net/sched: reject IDR error pointers when deleting actions","","","2026-10-09",0],["CVE-2026-98379","Linux","Linux","netfilter: ip6t_rpfilter: reject routes without inet6_dev","","","2026-10-09",0],["CVE-2026-98378","Linux","Linux","bpf: Skip unsettled links in link iterator","HIGH",7.8,"2026-10-09",0],["CVE-2026-98376","Linux","Linux","bpf: Use array_map_meta_equal for percpu array inner map replacement","HIGH",7.8,"2026-10-09",0],["CVE-2026-98377","Linux","Linux","vlan: require the MAC header to be present in __vlan_insert_inner_tag()","","","2026-10-09",0],["CVE-2026-19575","zephyrproject","zephyr","Type confusion in the device_deinit system call allows user-mode threads to execute arbitr","HIGH",7.8,"2026-10-09",0],["CVE-2026-19569","zephyrproject","zephyr","Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt t","HIGH",8.8,"2026-10-09",0],["CVE-2026-19574","zephyrproject","zephyr","ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isol","HIGH",7,"2026-10-09",0],["CVE-2026-19571","zephyrproject","zephyr","Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an ","MEDIUM",6.7,"2026-10-09",0],["CVE-2026-19570","zephyrproject","zephyr","Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into th","HIGH",8.8,"2026-10-09",0],["CVE-2026-98375","Linux","Linux","xen/netfront: drop RX packets with a short Ethernet header","","","2026-10-09",0],["CVE-2026-106155","Progress Software","Telerik Report Server","Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers","HIGH",8.9,"2026-10-09",0],["CVE-2026-106145","Progress Software","Telerik Report Server","Privilege Escalation in Telerik Report Server Service-Agent Hub","HIGH",7.1,"2026-10-09",0],["CVE-2026-101028","ash-project","ash","Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters a","MEDIUM",6,"2026-10-09",0],["CVE-2026-97076","WP Media","WP Rocket","WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability","HIGH",7.5,"2026-10-09",0],["CVE-2026-81929","OceanWP","Ocean Pro Demos","Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cr","HIGH",7.2,"2026-10-09",0],["CVE-2026-106097","","Code Snippets","Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Creden","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-93548","","FooSales","FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation","HIGH",8.8,"2026-10-09",0],["CVE-2025-15700","","AWP Classifieds","AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import","HIGH",8.8,"2026-10-09",0],["CVE-2026-106095","","Code Snippets","Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via upd","LOW",3.3,"2026-10-09",0],["CVE-2026-87841","","UnitechPay","UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-86850","","SKU Error Fixer for WooCommerce","SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deleti","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-88931","","Social Web Suite","Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-92989","","SendPress Newsletters","SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-92990","","SendPress Newsletters","SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded T","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-87109","MongoDB","Ops Manager","Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings","MEDIUM",6,"2026-10-09",0],["CVE-2026-87108","MongoDB","Ops Manager","Ops Manager Improper Authorization in Daily Host Monitoring Retrieval","LOW",2.3,"2026-10-09",0],["CVE-2026-87110","MongoDB","Ops Manager","Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107914","backdropcms","Backdrop","Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect config","HIGH",7.8,"2026-10-09",0],["CVE-2026-107911","FalkorDB","FalkorDB","Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument","HIGH",7.7,"2026-10-09",0],["CVE-2026-107910","FalkorDB","FalkorDB","Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling","CRITICAL",9.2,"2026-10-09",0],["CVE-2026-107909","FalkorDB","FalkorDB","Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via ","HIGH",8.8,"2026-10-09",0],["CVE-2026-107908","FalkorDB","FalkorDB","Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET mes","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-107889","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-107890","OpenPrinting","CUPS","OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP","LOW",3.3,"2026-10-09",0],["CVE-2026-107888","OpenPrinting","CUPS","OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() wh","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-7826","FalkorDB","FalkorDB","Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB","HIGH",8.8,"2026-10-09",0],["CVE-2026-7827","FalkorDB","FalkorDB","Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in cra","CRITICAL",9.2,"2026-10-09",0],["CVE-2026-5759","FalkorDB","FalkorDB","Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code executio","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-107886","OpenPrinting","CUPS","OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When C","LOW",2.3,"2026-10-09",0],["CVE-2026-107885","OpenPrinting","CUPS","OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submi","LOW",3.3,"2026-10-09",0],["CVE-2025-61560","","","A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Found","HIGH",8.1,"2026-10-09",0],["CVE-2026-75345","","","OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit ","HIGH",7.5,"2026-10-09",0],["CVE-2026-75346","","","An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through","HIGH",7.5,"2026-10-09",0],["CVE-2026-75347","","","EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer deref","HIGH",7.5,"2026-10-09",0],["CVE-2026-75348","","","An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to c","HIGH",7.5,"2026-10-09",0],["CVE-2026-75349","","","EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vul","HIGH",7.5,"2026-10-09",0],["CVE-2026-75350","","","EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAtt","HIGH",7.5,"2026-10-09",0],["CVE-2026-75351","","","OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ","HIGH",7.5,"2026-10-09",0],["CVE-2026-75352","","","OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP F","HIGH",7.5,"2026-10-09",0],["CVE-2026-75353","","","OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP","HIGH",7.5,"2026-10-09",0],["CVE-2026-78795","","","An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241","HIGH",7.5,"2026-10-09",0],["CVE-2026-78796","","","An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-78797","","","An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbit","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-78835","","","Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protecte","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-79363","","","Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Br","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-97032","Go standard library","net/http","HTTP/2 server crash due to HPACK encoder race in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-78660","Go standard library","net/http","HTTP/2 transport accepts malformed framing-related headers in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-78663","Go standard library","net/http","Double flow control refund on HTTP/2 server streams in net/http","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-78667","Go standard library","net/http","Lack of limit on size of parsed Range headers in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-78669","Go standard library","net/http","Excessive CPU consumption from repeated initial window changes in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-94439","Go standard library","net/http","HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-56857","Go standard library","os","Root.Mkdir(All) can follow junctions out of the root on Windows in os","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-56866","Go standard library","net/http","HTTP/1 client connection desynchronization after CONNECT rejection in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-78659","Go standard library","net/http","HTTP/2 server memory exhaustion due to Trailer headers in net/http","HIGH",7.5,"2026-10-09",0],["CVE-2026-94440","Go standard library","net/textproto","Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart","HIGH",7.5,"2026-10-09",0],["CVE-2026-97031","Go standard library","crypto/tls","Reject malformed ECH outer extension references in crypto/tls","HIGH",7.5,"2026-10-09",0],["CVE-2026-94444","Go toolchain","cmd/go","Checksum bypass for golang.org/fips140 in cmd/go","HIGH",7.8,"2026-10-09",0],["CVE-2026-94447","Go toolchain","cmd/go","Checksum database bypass for golang.org/toolchain in cmd/go","HIGH",7.8,"2026-10-09",0],["CVE-2026-94448","Go standard library","html/template","Reset context tracking on consecutive template expressions in html/template","MEDIUM",6.1,"2026-10-09",0],["CVE-2026-97030","Go standard library","html/template","Recognize yield as regexp preceder keyword in html/template","MEDIUM",6.1,"2026-10-09",0],["CVE-2026-107802","sumatrapdfreader","sumatrapdf","SumatraPDF — Windows command-line argument injection in AI selection-translate","HIGH",7.1,"2026-10-09",0],["CVE-2026-107738","sumatrapdfreader","sumatrapdf","SumatraPDF: Untrusted binary record offset used without lower-bound validation","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-107737","sumatrapdfreader","sumatrapdf","SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup","MEDIUM",5.7,"2026-10-09",0],["CVE-2026-107736","sumatrapdfreader","sumatrapdf","SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-107735","sumatrapdfreader","sumatrapdf","SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initia","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-107734","sumatrapdfreader","sumatrapdf","SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Executi","HIGH",7.1,"2026-10-09",0],["CVE-2026-107733","sumatrapdfreader","sumatrapdf","SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-107732","sumatrapdfreader","sumatrapdf","SumatraPDF: Markup/command-link injection into UI notification text","HIGH",8.4,"2026-10-09",0],["CVE-2026-105674","TP-Link Systems Inc.","Tapo C325WB v2","Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB","HIGH",8.7,"2026-10-09",0],["CVE-2026-105672","TP-Link Systems Inc.","Tapo C325WB v2","Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB","HIGH",8.7,"2026-10-09",0],["CVE-2026-105673","TP-Link Systems Inc.","Tapo C325WB v2","Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB","HIGH",7.1,"2026-10-09",0],["CVE-2026-107731","sumatrapdfreader","sumatrapdf","SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of se","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-107730","sumatrapdfreader","sumatrapdf","SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-107651","Red Hat","Red Hat Enterprise Linux 6","Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-107729","sumatrapdfreader","sumatrapdf","SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes ","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-96207","Microsoft","Microsoft Partner Center","Microsoft Partner Center Elevation of Privilege Vulnerability","CRITICAL",10,"2026-10-09",0],["CVE-2026-88131","Microsoft","Microsoft Dataverse","Microsoft Dataverse Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-94510","Microsoft","Microsoft Bookings","Microsoft Bookings Elevation of Privilege Vulnerability","CRITICAL",9.9,"2026-10-09",0],["CVE-2026-83943","Microsoft","Azure API Center","Azure API Center Information Disclosure Vulnerability","HIGH",8.7,"2026-10-09",0],["CVE-2026-83947","Microsoft","Azure Event Grid System","Azure Event Grid Spoofing Vulnerability","HIGH",7.7,"2026-10-09",0],["CVE-2026-77900","Microsoft","Azure App Service for Linux","Azure App Service Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-69435","Microsoft","Azure SRE Agent","Azure SRE Agent Elevation of Privilege Vulnerability","CRITICAL",9.6,"2026-10-09",0],["CVE-2026-107728","strawberry-graphql","strawberry","Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization res","HIGH",7.5,"2026-10-09",0],["CVE-2026-107727","strawberry-graphql","strawberry","Strawberry legacy graphql-ws retains naturally completed subscription slots","LOW",3.7,"2026-10-09",0],["CVE-2026-107726","hazelcast","hazelcast","Hazelcast: Arbitrary member memory access by low-privileged client","CRITICAL",9.3,"2026-10-09",0],["CVE-2026-107725","hazelcast","hazelcast","Hazelcast: Authorization bypass in IMap Predicates API","HIGH",8.7,"2026-10-09",0],["CVE-2026-107724","nearform","fast-jwt","fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery","HIGH",7.4,"2026-10-09",0],["CVE-2026-107830","banq","jivejdon","Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoi","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107831","banq","jivejdon","Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107829","banq","jivejdon","Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql","HIGH",8.2,"2026-10-09",0],["CVE-2026-107828","banq","jivejdon","Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107800","banq","jivejdon","Jivejdon through 5.0 Stored XSS via Private Short Messages","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-107801","banq","jivejdon","Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-107798","banq","jivejdon","Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filt","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-107799","banq","jivejdon","Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering","MEDIUM",5.1,"2026-10-09",0],["CVE-2026-107796","banq","jivejdon","Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Pa","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107797","banq","jivejdon","Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107792","banq","jivejdon","Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thr","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107793","banq","jivejdon","Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete","MEDIUM",5.3,"2026-10-09",0],["CVE-2025-71428","banq","jivejdon","Jivejdon through 5.0 SQL Injection via username in userListAction","MEDIUM",6.9,"2026-10-09",0],["CVE-2026-107723","nearform","fast-jwt","fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array","HIGH",8.1,"2026-10-09",0],["CVE-2026-107722","nearform","fast-jwt","fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS2","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-89091","Red Hat","Migration Toolkit for Applications 8","Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows a","HIGH",8.8,"2026-10-09",0],["CVE-2026-107721","nearform","fast-jwt","fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persi","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-107720","nearform","fast-jwt","fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is ex","HIGH",7.4,"2026-10-09",0],["CVE-2026-107719","nearform","fast-jwt","fast-jwt: Verifier cache accepts expired JWTs without iat.","MEDIUM",4.2,"2026-10-09",0],["CVE-2026-107718","adonisjs","http-server","AdonisJS: Unencoded route parameters can produce open redirects","MEDIUM",6.1,"2026-10-09",0],["CVE-2026-107717","masci","banks","Banks: User-controlled prompt input can be parsed as privileged chat messages","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-107716","masci","banks","Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistr","HIGH",7.3,"2026-10-09",0],["CVE-2026-75875","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-80381","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-82895","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.1,"2026-10-09",0],["CVE-2026-82900","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.1,"2026-10-09",0],["CVE-2026-105269","Satel","Satel Netco Design","Satel Netco Design Cross-site Scripting","HIGH",8.5,"2026-10-09",0],["CVE-2026-81932","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.6,"2026-10-09",0],["CVE-2026-84032","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities","MEDIUM",5.6,"2026-10-09",0],["CVE-2026-84035","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.1,"2026-10-09",0],["CVE-2026-84057","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.1,"2026-10-09",0],["CVE-2026-84058","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.1,"2026-10-09",0],["CVE-2026-84198","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.1,"2026-10-09",0],["CVE-2026-84209","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.1,"2026-10-09",0],["CVE-2026-84230","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities","HIGH",7.5,"2026-10-09",0],["CVE-2026-84246","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",8.1,"2026-10-09",0],["CVE-2026-84247","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.1,"2026-10-09",0],["CVE-2026-84249","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by vulnerability","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-84875","IBM","Guardium Data Protection","Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protect","HIGH",7.5,"2026-10-09",0],["CVE-2026-84891","IBM","Guardium Data Protection","Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Prot","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-107715","sparklemotion","mechanize","Mechanize sends credential headers to another host after an HTTP redirect","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-107714","sparklemotion","mechanize","Mechanize sends credential headers to a different scheme or port after a redirect","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-87980","IBM","Guardium Data Protection","Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Prote","LOW",3.1,"2026-10-09",0],["CVE-2026-107399","sparklemotion","mechanize","Mechanize sends credential headers to another origin after a meta refresh","MEDIUM",6.8,"2026-10-09",0],["CVE-2026-104628","Satel","Satel Netco Design","Satel Netco Design Inefficient Regular Expression Complexity","HIGH",7.1,"2026-10-09",0],["CVE-2026-105275","Satel","Satel Netco Design","Satel Netco Design Relative Path Traversal","MEDIUM",5.3,"2026-10-09",0],["CVE-2026-107406","NetScaler","ADC","Memory overflow vulnerability leading to Remote Code Execution or Denial of Service","CRITICAL",9.5,"2026-10-09",0],["CVE-2026-11318","Zuler Technology","DeskIn","Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer","HIGH",8.5,"2026-10-09",0],["CVE-2026-101024","Satel","Satel Netco Design","Satel Netco Design Relative path traversal","HIGH",8.7,"2026-10-09",0],["CVE-2026-11888","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",6.4,"2026-10-09",0],["CVE-2026-11930","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-11939","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","LOW",2.7,"2026-10-09",0],["CVE-2026-16823","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-16830","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-16916","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-17189","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","HIGH",8.2,"2026-10-09",0],["CVE-2026-18740","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","HIGH",8.8,"2026-10-09",0],["CVE-2026-19491","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","CRITICAL",9.1,"2026-10-09",0],["CVE-2026-19494","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","HIGH",8.1,"2026-10-09",0],["CVE-2026-19498","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",5.9,"2026-10-09",0],["CVE-2026-19493","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","HIGH",7.5,"2026-10-09",0],["CVE-2026-19482","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","HIGH",8.8,"2026-10-09",0],["CVE-2026-78399","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-78388","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",4.3,"2026-10-09",0],["CVE-2026-78401","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-78406","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","CRITICAL",9.8,"2026-10-09",0],["CVE-2026-19878","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",6.5,"2026-10-09",0],["CVE-2026-12091","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","LOW",3.7,"2026-10-09",0],["CVE-2026-11936","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",4.9,"2026-10-09",0],["CVE-2026-12109","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",5.5,"2026-10-09",0],["CVE-2026-78407","IBM","Security Verify Access","Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Ve","MEDIUM",5.4,"2026-10-09",0],["CVE-2026-102368","TP-Link System Inc.","Tapo S505 v1.6","Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-79842","Hewlett Packard Enterprise","HPE Intelligent Management Center (iMC)","An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) p","CRITICAL",9.1,"2026-10-08",0],["CVE-2026-107318","@fastify/reply-from","@fastify/reply-from","@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transp","HIGH",7.4,"2026-10-08",0],["CVE-2026-107781","dromara","skyeye","Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById","CRITICAL",9.1,"2026-10-08",0],["CVE-2026-107782","winsiderss","System Informer","System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port","HIGH",8.5,"2026-10-08",0],["CVE-2026-107780","dromara","skyeye","Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107778","MIT","krb5","MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()","HIGH",7.1,"2026-10-08",0],["CVE-2026-107779","dromara","skyeye","Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107708","MIT","krb5","MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-106435","MongoDB","Python Driver","Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Pyt","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107397","indico","indico","Indico: Cross-Site-Scripting in minutes editor","MEDIUM",4.4,"2026-10-08",0],["CVE-2026-107396","indico","indico","Indico: Cross-Site-Scripting in link fields","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-107395","indico","indico","Indico: Missing access check in legacy session export API","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-107394","indico","indico","Indico: Incomplete Server-Side Request Forgery (SSRF) check","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-107393","freescout-help-desk","freescout","FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-I","MEDIUM",6.1,"2026-10-08",0],["CVE-2026-107707","Intego","Intego Antivirus","Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Juncti","HIGH",8.5,"2026-10-08",0],["CVE-2026-107706","Dolibarr","dolibarr","Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107705","freedesktop","poppler","Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()","HIGH",8.3,"2026-10-08",0],["CVE-2026-106126","Tenable, Inc.","Tenable Identity Exposure (SaaS)","Command Injection","CRITICAL",9.4,"2026-10-08",0],["CVE-2026-107608","AWS","aws-cdk-lib","Improper link resolution in asset bundling output handling in aws-cdk-lib","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-104076","TVU Networks","TVU Receiver / Transceiver","TVU Networks Receiver/Transceiver Missing Authentication via REST API","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-104075","TVU Networks","TVU Receiver / Transceiver","TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-82334","IBM","Guardium Data Protection","IBM Guardium Data Protection Out-of-bounds Read","HIGH",8.1,"2026-10-08",0],["CVE-2026-107392","Borewit","music-metadata","music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-3","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-82335","IBM","Guardium Data Protection","IBM Guardium Data Protection Buffer Overflow","HIGH",8.1,"2026-10-08",0],["CVE-2026-82344","IBM","Guardium Data Protection","IBM Guardium Data Protection Buffer Overflow","HIGH",8.1,"2026-10-08",0],["CVE-2026-107391","Borewit","music-metadata","music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — u","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-107390","Borewit","music-metadata","music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-84244","IBM","Guardium Data Protection","IBM Guardium Data Protection Cross-Site Scripting","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-84245","IBM","Guardium Data Protection","IBM Guardium Data Protection Privilege Escalation","HIGH",7.8,"2026-10-08",0],["CVE-2026-84250","IBM","Guardium Data Protection","IBM Guardium Data Protection Hard-coded Credentials","HIGH",8.4,"2026-10-08",0],["CVE-2026-84271","IBM","Guardium Data Protection","IBM Guardium Data Protection Signature Verification Bypass","HIGH",7.8,"2026-10-08",0],["CVE-2026-84272","IBM","Guardium Data Protection","IBM Guardium Data Protection Missing Authentication","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-107389","Borewit","music-metadata","music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process ","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-84274","IBM","Guardium Data Protection","IBM Guardium Data Protection Information Disclosure","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-106436","MongoDB","PHP Driver","Application denial of service and data truncation via unchecked BSON append failures in Mo","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-84275","IBM","Guardium Data Protection","IBM Guardium Data Protection Path Traversal","HIGH",7.5,"2026-10-08",0],["CVE-2026-106432","MongoDB","PHP Driver","Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver","LOW",2,"2026-10-08",0],["CVE-2026-107325","MongoDB","Go Driver","Application denial of service via missing BSON array length validation in MongoDB Go Drive","HIGH",8.2,"2026-10-08",0],["CVE-2026-107388","Borewit","music-metadata","music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion ","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-84276","IBM","Guardium Data Protection","IBM Guardium Data Protection Denial of Service","HIGH",7.5,"2026-10-08",0],["CVE-2026-107387","Borewit","music-metadata","music-metadata: Uncontrolled memory allocation in APEv2 parser","MEDIUM",6.2,"2026-10-08",0],["CVE-2026-84278","IBM","Guardium Data Protection","IBM Guardium Data Protection Command Injection","HIGH",7.2,"2026-10-08",0],["CVE-2026-107324","MongoDB","Go Driver","Application denial of service via integer overflow in BSON value-length validation in Mong","HIGH",8.2,"2026-10-08",0],["CVE-2026-84290","IBM","Guardium Data Protection","Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Pr","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-106434","MongoDB","libmongocrypt","Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-106433","MongoDB","libmongocrypt","Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt","HIGH",8.7,"2026-10-08",0],["CVE-2026-107386","rabbitmq","amqp091-go","amqp091-go: Pre-negotiation frame limit is not enforced to 4KB","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-106429","MongoDB","libmongocrypt","Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt","HIGH",7.1,"2026-10-08",0],["CVE-2026-105452","Docker","Docker Sandboxes","Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hos","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-40804","Kodezen LLC","aBlocks","WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-08",0],["CVE-2026-101998","Docker","Docker Sandboxes","Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-105570","Docker","Docker Sandboxes","Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host","MEDIUM",6.7,"2026-10-08",0],["CVE-2026-106430","MongoDB","C++ Driver","Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver","MEDIUM",6,"2026-10-08",0],["CVE-2026-106438","MongoDB","C Driver","Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-106437","MongoDB","C Driver","Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-106431","MongoDB","C Driver","One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107322","aws","databases-on-aws","OS command injection in Amazon Agent Plugins for AWS databases-on-aws","HIGH",8.5,"2026-10-08",0],["CVE-2026-107385","mariadb-corporation","mariadb-connector-nodejs","MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BAC","HIGH",7.4,"2026-10-08",0],["CVE-2026-107704","jtescher","image_optimizer","image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107701","ntharim","dot-access","dot-access through 1.0.0 Prototype Pollution via set() path argument","HIGH",8.8,"2026-10-08",0],["CVE-2026-107703","enmaso","@enmaso/node-convert","@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107699","tzwm","ppt2png","ppt2png through 0.0.6 OS Command Injection via input and output paths","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107700","ntharim","dot-access","dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-106428","MongoDB","C Driver","Out-of-bounds read in SCRAM response parsing in MongoDB C Driver","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-107384","mariadb-corporation","mariadb-connector-nodejs","MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMu","HIGH",8.1,"2026-10-08",0],["CVE-2026-107383","mariadb-corporation","mariadb-connector-nodejs","MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON p","HIGH",7.5,"2026-10-08",0],["CVE-2026-107382","mariadb-corporation","mariadb-connector-nodejs","MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentica","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107702","Webkul","QloApps","QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107380","darylldoyle","svg-sanitizer","enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collis","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-107379","darylldoyle","svg-sanitizer","enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107378","Kozea","CairoSVG","CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>","HIGH",8.7,"2026-10-08",0],["CVE-2026-107377","datamodel-code-generator","datamodel-code-generator","datamodel-code-generator: Protobuf weak-import path traversal allows files to be written o","HIGH",7.5,"2026-10-08",0],["CVE-2026-107376","webonyx","graphql-php","webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested","HIGH",8.2,"2026-10-08",0],["CVE-2026-97147","OpenStack","Mistral","In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target ","HIGH",7.2,"2026-10-08",0],["CVE-2026-93861","OpenStack","Mistral","In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has a","MEDIUM",6,"2026-10-08",0],["CVE-2026-107375","jhipster","generator-jhipster","JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) ","HIGH",8.8,"2026-10-08",0],["CVE-2026-93860","OpenStack","Mistral","In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request","HIGH",7.1,"2026-10-08",0],["CVE-2026-107332","aws","aws-toolkit-vscode","Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio C","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-107334","CISA","Malcolm","Incorrect Authorization in Malcolm","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-107697","FFmpeg","FFmpeg","FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107698","FFmpeg","FFmpeg","FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107696","FFmpeg","FFmpeg","FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c","HIGH",7.1,"2026-10-08",0],["CVE-2026-107695","FFmpeg","FFmpeg","FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist","HIGH",7.1,"2026-10-08",0],["CVE-2026-107335","CISA","Malcolm","Improper Handling of Highly Compressed Data in Malcolm","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-93858","OpenStack","Mistral","In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied p","HIGH",8.7,"2026-10-08",0],["CVE-2026-107337","CISA","Malcolm","Cross-Site Request Forgery in Malcolm","HIGH",7.1,"2026-10-08",0],["CVE-2026-107361","CISA","Malcolm","Authentication Bypass Using an Alternate Path or Channel in Malcolm","MEDIUM",4.2,"2026-10-08",0],["CVE-2026-107362","CISA","Malcolm","Server-Side Request Forgery in Malcolm","HIGH",7.1,"2026-10-08",0],["CVE-2026-107333","CISA","Malcolm","Incorrect Authorization in Malcolm","HIGH",8.1,"2026-10-08",0],["CVE-2026-107303","jhipster","generator-jhipster","JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened","HIGH",7.6,"2026-10-08",0],["CVE-2026-107336","CISA","Malcolm","Authentication Bypass by Spoofing in Malcolm","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107302","mcollina","msgpack5","msgpack5: Truncated map32 headers throw an unexpected error","HIGH",7.5,"2026-10-08",0],["CVE-2026-107301","mcollina","msgpack5","msgpack5: Partial options disable prototype protection","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107300","mcollina","msgpack5","msgpack5: Many buffered values can exhaust the streaming decoder stack","HIGH",7.5,"2026-10-08",0],["CVE-2026-107299","mcollina","msgpack5","msgpack5: Reserved byte can cause unbounded stream buffering","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107298","mcollina","msgpack5","msgpack5: Deeply nested input can exhaust the decoder stack","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107297","mcollina","msgpack5","msgpack5: Quadratic parsing in the streaming decoder","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107296","mcollina","msgpack5","msgpack5: Decoding negative int64 values mutates the input buffer","LOW",3.7,"2026-10-08",0],["CVE-2026-107295","pydantic","pydantic-ai","`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that ca","HIGH",7.6,"2026-10-08",0],["CVE-2026-105436","MainWP","MainWP Child","WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability","HIGH",8.8,"2026-10-08",0],["CVE-2026-107294","pydantic","pydantic-ai","Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107709","Bower Decompress-Zip","decompress-zip","Bower decompress-zip has a path traversal vulnerability","HIGH",7.8,"2026-10-08",0],["CVE-2026-107293","pydantic","pydantic-ai","Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `incl","LOW",2.3,"2026-10-08",0],["CVE-2026-104078","Obsidian","Obsidian Desktop","Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass","HIGH",8.4,"2026-10-08",0],["CVE-2026-104077","Obsidian","Obsidian Desktop","Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown","HIGH",8.5,"2026-10-08",0],["CVE-2026-107292","pydantic","pydantic-ai","Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not v","MEDIUM",6.4,"2026-10-08",0],["CVE-2026-50055","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-50054","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocum","HIGH",7.1,"2026-10-08",0],["CVE-2026-10631","Zimbra","Zimbra Collaboration Suite","Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107291","pydantic","pydantic-ai","Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans in","LOW",2.3,"2026-10-08",0],["CVE-2026-61801","moby","sys","github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group databa","MEDIUM",5.5,"2026-10-08",0],["CVE-2026-107290","pydantic","pydantic-ai","Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-106177","HP Inc","HP Sure Click Enterprise","HP Sure Click Kernel Buffer Overflow","MEDIUM",6.4,"2026-10-08",0],["CVE-2026-107678","FFmpeg","FFmpeg","FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes","MEDIUM",5.7,"2026-10-08",0],["CVE-2026-107677","FFmpeg","FFmpeg","FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media","MEDIUM",5.7,"2026-10-08",0],["CVE-2026-107675","FFmpeg","FFmpeg","FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol","MEDIUM",6,"2026-10-08",0],["CVE-2026-107676","FFmpeg","FFmpeg","FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer","MEDIUM",4.8,"2026-10-08",0],["CVE-2026-107660","FFmpeg","FFmpeg","FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-19585","HashiCorp","Shared library","Go-getter vulnerable to a path traversal in S3/GCS directory download handling","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107289","pydantic","pydantic-ai","Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-107288","pydantic","pydantic-ai","Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes ","LOW",3.7,"2026-10-08",0],["CVE-2026-107287","pydantic","pydantic-ai","Pydantic AI: Excessive resource use when local web fetching converts nested HTML","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107286","pydantic","pydantic-ai","Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends e","HIGH",7.5,"2026-10-08",0],["CVE-2026-107586","Progressive Robot Ltd","hMailServer","Allocation of Resources Without Limits or Throttling in hMailServer","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-107585","Progressive Robot Ltd","hMailServer","Allocation of Resources Without Limits or Throttling in hMailServer","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107589","Jacamar CI","Jacamar CI","Authentication Bypass by Spoofing in Jacamar CI","HIGH",7.5,"2026-10-08",0],["CVE-2026-9209","mJob","mJobTime","mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107623","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-107604","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: view-clients role allows retrieval of active client ","MEDIUM",4.9,"2026-10-08",0],["CVE-2026-107565","Red Hat","Red Hat Enterprise Linux 10","Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow dat","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-12859","Caz Informatics Services Trade Inc.","Advancity ALMS Cloud","IDOR in Caz Informatics' Advancity ALMS Cloud","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-93017","Red Hat","Red Hat OpenShift Container Platform 4.14","Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and","HIGH",7.7,"2026-10-08",0],["CVE-2026-14269","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Buffer Overflow","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-105331","Checkmk GmbH","Checkmk","mk-oracle: Local privilege escalation via malicious Oracle Instant Client","MEDIUM",5.2,"2026-10-08",0],["CVE-2026-107640","Integrics","Enswitch","Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-107638","ph7software","ph7builder","pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php","HIGH",7.6,"2026-10-08",0],["CVE-2026-107639","ILIAS-eLearning e.V.","ILIAS","ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filena","HIGH",8.7,"2026-10-08",0],["CVE-2026-107636","ph7software","ph7builder","pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController","HIGH",7.1,"2026-10-08",0],["CVE-2026-107637","ph7software","ph7builder","pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107634","Aorimn","dislocker","Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-107635","Aorimn","dislocker","Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-105832","espocrm","espocrm","EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105833","espocrm","espocrm","EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords","HIGH",8.3,"2026-10-08",0],["CVE-2026-105830","thephpleague","commonmark","league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser","HIGH",8.7,"2026-10-08",0],["CVE-2026-105831","espocrm","espocrm","EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105829","thephpleague","commonmark","League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105828","parse-community","parse-server","Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-13257","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Insufficient Verification of Data Authenticity","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-13258","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Cross-Site Scripting","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-14273","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Incorrect Authorization","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-14496","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Read","HIGH",8.2,"2026-10-08",0],["CVE-2026-14497","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Improper Verification of Cryptographic Signature","HIGH",8.1,"2026-10-08",0],["CVE-2026-14502","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Improper Authentication","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-14507","IBM","DataPower Gateway 11.0.0","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.7,"2026-10-08",0],["CVE-2026-14508","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Use After Free","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-14509","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Denial of Service","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-14888","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Buffer Overflow","HIGH",8.1,"2026-10-08",0],["CVE-2026-14905","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway XXE","HIGH",8.2,"2026-10-08",0],["CVE-2026-14988","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Read","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-93034","SGLang","SGLang","CVE-2026-93034","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-14999","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Improper Verification of Cryptographic Signature","HIGH",7.4,"2026-10-08",0],["CVE-2026-14992","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-14990","IBM","DataPower Gateway 10.6.0","IBM DataPower Gateway affected by cross-site scripting","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-14991","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-15781","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Buffer Overflow","HIGH",8,"2026-10-08",0],["CVE-2026-89290","İzometri IT Services Domestic and Foreign Trade Co. Ltd.","eimzamip","HTML Injection in İzometri Informatics' eimzamip","LOW",3.5,"2026-10-08",0],["CVE-2026-91844","İzometri IT Services Domestic and Foreign Trade Co. Ltd.","eimzamip","Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip","HIGH",7.3,"2026-10-08",0],["CVE-2026-104634","ScriptKittyOS","beam_mcp","beam_mcp: JSON boolean and null tool arguments reach dispatch as strings","LOW",2.3,"2026-10-08",0],["CVE-2026-88257","ScriptKittyOS","beam_mcp","beam_mcp: nested tool argument constraints advertised but not enforced","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107615","GlavSoft","TightVNC","DLL search order hijacking via screenhooks libraries in TightVNC Server","HIGH",7.8,"2026-10-08",0],["CVE-2026-107614","GlavSoft","TightVNC","Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read","MEDIUM",6.1,"2026-10-08",0],["CVE-2026-107613","GlavSoft","TightVNC","NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initiali","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107612","GlavSoft","TightVNC","World-accessible IPC shared memory with predictable name in TightVNC Server","HIGH",7.8,"2026-10-08",0],["CVE-2026-107611","GlavSoft","TightVNC","Out-of-bounds read in TightVNC Viewer ZRLE palette decoding","HIGH",7.1,"2026-10-08",0],["CVE-2026-15784","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",8.1,"2026-10-08",0],["CVE-2026-15762","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-15819","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.5,"2026-10-08",0],["CVE-2026-15822","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Denial of Service","HIGH",7.5,"2026-10-08",0],["CVE-2026-15824","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Denial of Service","HIGH",8.2,"2026-10-08",0],["CVE-2026-16111","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Type Confusion","HIGH",7.5,"2026-10-08",0],["CVE-2026-27420","Katie Seaborn","Zotpress","WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-16159","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",8.6,"2026-10-08",0],["CVE-2026-16161","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Read","HIGH",7.5,"2026-10-08",0],["CVE-2026-16164","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.5,"2026-10-08",0],["CVE-2026-16165","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway NULL Pointer Dereference","HIGH",7.5,"2026-10-08",0],["CVE-2026-16163","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",8.6,"2026-10-08",0],["CVE-2026-103663","Ollama","Ollama","Path Traversal leading to Remote Code Execution in Ollama","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-16167","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.5,"2026-10-08",0],["CVE-2026-42698","Themeum","Tutor LMS","WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-16169","IBM","DataPower Gateway 11.0.0","IBM DataPower Gateway Denial of Service","HIGH",7.5,"2026-10-08",0],["CVE-2026-16170","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.5,"2026-10-08",0],["CVE-2026-16176","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Denial of Service","HIGH",7.5,"2026-10-08",0],["CVE-2026-16177","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Read","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-16178","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","HIGH",7.5,"2026-10-08",0],["CVE-2026-62127","MediaRon LLC","WP Plugin Info Card","WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-16340","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Out-of-bounds Write","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-62128","Creator LMS","Creator LMS","WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-16181","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Improper Authorization","HIGH",7.4,"2026-10-08",0],["CVE-2026-16179","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway Buffer Underwrite","HIGH",7.5,"2026-10-08",0],["CVE-2026-16182","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway NULL Pointer Dereference","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-106611","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability","HIGH",7.1,"2026-10-08",0],["CVE-2026-105893","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-14521","IBM","DataPower Gateway 10.6CD","IBM DataPower Gateway affected by server-side request forgery","MEDIUM",4.9,"2026-10-08",0],["CVE-2026-105079","StylemixThemes","MasterStudy LMS","WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-105891","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-103072","VillaTheme","VillaTheme Core","WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-105890","Liquid Web / StellarWP","Gutenberg Blocks by Kadence Blocks","WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS)","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-105888","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-105078","WP Store Locator","WP Store Locator","WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-106596","Visual Composer","Visual Composer Website Builder","WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulner","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105887","Robosoft","Robo Gallery","WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-103070","ShortPixel","ShortPixel Image Optimizer","WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerab","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-105886","BdThemes","Ultimate Post Kit","WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-105076","Appsbd","Vitepos","WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability","HIGH",7.6,"2026-10-08",0],["CVE-2026-44038","OFFIS","DCMTK","Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding","MEDIUM",4.8,"2026-10-08",0],["CVE-2026-44037","OFFIS","DCMTK","Uncontrolled recursion in DCMTK JSON reader allows denial of service","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-44036","OFFIS","DCMTK","Uncontrolled recursion in DCMTK xml2dcm allows denial of service","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-44035","OFFIS","DCMTK","Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-44034","OFFIS","DCMTK","Heap out-of-bounds read in DCMTK RLE decodeFrame()","MEDIUM",4.8,"2026-10-08",0],["CVE-2026-44033","OFFIS","DCMTK","Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-44031","OFFIS","DCMTK","Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote den","HIGH",8.7,"2026-10-08",0],["CVE-2026-102783","balbooa.com","Gridbox extension for Joomla","Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-102784","balbooa.com","Gridbox extension for Joomla","Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0","HIGH",8.7,"2026-10-08",0],["CVE-2026-62142","Melapress","WP 2FA","WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability","HIGH",8.8,"2026-10-08",0],["CVE-2026-105878","YITH","YITH WooCommerce Product Bundles","WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulner","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-106603","Groundhogg","HollerBox","WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerabil","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-66479","Liquid Web / StellarWP","WPComplete","WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability","HIGH",7.1,"2026-10-08",0],["CVE-2026-106600","Liquid Web / StellarWP","GiveWP","WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-19218","AKIN Software Computer Import-Export Industry and Trade Co. Ltd.","MyRezzta","Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta","CRITICAL",9.1,"2026-10-08",0],["CVE-2026-92555","AKIN Software Computer Import-Export Industry and Trade Co. Ltd.","AKINSOFT WOLVOX Control Panel","Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-107584","Progressive Robot Ltd","hMailServer","Not Failing Securely ('Failing Open') in hMailServer","HIGH",7.4,"2026-10-08",0],["CVE-2026-107583","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107587","Progressive Robot Ltd","hMailServer","Improper Certificate Validation in hMailServer","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107582","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107581","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107580","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107579","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-107578","Progressive Robot Ltd","hMailServer","Improper Link Resolution Before File Access ('Link Following') in hMailServer","MEDIUM",6.7,"2026-10-08",0],["CVE-2026-107576","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-107577","Progressive Robot Ltd","hMailServer","Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-107575","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107572","Progressive Robot Ltd","hMailServer","Inefficient Regular Expression Complexity in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107573","Progressive Robot Ltd","hMailServer","Incorrect Default Permissions in hMailServer","HIGH",7.8,"2026-10-08",0],["CVE-2026-107574","Progressive Robot Ltd","hMailServer","Inefficient Algorithmic Complexity in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-107570","mutt","mutt","Use of Out-of-range Pointer Offset in mutt","LOW",2.5,"2026-10-08",0],["CVE-2026-19083","AKIN Software Computer Import-Export Industry and Trade Co. Ltd.","OctoCloud","IDOR in AKIN Software's OctoCloud","HIGH",8.8,"2026-10-08",0],["CVE-2026-107275","@fastify/jwt","@fastify/jwt","@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-103011","Progressive Robot Ltd","hMailServer","Heap-based Buffer Overflow in hMailServer","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-103010","Progressive Robot Ltd","hMailServer","Heap-based Buffer Overflow in hMailServer","HIGH",7.8,"2026-10-08",0],["CVE-2026-103647","Progressive Robot Ltd","hMailServer","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hM","HIGH",8,"2026-10-08",0],["CVE-2026-103649","Progressive Robot Ltd","hMailServer","Synchronous Access of Remote Resource without Timeout in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-104659","Progressive Robot Ltd","hMailServer","Origin Validation Error in hMailServer","HIGH",7.5,"2026-10-08",0],["CVE-2026-104660","Progressive Robot Ltd","hMailServer","Missing Authorization in hMailServer","HIGH",7.8,"2026-10-08",0],["CVE-2026-104658","Progressive Robot Ltd","hMailServer","Reliance on Untrusted Inputs in a Security Decision in hMailServer","HIGH",7.8,"2026-10-08",0],["CVE-2026-104704","Progressive Robot Ltd","hMailServer","Cleartext Transmission of Sensitive Information in hMailServer","HIGH",7.4,"2026-10-08",0],["CVE-2026-93509","","Wallet System for WooCommerce","Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-104671","","TutorStarter","TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105190","","Easy Digital Downloads","Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabl","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-103517","","Airwallex Online Payments Gateway","Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Web","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107510","Infoblox","NIOS","Authenticated argument injection in NIOS command line leading to privilege escalation","CRITICAL",9.1,"2026-10-08",0],["CVE-2026-107503","Eclipse Ditto","Ditto Explorer UI","In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads ","HIGH",7.1,"2026-10-08",0],["CVE-2026-105110","Iskratel","Innbox","Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-4894","Frappe Technologies","Frappe Technologies","Authentication bypass in multiple products from Frappe Technologies","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-71896","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of Use","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-71895","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Ku","HIGH",7.1,"2026-10-08",0],["CVE-2026-71183","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Info","HIGH",7.1,"2026-10-08",0],["CVE-2026-66087","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint ","HIGH",8.1,"2026-10-08",0],["CVE-2026-66084","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream","HIGH",8.1,"2026-10-08",0],["CVE-2026-66082","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (sch","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-89191","SQLView","SQLView KRIS","Stored Cross-Site Scripting in SQLView KRIS","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-12260","NetBoard CRM","NetBoard CRM Demo Platform","SQL injection in the NetBoard CRM demo platform","CRITICAL",10,"2026-10-08",0],["CVE-2026-107466","Red Hat","Red Hat Enterprise Linux 10","Flatpak-builder: local file exfiltration via `file","MEDIUM",6.1,"2026-10-08",0],["CVE-2026-93699","WebPros","WP Toolkit","Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code a","HIGH",8.5,"2026-10-08",0],["CVE-2026-87428","Brocade","Brocade Active Support Connectivity Gateway","In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a req","HIGH",8.4,"2026-10-08",0],["CVE-2026-87426","Brocade","Brocade Active Support Connectivity Gateway","An unauthenticated network-based attacker can query specific internal management endpoints","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-87425","Brocade","Brocade Active Support Connectivity Gateway","An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG v","HIGH",7.6,"2026-10-08",0],["CVE-2026-87424","Brocade","Brocade Active Support Connectivity Gateway","A vulnerability in the SupportLink API authentication component of Brocade ASCG versions p","HIGH",8.6,"2026-10-08",0],["CVE-2026-85490","Brocade","Brocade Active Support Connectivity Gateway","When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote comp","HIGH",7.7,"2026-10-08",0],["CVE-2026-85097","Bricksforge","Bricksforge","Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' ","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-85489","Brocade","Brocade Active Support Connectivity Gateway","An authentication flaw exists in the Brocade ASCG administrative management service compon","HIGH",8.7,"2026-10-08",0],["CVE-2026-85488","Brocade","Brocade Active Support Connectivity Gateway","Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script d","HIGH",7,"2026-10-08",0],["CVE-2026-85487","Brocade","Brocade Active Support Connectivity Gateway","A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versio","HIGH",8.6,"2026-10-08",0],["CVE-2026-85486","Brocade","Brocade Active Support Connectivity Gateway","Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to","HIGH",8.6,"2026-10-08",0],["CVE-2026-85423","Brocade","Brocade Active Support Connectivity Gateway","A vulnerability has been identified in the data collection service of Brocade ASCG version","HIGH",8.6,"2026-10-08",0],["CVE-2026-85422","Brocade","Brocade Active Support Connectivity Gateway","A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a s","HIGH",8.4,"2026-10-08",0],["CVE-2026-85421","Brocade","Brocade Active Support Connectivity Gateway","A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.","HIGH",8.7,"2026-10-08",0],["CVE-2026-5769","Brocade","Brocade SANnav","A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin","MEDIUM",5.6,"2026-10-08",0],["CVE-2026-94246","","Wallet System for WooCommerce","Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Reques","MEDIUM",6.3,"2026-10-08",0],["CVE-2026-94258","","SMS Alert","SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actio","LOW",2.7,"2026-10-08",0],["CVE-2026-94275","","Track Orders for WooCommerce","Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Paramete","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-86827","","BackWPup","BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-86828","","BackWPup","BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback","MEDIUM",6.6,"2026-10-08",0],["CVE-2026-94244","","Wallet System for WooCommerce","Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosu","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-94245","","Wallet System for WooCommerce","Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft ","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-105196","","Appointment Booking Plugin","LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API","LOW",3.3,"2026-10-08",0],["CVE-2026-105197","","Appointment Booking Plugin","LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR","LOW",2.7,"2026-10-08",0],["CVE-2026-105198","","Appointment Booking Plugin","LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-105260","","Database Addon For WPForms ( wpforms entries )","Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-86826","","BackWPup","BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-105193","","Booking Calendar","Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification ","MEDIUM",4.8,"2026-10-08",0],["CVE-2026-105194","","Easy Digital Downloads","Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Dow","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-105195","","Booking Calendar","Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure","LOW",2.7,"2026-10-08",0],["CVE-2026-103646","","Ultimate Multisite","Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Pa","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-103692","","Frontend Dashboard","Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Func","CRITICAL",9.8,"2026-10-08",0],["CVE-2026-104645","","Image Photo Gallery Final Tiles Grid","Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Im","LOW",2.7,"2026-10-08",0],["CVE-2026-104646","","Image Photo Gallery Final Tiles Grid","Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortc","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-103309","","GPTranslate","GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage","HIGH",7.5,"2026-10-08",0],["CVE-2026-107459","Openfind","SecuShare Pro","Openfind｜SecuShare Pro - OS Command Injection","CRITICAL",9.3,"2026-10-08",0],["CVE-2026-5049","Brocade","Brocade SANnav","A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade S","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-5048","Brocade","Brocade SANnav","In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API in","MEDIUM",6.1,"2026-10-08",0],["CVE-2026-5047","Brocade","Brocade SANnav","A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and aut","HIGH",8.2,"2026-10-08",0],["CVE-2023-5649","Brocade","Brocade Active Support Connectivity Gateway","An Improper Input Validation vulnerability for the registered case credentials in Brocade ","MEDIUM",6.8,"2026-10-08",0],["CVE-2023-5648","Brocade","Active Support Connectivity Gateway","In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missi","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-107450","stumpapp","Stump","In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-94585","Brocade","Fabric OS","An authentication bypass vulnerability exists in the web management interface of Brocade F","HIGH",7.7,"2026-10-08",0],["CVE-2026-94587","Brocade","Fabric OS","A buffer overflow vulnerability exists in the WebTools administrative interface handling c","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-94579","Brocade","Fabric OS","An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) ","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-94576","Brocade","Fabric OS","An authentication logic and privilege escalation vulnerability exists in the account manag","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-87661","Brocade","Fabric OS","Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apac","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-17196","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions","HIGH",8.8,"2026-10-08",0],["CVE-2026-17609","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files","CRITICAL",9.1,"2026-10-08",0],["CVE-2026-107449","linuxserver","Heimdall","linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism on","LOW",3.4,"2026-10-08",0],["CVE-2026-87677","Brocade","Fabric OS","An OS command injection vulnerability exists in the account management subsystem of Brocad","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-94586","Brocade","Fabric OS","A command injection vulnerability exists in the WebTools administrative interface handling","HIGH",8.5,"2026-10-08",0],["CVE-2026-94581","Brocade","Fabric OS","An OS command injection vulnerability exists in the REST API management interface of Broca","HIGH",8.5,"2026-10-08",0],["CVE-2026-94577","Brocade","Fabric OS","A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) a","HIGH",7.3,"2026-10-08",0],["CVE-2026-87664","Brocade","Fabric OS","A session context forgery vulnerability exists in the web management daemon of Brocade Fab","HIGH",8.5,"2026-10-08",0],["CVE-2026-87663","Brocade","Fabric OS","An authentication bypass and command injection vulnerability exists in the inter-switch re","HIGH",7.1,"2026-10-08",0],["CVE-2026-87662","Brocade","Fabric OS","Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific dow","HIGH",7,"2026-10-08",0],["CVE-2026-87660","Brocade","Fabric OS","An improper file permission and missing authorization vulnerability exists in the diagnost","HIGH",7,"2026-10-08",0],["CVE-2026-107448","Wizards of the Coast","Magic: The Gathering Arena","Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain la","LOW",3.4,"2026-10-08",0],["CVE-2026-87667","Brocade","Fabric OS","An argument injection vulnerability exists in the configuration management command-line ut","HIGH",8.4,"2026-10-08",0],["CVE-2026-87666","Brocade","Fabric OS","An OS command injection vulnerability exists in the time and zone management subsystem of ","HIGH",8.6,"2026-10-08",0],["CVE-2026-107445","Red Hat","Red Hat Hardened Images","Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organizat","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-107444","Red Hat","Red Hat Hardened Images","Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization","MEDIUM",4.3,"2026-10-08",0],["CVE-2026-107446","containerd","overlaybd","containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overf","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-87675","Brocade","Fabric OS","An OS command injection vulnerability exists in the configuration management subsystem of ","HIGH",7.3,"2026-10-08",0],["CVE-2026-87674","Brocade","Fabric OS","A local privilege escalation vulnerability exists in the system logging daemon of Brocade ","HIGH",8.5,"2026-10-08",0],["CVE-2026-87673","Brocade","Fabric OS","An OS command injection vulnerability exists in maintenance command-line diagnostic utilit","HIGH",7,"2026-10-08",0],["CVE-2026-87687","Brocade","Fabric OS","An authorization and input validation vulnerability exists in Brocade Fabric OS versions b","HIGH",8.5,"2026-10-08",0],["CVE-2026-87685","Brocade","Fabric OS","An arbitrary file manipulation vulnerability exists in the WebTools management interface o","HIGH",8.4,"2026-10-08",0],["CVE-2026-87688","Brocade","Fabric OS","An input validation vulnerability exists in the security certificate management component ","HIGH",8.5,"2026-10-08",0],["CVE-2026-94584","Brocade","Fabric OS","A race condition and thread-safety vulnerability exists in the web management daemon of Br","LOW",2.1,"2026-10-08",0],["CVE-2026-94580","Brocade","Fabric OS","An arbitrary file and directory deletion vulnerability exists in the REST API management i","MEDIUM",5.7,"2026-10-08",0],["CVE-2026-94575","Brocade","Fabric OS","A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-94583","Brocade","Fabric OS","A race condition vulnerability exists in the request processing logic of the REST manageme","LOW",2.1,"2026-10-08",0],["CVE-2026-94582","Brocade","Fabric OS","A memory buffer overflow vulnerability exists in the internal diagnostic and route validat","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-87668","Brocade","Fabric OS","A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of ","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-87665","Brocade","Fabric OS","A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) pr","MEDIUM",6,"2026-10-08",0],["CVE-2026-87672","Brocade","Fabric OS","An information disclosure vulnerability exists in the SupportLink diagnostic collection ut","MEDIUM",6.8,"2026-10-08",0],["CVE-2026-92862","Wavedash Co., Ltd.","Ticket Ryutsu Center","The Android application \"Ticket Ryutsu Center\" improperly handles custom URL schemes, allo","MEDIUM",4.6,"2026-10-08",0],["CVE-2026-92861","Wavedash Co., Ltd.","Ticket Ryutsu Center","The Android application \"Ticket Ryutsu Center\" contains hard-coded credentials, which may ","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-87670","Brocade","Fabric OS","An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-87669","Brocade","Fabric OS","A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interfa","MEDIUM",5.1,"2026-10-08",0],["CVE-2026-87678","Brocade","Fabric OS","An input validation and output encoding vulnerability exists in the web management interfa","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-87676","Brocade","Fabric OS","A stack-based buffer overflow vulnerability exists in the security library component of Br","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-87686","Brocade","Fabric OS","An authentication and access control bypass vulnerability exists in the web server managem","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-94578","Brocade","Fabric OS","Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in t","HIGH",7.5,"2026-10-08",0],["CVE-2026-87659","Brocade","Fabric OS","A critical authorization bypass vulnerability exists in the Management Server handling of ","HIGH",7.1,"2026-10-08",0],["CVE-2026-87671","Brocade","Fabric OS","An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade ","HIGH",7.1,"2026-10-08",0],["CVE-2026-87684","Brocade","Fabric OS","A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of ","HIGH",8.7,"2026-10-08",0],["CVE-2017-20283","NXP","MQX","NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP r","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-87726","NXP","NxpNfcRdLib","Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_P","LOW",3.9,"2026-10-08",0],["CVE-2026-102488","Octopus Deploy","Octopus Server","In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assi","HIGH",8.7,"2026-10-08",0],["CVE-2026-82627","uncannyowl","Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included","Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usa","HIGH",7.5,"2026-10-08",0],["CVE-2026-87683","Brocade","Fabric OS","Multiple stack-based buffer overflow vulnerabilities exist in the REST API management comp","HIGH",8.6,"2026-10-08",0],["CVE-2026-87682","Brocade","Fabric OS","Multiple OS Command Injection vulnerabilities exist in the management interface and sessio","HIGH",8.6,"2026-10-08",0],["CVE-2026-87681","Brocade","Fabric OS","An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) vali","HIGH",7.1,"2026-10-08",0],["CVE-2026-87680","Brocade","Fabric OS","A command injection vulnerability in the REST API management interface of Brocade Fabric O","HIGH",8.5,"2026-10-08",0],["CVE-2026-87679","Brocade","Fabric OS","When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, th","HIGH",8.5,"2026-10-08",0],["CVE-2024-8122","WSO2","WSO2 Identity Server","Potential brute force vulnerability due to non-expiring SMS OTPs","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-67693","","","An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing","LOW",3.7,"2026-10-08",0],["CVE-2026-88647","","","A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-88648","","","Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordina","LOW",3.7,"2026-10-08",0],["CVE-2026-95116","","","An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service vi","HIGH",7.5,"2026-10-08",0],["CVE-2026-95125","","","libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c","MEDIUM",6.5,"2026-10-08",0],["CVE-2026-95184","","","Improper certificate validation in gnutls v3.8.13 causes the application to reject legitim","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-95208","","","An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 ","HIGH",7.5,"2026-10-08",0],["CVE-2026-95209","","","An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a ","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-95210","","","Improper certificate validation in gnutls v3.8.13 causes the application to accept certifi","MEDIUM",4.8,"2026-10-08",0],["CVE-2026-17538","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Au","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-94154","r3098","Aurora Heatmap","Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter","MEDIUM",6.1,"2026-10-08",0],["CVE-2026-107315","pgjdbc","pgjdbc","pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rat","MEDIUM",5.3,"2026-10-08",0],["CVE-2026-107314","pgjdbc","pgjdbc","pgjdbc does not enforce requireAuth when the value excludes every authentication method","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-89322","HashiCorp","Vault","Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions","HIGH",7.2,"2026-10-08",0],["CVE-2026-105820","HashiCorp","Vault Enterprise","Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution","MEDIUM",5.4,"2026-10-08",0],["CVE-2026-105816","HashiCorp","Vault","Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft","HIGH",8,"2026-10-08",0],["CVE-2026-107285","AsyncHttpClient","async-http-client","AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunn","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107284","AsyncHttpClient","async-http-client","AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check","LOW",3.7,"2026-10-08",0],["CVE-2026-107283","AsyncHttpClient","async-http-client","AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random so","LOW",3.7,"2026-10-08",0],["CVE-2026-107282","AsyncHttpClient","async-http-client","AsyncHttpClient: Replay to a different host sends the original host request and credential","CRITICAL",9.4,"2026-10-08",0],["CVE-2026-105818","HashiCorp","Vault","Vault PKI ACME Issues Certificate With Unvalidated SANs","MEDIUM",5.9,"2026-10-08",0],["CVE-2026-107281","AsyncHttpClient","async-http-client","AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Nego","HIGH",7.6,"2026-10-08",0],["CVE-2026-107280","AsyncHttpClient","async-http-client","AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so","MEDIUM",6.9,"2026-10-08",0],["CVE-2026-107279","AsyncHttpClient","async-http-client","AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-","HIGH",8.8,"2026-10-08",0],["CVE-2026-107232","AsyncHttpClient","async-http-client","AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT","HIGH",7.5,"2026-10-08",0],["CVE-2026-107231","AsyncHttpClient","async-http-client","AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the","HIGH",8.7,"2026-10-08",0],["CVE-2026-107230","AsyncHttpClient","async-http-client","AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy l","HIGH",7.4,"2026-10-08",0],["CVE-2026-107229","AsyncHttpClient","async-http-client","AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing","MEDIUM",4,"2026-10-07",0],["CVE-2026-107228","AsyncHttpClient","async-http-client","AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHead","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-107227","AsyncHttpClient","async-http-client","AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompress","HIGH",7.5,"2026-10-07",0],["CVE-2026-76286","Splunk","Splunk MCP Server","Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-76284","Splunk","Splunk Enterprise","Improper Neutralization in Splunk Enterprise","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76285","Splunk","Splunk Enterprise","Improper Adherence to Coding Standards in Splunk Enterprise","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76282","Splunk","Splunk Enterprise","Improper Control of a Resource Through its Lifetime in Splunk Enterprise","HIGH",8.8,"2026-10-07",0],["CVE-2026-76283","Splunk","Splunk Enterprise","Protection Mechanism Failure in Splunk Enterprise","HIGH",7.6,"2026-10-07",0],["CVE-2026-76280","Splunk","Splunk Enterprise","Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gatew","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-76281","Splunk","Splunk Enterprise","Improper Access Control in Splunk Enterprise","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-76278","Splunk","Splunk Enterprise","Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76279","Splunk","Splunk Enterprise","Improper Input Validation of Index Names through the collect Command in Splunk Enterprise","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76276","Splunk","Splunk Enterprise","Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web f","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76277","Splunk","Splunk Enterprise","Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterp","MEDIUM",4.1,"2026-10-07",0],["CVE-2026-76274","Splunk","Splunk Enterprise","Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observabi","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76275","Splunk","Splunk Enterprise","Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76272","Splunk","Splunk Enterprise","Missing Access Control through the REST API in Splunk Secure Gateway","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76273","Splunk","Splunk Enterprise","Improper Input Validation through the collect Command in Splunk Enterprise","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76270","Splunk","Splunk Enterprise","Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76271","Splunk","Splunk Enterprise","Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterpri","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76268","Splunk","Splunk Enterprise","Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76269","Splunk","Splunk Enterprise","Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76267","Splunk","Splunk Enterprise","Log Injection through the REST API in Splunk App for Splunk O11y Cloud","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-76265","Splunk","Splunk Enterprise","Improper Access Control through REST API Endpoints in Splunk Secure Gateway","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76266","Splunk","Splunk Enterprise","Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise","HIGH",7.7,"2026-10-07",0],["CVE-2026-76264","Splunk","Splunk Enterprise","Improper Authorization through the REST API in Splunk Enterprise","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-107352","AWS","Amazon Athena","Missing authorization checks in Amazon Athena engine version 3 request handling","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-107363","OpenStack","Zaqar","In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identi","MEDIUM",6.1,"2026-10-07",0],["CVE-2026-1403","GitLab","GitLab","Allocation of Resources Without Limits or Throttling in GitLab","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-97717","Absolute Security","Secure Access","Denial of Service in Absolute Secure Access","MEDIUM",6,"2026-10-07",0],["CVE-2026-97716","Absolute Security","Secure Access","Denial of Service in Absolute Secure Access","HIGH",8.7,"2026-10-07",0],["CVE-2026-34499","Johnson Controls","ADVMS","Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Se","HIGH",8.5,"2026-10-07",0],["CVE-2026-107353","ljharb","traverse","traverse: set() can write to built-in prototypes via an untrusted path","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-97715","Absolute Security","Secure Access","Denial of Service in Absolute Secure Access","HIGH",7.1,"2026-10-07",0],["CVE-2026-107176","Red Hat","Red Hat OpenShift Container Platform 4","Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-107161","Red Hat","Red Hat Enterprise Linux 10","Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server ","HIGH",7.5,"2026-10-07",0],["CVE-2026-97714","Absolute Security","Secure Access","Denial of service vulnerability in Secure Access","HIGH",8.2,"2026-10-07",0],["CVE-2026-107225","qax-os","excelize","Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107224","qax-os","excelize","Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107223","qax-os","excelize","Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded pe","HIGH",7.1,"2026-10-07",0],["CVE-2026-103371","Apache Software Foundation","Apache Geode","Apache Geode: Management REST API: Insertion of Sensitive Information into Log File","HIGH",7.5,"2026-10-07",0],["CVE-2026-107222","qax-os","excelize","Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no l","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107221","qax-os","excelize","Excelize: a row whose earlier cell has a higher column reference than its last cell panics","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107220","qax-os","excelize","Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107219","qax-os","excelize","Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile","HIGH",7.5,"2026-10-07",0],["CVE-2026-107218","qax-os","excelize","Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107217","qax-os","excelize","Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil er","HIGH",7.5,"2026-10-07",0],["CVE-2026-107313","pgjdbc","pgjdbc","pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connect","MEDIUM",4.2,"2026-10-07",0],["CVE-2026-106164","Progress Software","Telerik Document Processing Libraries","Infinite Loop in Telerik Document Processing XLS Import","HIGH",7.3,"2026-10-07",0],["CVE-2026-107216","qax-os","excelize","Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entra","HIGH",7.5,"2026-10-07",0],["CVE-2026-107215","qax-os","excelize","Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers ","HIGH",7.5,"2026-10-07",0],["CVE-2026-56851","golang.org/x/text","golang.org/x/text/secure/precis","Panic parsing crafted input in x/text/secure/precis in golang.org/x/text","HIGH",7.5,"2026-10-07",0],["CVE-2026-107214","qax-os","excelize","Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks","HIGH",7.5,"2026-10-07",0],["CVE-2026-107213","qax-os","excelize","Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no","HIGH",8.7,"2026-10-07",0],["CVE-2026-106067","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in hot color filter on oversized image","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-106066","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-107212","qax-os","excelize","Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop fo","HIGH",7.5,"2026-10-07",0],["CVE-2026-107211","qax-os","excelize","Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverabl","HIGH",8.7,"2026-10-07",0],["CVE-2026-96335","WPMU DEV","Forminator","WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-07",0],["CVE-2026-95606","Liquid Web / StellarWP","The Events Calendar","WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-95605","Passionate Programmer Peter","WP Data Access","WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-95595","Fontsplugin","Disable and Remove Google Fonts | GDPR & DSGVO friendly","WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross ","HIGH",7.1,"2026-10-07",0],["CVE-2026-95534","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","HIGH",8.8,"2026-10-07",0],["CVE-2026-94670","Everest Forms","Everest Forms","WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-07",0],["CVE-2026-106065","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-94662","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) v","HIGH",7.1,"2026-10-07",0],["CVE-2026-92543","Docker","Docker Engine","Docker Engine insecure-registry fallback via malicious DNS responses","HIGH",7.6,"2026-10-07",0],["CVE-2026-92542","Docker","Docker Engine","Blind VXLAN injection into encrypted overlay networks from cluster peer","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-106557","backstage","backstage","Backstage: Improper input validation in TechDocs Markdown extension configuration","HIGH",7.7,"2026-10-07",0],["CVE-2026-76472","Cisco","Cisco Campus Gateway Software","Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special ","HIGH",8.8,"2026-10-07",0],["CVE-2026-76467","Cisco","Cisco Campus Gateway Software","Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities","HIGH",7.5,"2026-10-07",0],["CVE-2026-76470","Cisco","Cisco Campus Gateway Software","Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-76469","Cisco","Cisco Campus Gateway Software","Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management","HIGH",7.4,"2026-10-07",0],["CVE-2026-76468","Cisco","Cisco Campus Gateway Software","Cisco Meraki Hardening Release - Input Validation Vulnerabilities","HIGH",8.2,"2026-10-07",0],["CVE-2026-76463","Cisco","Cisco Campus Gateway Software","Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabil","HIGH",8.8,"2026-10-07",0],["CVE-2026-76464","Cisco","Cisco Campus Gateway Software","Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities","CRITICAL",9.6,"2026-10-07",0],["CVE-2026-76501","Cisco","Cisco NX-OS Software","Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76500","Cisco","Cisco Application Policy Infrastructure Controller (APIC)","Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Impro","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76498","Cisco","Cisco Application Policy Infrastructure Controller (APIC)","Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Impro","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76499","Cisco","Cisco Application Policy Infrastructure Controller (APIC)","Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Impro","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76486","Cisco","Cisco NX-OS Software","Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerab","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76488","Cisco","Cisco Application Policy Infrastructure Controller (APIC)","Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vu","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-76484","Cisco","Cisco License On-Prem","Cisco License On-Prem Security Hardening Release","HIGH",8.8,"2026-10-07",0],["CVE-2026-76485","Cisco","Cisco NX-OS Software","Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerab","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76483","Cisco","Cisco License On-Prem","Cisco License On-Prem Security Hardening Release","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-76482","Cisco","Cisco License On-Prem","Cisco License On-Prem Security Hardening Release","CRITICAL",10,"2026-10-07",0],["CVE-2026-76480","Cisco","Cisco License On-Prem","Cisco License On-Prem Security Hardening Release","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76458","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Excep","HIGH",8.6,"2026-10-07",0],["CVE-2026-76459","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulner","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76471","Cisco","Cisco NX-OS Software","Cisco NX-OS Software NX-API Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76455","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vu","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76457","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnera","HIGH",8.6,"2026-10-07",0],["CVE-2026-76456","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation ","HIGH",8.6,"2026-10-07",0],["CVE-2026-76465","Cisco","Cisco NX-OS Software","Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-101886","Cisco","Jabber for Android","Cisco Jabber for Android Path Traversal via Shared Content URI","MEDIUM",5.1,"2026-10-07",0],["CVE-2026-62252","sipcapture","homer","Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-76454","Cisco","Cisco License On-Prem","Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-76453","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vu","HIGH",8.8,"2026-10-07",0],["CVE-2026-76437","Cisco","Cisco License On-Prem","Cisco Smart Software Manager On-Prem Command Injection Vulnerability","MEDIUM",4.9,"2026-10-07",0],["CVE-2026-20362","Cisco","Cisco Finesse","Cisco Finesse Server-Side Request Forgery Vulnerability","HIGH",7.2,"2026-10-07",0],["CVE-2026-76452","Cisco","Cisco License On-Prem","Cisco Smart Software Manager On-Prem SQL Injection Vulnerability","MEDIUM",4.9,"2026-10-07",0],["CVE-2026-20173","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Denial of Service Vulnerability","MEDIUM",5.8,"2026-10-07",0],["CVE-2026-20328","Cisco","Cisco License On-Prem","Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-20032","Cisco","Cisco NX-OS Software","Cisco NX-OS Software Python Sandbox Escape Vulnerability","MEDIUM",4.4,"2026-10-07",0],["CVE-2026-20038","Cisco","Cisco NX-OS System Software in ACI Mode","Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group C","MEDIUM",5.8,"2026-10-07",0],["CVE-2026-20321","Cisco","Cisco Application Policy Infrastructure Controller (APIC)","Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-62253","sipcapture","homer","Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-62251","sipcapture","homer","Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/qu","HIGH",8.1,"2026-10-07",0],["CVE-2026-62176","MervinPraison","PraisonAI","PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-107166","","Open5GS","Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-107210","ImageMagick","ImageMagick","ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107209","ImageMagick","ImageMagick","ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-107208","ImageMagick","ImageMagick","ImageMagick: Denial of service with crafted XMP profile","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106580","ImageMagick","ImageMagick","ImageMagick: Policy Bypass in CUT encoder","MEDIUM",4,"2026-10-07",0],["CVE-2026-92415","Apache Software Foundation","Apache Jackrabbit","Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-contro","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-92414","Apache Software Foundation","Apache Jackrabbit","Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-106579","ImageMagick","ImageMagick","ImageMagick: Policy Bypass when using coder as the domain.","MEDIUM",6.2,"2026-10-07",0],["CVE-2026-107273","gophish","gophish","Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107271","gophish","gophish","Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-107272","gophish","gophish","Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages","LOW",2.3,"2026-10-07",0],["CVE-2026-107270","gophish","gophish","Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints","HIGH",7.1,"2026-10-07",0],["CVE-2026-107278","MISP","MISP","MISP Object Sync Drops Objects and Attributes When Description Is Empty","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106578","ImageMagick","ImageMagick","ImageMagick: Invalid Memory Free in MVG decoder","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-107269","gophish","gophish","Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-106577","ImageMagick","ImageMagick","ImageMagick: Code Injection in the postscript coders","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106576","ImageMagick","ImageMagick","ImageMagick: Denial of service possible when parsing an XMP profile.","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107276","MISP","MISP","MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurre","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-106575","ImageMagick","ImageMagick","ImageMagick: Unclosed file pointer in magick script","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106574","ImageMagick","ImageMagick","ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a cra","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106573","ImageMagick","ImageMagick","ImageMagick: Denial of service in MVG decoder","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106572","ImageMagick","ImageMagick","ImageMagick: Stack Overflown CALS decoder due to missing depth check.","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106571","ImageMagick","ImageMagick","ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash","MEDIUM",5.1,"2026-10-07",0],["CVE-2026-106570","ImageMagick","ImageMagick","ImageMagick: Denial of service in distributed pixel cache server","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-106569","ImageMagick","ImageMagick","ImageMagick: Denial of service in ASE decoder because of missing security checks","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106568","ImageMagick","ImageMagick","ImageMagick: Infinite Loop when reading a crafted XMP profile","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107207","LMCache","LMCache","LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlis","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-107205","LMCache","LMCache","LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API","HIGH",8.8,"2026-10-07",0],["CVE-2026-107206","LMCache","LMCache","LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API","HIGH",8.8,"2026-10-07",0],["CVE-2026-107204","LMCache","LMCache","LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-106567","ImageMagick","ImageMagick","ImageMagick: Infinite Loop in PSD decoder on 32-bit builds","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-106566","ImageMagick","ImageMagick","ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check","MEDIUM",4,"2026-10-07",0],["CVE-2026-106565","ImageMagick","ImageMagick","ImageMagick: Infinite Loop in bzip2 compressed images.","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-106564","ImageMagick","ImageMagick","ImageMagick: Heap Buffer Over-Write in EXR decoder","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-33586","OVHcloud","OVHcloud","Authenticated SMTP Sender Address Forgery","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-106563","backstage","backstage","Backstage: Improper entity validation in deprecated Kubernetes services endpoint","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106562","backstage","backstage","Backstage: Incorrect authorization in search engine permission filtering","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-106561","backstage","backstage","Backstage: Sensitive information disclosure in Kubernetes resource queries","MEDIUM",5,"2026-10-07",0],["CVE-2026-106560","backstage","backstage","Backstage: Improper repository path validation in a Scaffolder backend module","HIGH",7.1,"2026-10-07",0],["CVE-2026-106559","backstage","backstage","Backstage: Improper input validation in Confluence to Markdown scaffolder module","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-106558","backstage","backstage","Backstage: Improper validation of TechDocs MkDocs configuration","HIGH",8.8,"2026-10-07",0],["CVE-2026-106556","backstage","backstage","Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization","HIGH",7.7,"2026-10-07",0],["CVE-2026-106510","backstage","backstage","Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml","HIGH",7.7,"2026-10-07",0],["CVE-2026-77214","libexpat","libexpat","libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer","HIGH",8.3,"2026-10-07",0],["CVE-2026-107174","Red Hat","OpenShift Serverless","Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extr","MEDIUM",6.4,"2026-10-07",0],["CVE-2026-107169","Red Hat","Red Hat Enterprise Linux 10","M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8","MEDIUM",6.2,"2026-10-07",0],["CVE-2026-107167","Red Hat","Red Hat Enterprise Linux 10","M17n-lib: heap use-after-free write in re_init_ic()","MEDIUM",6.2,"2026-10-07",0],["CVE-2026-106064","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-104074","coturn","coturn","Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-62179","MervinPraison","praisonai-platform","PraisonAI: Platform members can delete owner issue dependencies through member-owned relat","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-107202","jonssonyan","h-ui","CVE-2026-107202","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-107125","XnView","Classic","XnView Classic FLI File heap-based overflow","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-46438","wger-project","wger","wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-46437","wger-project","wger","wger: API credentials remain valid after logout/password change","MEDIUM",4.8,"2026-10-07",0],["CVE-2026-46434","wger-project","wger","wger: Trainer Privilege Escalation - Improper Privilege Management","HIGH",7.1,"2026-10-07",0],["CVE-2026-107194","Sungrow","iSolarCloud","Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover vi","CRITICAL",9.2,"2026-10-07",0],["CVE-2026-45161","wger-project","wger","wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding","MEDIUM",5.4,"2026-10-07",0],["CVE-2026-107183","ggml-org","llama.cpp","llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser","CRITICAL",9.2,"2026-10-07",0],["CVE-2026-107181","Telegram","Telegram Desktop","Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme","HIGH",8.6,"2026-10-07",0],["CVE-2026-43976","wger-project","wger","wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","HIGH",7.1,"2026-10-07",0],["CVE-2026-102258","SonicWall","SMA1000","Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in","MEDIUM",6.1,"2026-10-07",0],["CVE-2026-102257","SonicWall","SMA1000","A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interfac","HIGH",7.2,"2026-10-07",0],["CVE-2026-102256","SonicWall","SMA1000","Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS","HIGH",7.8,"2026-10-07",0],["CVE-2026-102255","SonicWall","SMA1000","A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interfa","CRITICAL",10,"2026-10-07",0],["CVE-2026-98374","Linux","Linux","tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()","HIGH",8.8,"2026-10-07",0],["CVE-2026-98373","Linux","Linux","mm/hugetlb: preserve mremap address delta when skipping page tables","","","2026-10-07",0],["CVE-2026-41958","visidata","visidata","A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionalit","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-42532","visidata","visidata","A path traversal vulnerability exists in the EmailSheet extract_parts functionality of Vis","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-103435","Anthropic","@anthropic-ai/claude-code","Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code","HIGH",7.7,"2026-10-07",0],["CVE-2026-107180","MISP","MISP","MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instanc","HIGH",7.1,"2026-10-07",0],["CVE-2026-107177","ExpressGateway","express-gateway","Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens","HIGH",7.4,"2026-10-07",0],["CVE-2026-107162","ExpressGateway","express-gateway","Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass","HIGH",7.6,"2026-10-07",0],["CVE-2026-107170","Red Hat","Red Hat Enterprise Linux 10","M17n-lib: null dereference in minput_open_im() after failed m17n_init()","LOW",2.9,"2026-10-07",0],["CVE-2026-107175","MISP","MISP","MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-107168","Red Hat","Red Hat Enterprise Linux 10","M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()","MEDIUM",6.2,"2026-10-07",0],["CVE-2026-107151","Red Hat","Red Hat Satellite 6","Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated request","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-105139","obot-platform","obot","Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-105140","obot-platform","obot","Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group M","LOW",2.3,"2026-10-07",0],["CVE-2026-105138","obot-platform","obot","Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API","HIGH",7.1,"2026-10-07",0],["CVE-2026-107159","miniupnp project","miniupnpd","MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header","HIGH",7.1,"2026-10-07",0],["CVE-2026-106059","gitahead","gitahead","GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript","HIGH",8.7,"2026-10-07",0],["CVE-2026-106057","wummel","patool","patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt","HIGH",8.5,"2026-10-07",0],["CVE-2026-106058","gitahead","gitahead","GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames","HIGH",7.7,"2026-10-07",0],["CVE-2026-106056","rundeck","rundeck","Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting","HIGH",7.7,"2026-10-07",0],["CVE-2026-42708","AF themes","WP Post Author","WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-42710","10Web","Slider by 10Web","WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-42713","Gopiplus","Post title marquee scroll","WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-42714","Piggly Dev","Pix por Piggly (para Woocommerce)","WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-92533","BugTracker.NET","BugTracker.NET","Path Traversal in BugTracker.NET","HIGH",7.1,"2026-10-07",0],["CVE-2026-92532","BugTracker.NET","BugTracker.NET","Unrestricted Upload of File with Dangerous Type in BugTracker.NET","HIGH",7.5,"2026-10-07",0],["CVE-2026-92531","BugTracker.NET","BugTracker.NET","Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET","HIGH",7.5,"2026-10-07",0],["CVE-2026-103668","Six Apart Ltd.","Movable Type Cloud Edition","An SQL Injection vulnerability exists in the Site Search function of Movable Type, which m","HIGH",8.8,"2026-10-07",0],["CVE-2026-96408","Six Apart Ltd.","Movable Type Cloud Edition","A code injection vulnerability exists in the upgrade script of Movable Type, which may all","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-42720","Sarah Giles","Dynamic User Directory","WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-42721","SERVIT Software Solutions","affiliate-toolkit","WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability","HIGH",7.6,"2026-10-07",0],["CVE-2026-105192","LMCache","LMCache","LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-27434","sc Internet Vivoo","WP Rentals","WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-104390","Arraytics","Booktics","WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-105876","WP Chill","Modula Image Gallery","WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-97146","Apache Software Foundation","Apache YuniKorn","Apache YuniKorn: Admission control bypass via system label forgery","MEDIUM",4.8,"2026-10-07",0],["CVE-2026-104393","weDevs","Happy Addons for Elementor","WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-78243","Apache Software Foundation","Apache YuniKorn","Apache YuniKorn: LDAP Group provider panics on lowercase attribute name","LOW",2.1,"2026-10-07",0],["CVE-2026-105875","BdThemes","Prime Slider – Addons For Elementor","WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS)","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-92393","Apache Software Foundation","Apache YuniKorn","Apache YuniKorn: Admission control bypass via workload UPDATE operation","LOW",2,"2026-10-07",0],["CVE-2026-104391","ExpressTech","Quiz And Survey Master","WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerabili","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-103075","WPMU DEV","Hustle","WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-105884","WP Media","Rocket Lazy Load","WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-105873","BdThemes","Element Pack Elementor Addons","WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulne","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-97294","David Lingren","Media LIbrary Assistant","WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilit","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-105871","BdThemes","Element Pack Elementor Addons","WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulne","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-15894","zephyrproject","zephyr","Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement","HIGH",8.8,"2026-10-07",0],["CVE-2026-19186","zephyrproject","zephyr","Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write","HIGH",8.1,"2026-10-07",0],["CVE-2026-103416","Eclipse Foundation","Eclipse ThreadX - NetX Duo","Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX","CRITICAL",9.3,"2026-10-07",0],["CVE-2025-64391","Veeam","Agent for Windows","This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user","MEDIUM",4.1,"2026-10-07",0],["CVE-2025-64392","Veeam","Backup Enterprise Manager","This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script","MEDIUM",4.8,"2026-10-07",0],["CVE-2026-93026","Veeam","Backup and Replication","This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Ente","MEDIUM",6.1,"2026-10-07",0],["CVE-2026-58068","Veeam","Agent for Windows","This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-58069","Veeam","Backup and Replication","This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect ten","HIGH",8.3,"2026-10-07",0],["CVE-2025-64393","Veeam","Backup and Replication","This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitra","CRITICAL",9.4,"2026-10-07",0],["CVE-2026-93684","Apache Software Foundation","Apache Impala","Apache Impala: Stored XSS in Impala query plans","MEDIUM",5.4,"2026-10-07",0],["CVE-2026-90466","Apache Software Foundation","Apache Impala","Apache Impala: Path traversal executes JARs outside trusted paths","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-97720","Apache Software Foundation","Apache Impala","Apache Impala: Impala Executor Webserver Auth Bypass","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-5703","Satel Iberia","SenNet Datalogger Serie 200","Path Traversal in Satel Iberia SenNet Datalogger Serie 200","HIGH",7.1,"2026-10-07",0],["CVE-2026-89417","daanvandenbergh","OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored","HIGH",7.2,"2026-10-07",0],["CVE-2026-107104","Manacle Technologies","Multi-tenant ERP System","Unsafe Deserialization Vulnerability in Manacle Technologies ERP System","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-107103","Manacle Technologies","Multi-tenant ERP System","SQL Injection Vulnerability in Manacle Technologies ERP System","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-107102","Manacle Technologies","Multi-tenant ERP System","Account Takeover Vulnerability in Manacle Technologies ERP System","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-102782","ordasoft.com","OrdaSoft Simple Membership extension for Joomla","Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Members","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-102781","ordasoft.com","Touch Slider extension for Joomla","Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slide","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-107121","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downg","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-82211","","Nexi XPay Build","Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure","HIGH",8.2,"2026-10-07",0],["CVE-2026-82212","","Nexi XPay Build","Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler","HIGH",7.5,"2026-10-07",0],["CVE-2026-105322","","Magee Shortcodes","Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-86833","","MetForm","MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcod","MEDIUM",5.4,"2026-10-07",0],["CVE-2026-97354","","PowerPress Podcasting plugin by Blubrry","PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects","MEDIUM",4.1,"2026-10-07",0],["CVE-2026-86816","","WPCafe","WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-87782","","Koinonia Link","Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator","HIGH",8.8,"2026-10-07",0],["CVE-2026-87971","","If-So Dynamic Content","If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter","HIGH",7.1,"2026-10-07",0],["CVE-2026-96530","","Optimole","Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-97188","","String locator","String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor","HIGH",8.8,"2026-10-07",0],["CVE-2026-97331","","User Private Files","User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_ac","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-104678","","CP Media Player","CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update","LOW",2.7,"2026-10-07",0],["CVE-2026-104953","","MPG","MPG < 4.2.3 - Editor+ SQLi via Project Import","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-105316","","Magee Shortcodes","Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Acti","HIGH",7.1,"2026-10-07",0],["CVE-2026-104050","","Academy LMS","Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answ","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-104651","","Yaad Sarig Payment Gateway For WC","Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulat","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-104652","","Envira Gallery","Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-104653","","Envira Gallery","Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-104667","","Animated Number Counters","Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order","MEDIUM",6.8,"2026-10-07",0],["CVE-2026-104677","","WP Coder","WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP","HIGH",7.2,"2026-10-07",0],["CVE-2026-103323","","Integration for Epos Now and WooCommerce","Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler","MEDIUM",5.9,"2026-10-07",0],["CVE-2026-103378","","Geliver Akıllı Kargo Pazaryeri","Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Publ","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-103681","","Frontend Dashboard","Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_prof","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-104049","","Academy LMS","Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpo","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-103870","Red Hat","Red Hat Satellite 6","Pulp-rpm: distribution tree publish creates directories from .treeinfo ids","MEDIUM",5,"2026-10-07",0],["CVE-2026-103869","Red Hat","Red Hat Ansible Automation Platform 2","Pulp-ansible: bearer tokens are reused across remotes in a worker","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-103868","Red Hat","Red Hat Ansible Automation Platform 2","Pulp-container: registry credentials are reused across remotes in a worker","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-59347","VMware","VMware Workstation","VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability","HIGH",8.1,"2026-10-07",0],["CVE-2026-59346","VMware","VMware Workstation","VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-102173","themeum","Kirki – Freeform Page Builder, Website Builder & Customizer","Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Sto","HIGH",7.2,"2026-10-07",0],["CVE-2026-19572","Flexera","FlexNet Publisher","FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-84897","wolfSSL Inc.","wolfSSH","wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated","MEDIUM",6.9,"2026-10-07",0],["CVE-2026-83742","wolfSSL Inc.","wolfSSH","wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-83540","wolfSSL","wolfSSH","wolfSSHd on Windows race condition leading to logon token reused across connections","HIGH",7.7,"2026-10-07",0],["CVE-2026-81535","wolfSSL Inc.","wolfSSH","wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorizat","MEDIUM",6.3,"2026-10-07",0],["CVE-2026-16516","wolfSSL Inc.","wolfSSH","wolfSSH ECDSA host key curve not validated against negotiated algorithm","CRITICAL",9,"2026-10-07",0],["CVE-2026-106061","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-14911","ASUS","Router","Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in AS","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-19396","ASUS","Router","A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token","HIGH",7.7,"2026-10-07",0],["CVE-2026-19386","ASUS","Router","A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby us","CRITICAL",9.3,"2026-10-07",0],["CVE-2026-16528","ASUS","Router","Insertion of Sensitive Information into Log File in certain ASUS router models allows a re","HIGH",8.4,"2026-10-07",0],["CVE-2026-106471","Red Hat","Red Hat Satellite 6","Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter mult","HIGH",8.1,"2026-10-07",0],["CVE-2026-102478","Octopus Deploy","Octopus Server","In affected versions of Octopus Server, an authenticated user with permission to modify ro","HIGH",8.7,"2026-10-07",0],["CVE-2026-105324","ASUSTOR Inc.","ADM","An HTTP header injection vulnerability was found in the ADM","CRITICAL",9.2,"2026-10-07",0],["CVE-2026-88962","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-93443","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",7.5,"2026-10-07",0],["CVE-2026-93448","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-93449","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.5,"2026-10-07",0],["CVE-2026-93445","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.1,"2026-10-07",0],["CVE-2026-93447","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",7.5,"2026-10-07",0],["CVE-2026-93675","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-93677","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",7.7,"2026-10-07",0],["CVE-2026-93678","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",7.6,"2026-10-07",0],["CVE-2026-93679","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-93674","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-97671","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-97673","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2025-70515","","","The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit","MEDIUM",6.1,"2026-10-07",0],["CVE-2025-70516","","","The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper au","CRITICAL",9.1,"2026-10-07",0],["CVE-2025-70517","","","The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-o","HIGH",8.8,"2026-10-07",0],["CVE-2025-70518","","","The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 doe","CRITICAL",10,"2026-10-07",0],["CVE-2025-70519","","","The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit","MEDIUM",6.1,"2026-10-07",0],["CVE-2025-70520","","","The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper au","CRITICAL",9.8,"2026-10-07",0],["CVE-2025-70521","","","The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 doe","CRITICAL",9.8,"2026-10-07",0],["CVE-2025-70522","","","The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-o","HIGH",8.8,"2026-10-07",0],["CVE-2026-42616","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allow","HIGH",7.8,"2026-10-07",0],["CVE-2026-42617","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c th","HIGH",7.1,"2026-10-07",0],["CVE-2026-42618","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress","HIGH",7.1,"2026-10-07",0],["CVE-2026-46569","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libnt","HIGH",7.7,"2026-10-07",0],["CVE-2026-46570","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in lib","HIGH",8.1,"2026-10-07",0],["CVE-2026-46571","","","In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-46572","","","In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs","HIGH",7.4,"2026-10-07",0],["CVE-2026-88514","","","An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive informa","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-97674","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.1,"2026-10-07",0],["CVE-2026-97678","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-97679","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-97680","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.3,"2026-10-07",0],["CVE-2026-97655","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-97676","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-101329","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-101331","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",7.7,"2026-10-07",0],["CVE-2026-103360","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.1,"2026-10-07",0],["CVE-2026-104334","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","CRITICAL",9.8,"2026-10-07",0],["CVE-2026-104335","IBM","Langflow OSS","Langflow OSS is affected by multiple vulnerabilities","HIGH",8.8,"2026-10-07",0],["CVE-2026-106583","OpenBSD","OpenSSH","In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, le","LOW",2.5,"2026-10-07",0],["CVE-2026-80048","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd-kcm: local denial of service via excessive memory preallocation","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-106509","backstage","backstage","Backstage: Improper validation of MkDocs theme configuration in TechDocs","HIGH",7.7,"2026-10-07",0],["CVE-2026-106508","backstage","backstage","Backstage: Potential file exposure through local TechDocs publisher","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106507","backstage","backstage","Backstage: TechDocs arbitrary file read via mkdocs snippets","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106506","backstage","backstage","Backstage: Improper input validation in scaffolder task list ordering","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106505","backstage","backstage","Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","HIGH",7.7,"2026-10-07",0],["CVE-2026-106504","backstage","backstage","Backstage: Sensitive information exposure in scaffolder task logs","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-106503","backstage","backstage","Backstage: Scaffolder action input authorization bypass","HIGH",8.1,"2026-10-07",0],["CVE-2026-97626","Gitea","Gitea","Gitea profile feed disclosure bypassing user visibility","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-96594","Gitea","Gitea","Gitea repository media API stored XSS","MEDIUM",6.1,"2026-10-07",0],["CVE-2026-89182","Gitea","Gitea","Gitea push-to-create bypass of FORCE_PRIVATE policy","MEDIUM",5.4,"2026-10-07",0],["CVE-2026-105268","Gitea","Gitea","Gitea issue attachment API allows changing comment attachments","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-105267","Gitea","Gitea","Gitea tag delete route deletes releases without release permission","HIGH",8.1,"2026-10-07",0],["CVE-2026-104633","Gitea","Gitea","Gitea migration memory exhaustion from zero page size","MEDIUM",6.5,"2026-10-07",0],["CVE-2026-101023","Gitea","Gitea","Gitea OAuth2 refresh token grant accepts access tokens","CRITICAL",9.1,"2026-10-07",0],["CVE-2026-106502","backstage","backstage","Backstage: Sensitive information may be exposed in Scaffolder task failure events","MEDIUM",5.3,"2026-10-07",0],["CVE-2026-106501","backstage","backstage","Backstage: Sensitive information exposure in Scaffolder","CRITICAL",9.6,"2026-10-07",0],["CVE-2026-106500","backstage","backstage","Backstage: Improper task state validation in Scaffolder backend","HIGH",8.5,"2026-10-07",0],["CVE-2026-106499","backstage","backstage","Backstage: Secret-derived values may be exposed in scaffolder task logs","MEDIUM",4.9,"2026-10-07",0],["CVE-2026-106498","backstage","backstage","Backstage: Improper URL validation in catalog entity placeholder resolution","HIGH",7.7,"2026-10-07",0],["CVE-2026-106589","OpenBSD","OpenSSH","In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer ","LOW",2.9,"2026-10-07",0],["CVE-2026-106497","backstage","backstage","Backstage: Inconsistent catalog property permission evaluation","MEDIUM",4.3,"2026-10-07",0],["CVE-2026-97208","Gitea","Gitea","Gitea push mirror API bypass of DISABLE_NEW_PUSH policy","MEDIUM",4.9,"2026-10-07",0],["CVE-2026-106496","backstage","backstage","Backstage: Inconsistent enforcement of allowed location types during catalog processing","LOW",3.1,"2026-10-07",0],["CVE-2026-86684","Gitea","Gitea","Gitea push mirror local path check uses the repository owner","HIGH",7.1,"2026-10-07",0],["CVE-2026-106588","OpenBSD","OpenSSH","In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of","LOW",3.1,"2026-10-07",0],["CVE-2026-65142","NVIDIA","Model-Optimizer","NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserializatio","HIGH",7.8,"2026-10-07",0],["CVE-2026-106587","OpenBSD","OpenSSH","In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes i","LOW",3.6,"2026-10-07",0],["CVE-2026-65122","NVIDIA","TensorRT","NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read","MEDIUM",5.5,"2026-10-07",0],["CVE-2026-106586","OpenBSD","OpenSSH","In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to ","LOW",2.5,"2026-10-06",0],["CVE-2026-106494","backstage","backstage","Backstage: Improper input validation in cloud storage URL readers","MEDIUM",4.4,"2026-10-06",0],["CVE-2026-106585","OpenBSD","OpenSSH","In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet l","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106493","backstage","backstage","Backstage: Cloud storage catalog locations may cross configured storage boundaries","LOW",3,"2026-10-06",0],["CVE-2026-106492","backstage","backstage","Backstage: Improper preservation of access restrictions during service credential delegati","HIGH",7.6,"2026-10-06",0],["CVE-2026-106584","OpenBSD","OpenSSH","In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times b","LOW",2.5,"2026-10-06",0],["CVE-2026-106491","backstage","backstage","Backstage: Improper input validation in proxy-backend","MEDIUM",6.4,"2026-10-06",0],["CVE-2026-106490","backstage","backstage","Backstage: Improper input validation in TechDocs static content requests","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106489","backstage","backstage","Backstage: Improper authorization enforcement for TechDocs static content","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106488","backstage","backstage","Backstage: Improper authentication in the OIDC provider","HIGH",8.1,"2026-10-06",0],["CVE-2026-104045","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via race condition in autofs responder","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106487","backstage","backstage","Backstage: Unsupported catalog cluster authentication mode in kubernetes backend","LOW",3.5,"2026-10-06",0],["CVE-2026-106582","OpenBSD","OpenSSH","In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though t","LOW",3.7,"2026-10-06",0],["CVE-2026-106486","backstage","backstage","Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions","HIGH",8.5,"2026-10-06",0],["CVE-2026-106032","aws","bedrock-agentcore-starter-toolkit","Server-side request forgery and local file read via unrestricted external OpenAPI referenc","MEDIUM",5.7,"2026-10-06",0],["CVE-2026-105812","aws","bedrock-agentcore-starter-toolkit","Code injection via unencoded configuration values during Python code generation in Bedrock","HIGH",8.8,"2026-10-06",0],["CVE-2026-106463","backstage","backstage","Backstage: Improper authorization in GitLab organizational user ingestion","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106462","backstage","backstage","Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallb","MEDIUM",6.4,"2026-10-06",0],["CVE-2026-106555","OpenBSD","OpenSSH","In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly ","LOW",2.2,"2026-10-06",0],["CVE-2026-106553","OpenBSD","OpenSSH","In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSS","LOW",2.2,"2026-10-06",0],["CVE-2026-106461","backstage","backstage","Backstage: Incorrect authorization in scaffolder task listing","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106460","backstage","backstage","Backstage: Explicit negative email verification can be ignored during shared OAuth profile","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106552","OpenBSD","OpenSSH","In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106459","backstage","backstage","Backstage: Improper input validation in Sentry scaffolder actions","HIGH",8.5,"2026-10-06",0],["CVE-2026-106458","backstage","backstage","Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106547","The HDF Group","HDF5","HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata","HIGH",8.5,"2026-10-06",0],["CVE-2026-106457","backstage","backstage","Backstage: Insufficient audience validation in the Cloudflare Access auth provider","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106456","backstage","backstage","Backstage: Inconsistent credential enforcement for overlapping proxy routes","MEDIUM",4.8,"2026-10-06",0],["CVE-2026-106550","Mozilla","Node-convict","CVE-2026-106550","HIGH",7.5,"2026-10-06",0],["CVE-2026-43598","AMD","AMD Instinct™ MI210","Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could a","HIGH",7.7,"2026-10-06",0],["CVE-2026-106455","backstage","backstage","Backstage: Improper validation of MkDocs plugin configuration in TechDocs","HIGH",7.7,"2026-10-06",0],["CVE-2026-105811","aws","qnabot-on-aws","Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sa","HIGH",7.1,"2026-10-06",0],["CVE-2026-104046","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via incomplete identity provider authentication requests","MEDIUM",6.2,"2026-10-06",0],["CVE-2026-106062","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file","HIGH",7.8,"2026-10-06",0],["CVE-2026-101258","Red Hat","Red Hat Enterprise Linux 10","Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedur","HIGH",7.8,"2026-10-06",0],["CVE-2026-19029","The HDF Group","HDF5","HDF5 scale-offset filter heap buffer over-read via crafted chunk","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106454","twisted","twisted","Twisted: IMAP wildcardToRegexp() ReDoS","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106453","yawkat","lz4-java","yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte ","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106452","yawkat","lz4-java","yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the s","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105244","Apache Software Foundation","Apache log4net","Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105243","Apache Software Foundation","Apache log4net","Apache log4net: Oversize EventLogAppender record silently discarded","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106451","yawkat","lz4-java","yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable t","HIGH",7.3,"2026-10-06",0],["CVE-2026-105242","Apache Software Foundation","Apache log4net","Apache log4net: Request validation failure drops the event in the aspnet-request converter","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105241","Apache Software Foundation","Apache log4net","Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106450","yawkat","lz4-java","yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing C","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105240","Apache Software Foundation","Apache log4net","Apache log4net: NUL character truncates OutputDebugStringAppender records","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105239","Apache Software Foundation","Apache log4net","Apache log4net: NUL character truncates EventLogAppender records","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106449","yawkat","lz4-java","yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty b","LOW",3.7,"2026-10-06",0],["CVE-2026-106448","StableLib","stablelib","StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding","HIGH",8.9,"2026-10-06",0],["CVE-2026-105111","Apache Software Foundation","Apache Commons BCEL","Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS","LOW",2.3,"2026-10-06",0],["CVE-2026-106447","StableLib","stablelib","StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags","HIGH",8.7,"2026-10-06",0],["CVE-2026-94114","Apache Software Foundation","Apache Commons BCEL","Apache Commons BCEL: Class repositories cache class files under their self-declared names,","HIGH",8.2,"2026-10-06",0],["CVE-2026-106446","handlebars-lang","handlebars.js","Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-102165","Arista Networks","Wi-Fi Access Points","Security Advisory 0198","HIGH",7.7,"2026-10-06",0],["CVE-2026-102167","Arista Networks","Wi-Fi Access Points","Security Advisory 0197","CRITICAL",9,"2026-10-06",0],["CVE-2026-102163","Arista Networks","Wi-Fi Access Points","Security Advisory 0195","HIGH",8.7,"2026-10-06",0],["CVE-2026-102164","Arista Networks","Wi-Fi Access Points","Security Advisory 0196","LOW",2.3,"2026-10-06",0],["CVE-2026-102168","Arista Networks","Wi-Fi Access Points","Security Advisory 0194","HIGH",7.1,"2026-10-06",0],["CVE-2026-102169","Arista Networks","Wi-Fi Access Points","Security Advisory 0194","HIGH",7.1,"2026-10-06",0],["CVE-2026-101157","Arista Networks","CloudVision CUE","Security Advisory 0192","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-102162","Arista Networks","Wi-Fi Access Points","Security Advisory 0193","CRITICAL",9.4,"2026-10-06",0],["CVE-2026-101156","Arista Networks","CloudVision CUE","Security Advisory 0192","MEDIUM",6.2,"2026-10-06",0],["CVE-2026-102156","Arista Networks","CloudVision CUE","Security Advisory 0191","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-102160","Arista Networks","CloudVision CUE","Security Advisory 0190","HIGH",8.6,"2026-10-06",0],["CVE-2026-102161","Arista Networks","CloudVision CUE","Security Advisory 0190","HIGH",8.7,"2026-10-06",0],["CVE-2026-102158","Arista Networks","CloudVision CUE","Security Advisory 0190","HIGH",7.1,"2026-10-06",0],["CVE-2026-102159","Arista Networks","CloudVision CUE","Security Advisory 0190","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-102155","Arista Networks","CloudVision CUE","Security Advisory 0190","HIGH",7.1,"2026-10-06",0],["CVE-2026-102157","Arista Networks","CloudVision CUE","Security Advisory 0190","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106445","handlebars-lang","handlebars.js","Handlebars: JavaScript Injection via Own Property Check Bypass","CRITICAL",9.2,"2026-10-06",0],["CVE-2026-101155","Arista Networks","CloudVision Portal","Security Advisory 0189","HIGH",8.6,"2026-10-06",0],["CVE-2026-101154","Arista Networks","CloudVision Portal","Security Advisory 0189","HIGH",8.6,"2026-10-06",0],["CVE-2026-101153","Arista Networks","CloudVision Portal","Security Advisory 0188","HIGH",7.2,"2026-10-06",0],["CVE-2026-101151","Arista Networks","CloudVision Portal","Security Advisory 0187","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-101152","Arista Networks","CloudVision Portal","Security Advisory 0187","HIGH",7.6,"2026-10-06",0],["CVE-2026-101149","Arista Networks","CloudVision Portal","Security Advisory 0186","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-101150","Arista Networks","CloudVision Portal","Security Advisory 0186","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-101158","Arista Networks","CloudVision Portal","Security Advisory 0185","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-106063","Red Hat","Red Hat Enterprise Linux 10","Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions","MEDIUM",6.3,"2026-10-06",0],["CVE-2026-104048","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-104047","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: information disclosure via query injection in entra id lookups","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-73278","Gitea","Gitea","Gitea WebAuthn bypass during OAuth and OIDC sign-in","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-103009","Elastic","Elasticsearch","Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information D","HIGH",7.1,"2026-10-06",0],["CVE-2026-103008","Elastic","Elasticsearch","Uncontrolled Recursion in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-103007","Elastic","Elasticsearch","Incorrect Authorization in Elasticsearch Leading to Privilege Escalation","HIGH",7.2,"2026-10-06",0],["CVE-2026-103006","Elastic","Elasticsearch","Uncontrolled Recursion in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-103005","Elastic","Elasticsearch","Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-102413","Elastic","Elastic Agent and Elastic Defend","Uncaught Exception in Elastic Endpoint Leading to Denial of Service","MEDIUM",6.2,"2026-10-06",0],["CVE-2026-102412","Elastic","Kibana","Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-102411","Elastic","Elasticsearch","Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-102410","Elastic","Kibana","Missing Authorization in Kibana Leading to Information Disclosure","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-102409","Elastic","Elasticsearch","Uncontrolled Recursion in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-102408","Elastic","Elasticsearch","Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-102407","Elastic","Elasticsearch","Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-102406","Elastic","Kibana","Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data In","HIGH",8.8,"2026-10-06",0],["CVE-2026-102404","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-96589","Gitea","Gitea","Gitea private repository access retained after rejected transfer","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-96580","Gitea","Gitea","Gitea Actions memory exhaustion through large static matrices","HIGH",7.5,"2026-10-06",0],["CVE-2026-96404","Gitea","Gitea","Gitea installer authentication bypass for existing accounts","HIGH",8.1,"2026-10-06",0],["CVE-2026-96400","Gitea","Gitea","Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-96399","Gitea","Gitea","Gitea denial of service through external issue tracker patterns","HIGH",7.5,"2026-10-06",0],["CVE-2026-95112","Gitea","Gitea","Gitea issue reference parsing CPU exhaustion","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-94205","Gitea","Gitea","Gitea fork workflow approval bypass through maintainer-triggered events","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-79960","Gitea","Gitea","Gitea deploy key pushes acting as the repository owner","HIGH",7.1,"2026-10-06",0],["CVE-2026-70357","Gitea","Gitea","Gitea repository migration SSRF through DNS rebinding","HIGH",7.5,"2026-10-06",0],["CVE-2026-104636","Gitea","Gitea","Gitea SSRF through Git HTTP redirects in mirrors and fetches","HIGH",7.5,"2026-10-06",0],["CVE-2026-76061","Red Hat","Red Hat OpenShift Container Platform 4","Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-103504","Gitea","Gitea","Gitea API team demotion not applied to unit permissions","HIGH",8.1,"2026-10-06",0],["CVE-2026-95106","Gitea","Gitea","Gitea review and execution mismatch through duplicate tree entries","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-89430","Gitea","Gitea","Gitea push mirror SSRF and forced writes to internal Git hosts","HIGH",8.1,"2026-10-06",0],["CVE-2026-103670","Gitea","Gitea","Gitea trusted workflow cancellation by unapproved fork runs","HIGH",7.5,"2026-10-06",0],["CVE-2026-103667","Gitea","Gitea","Gitea container registry stored XSS through blob media type","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-101029","Gitea","Gitea","Gitea migration and pull mirror SSRF through multi-answer DNS","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-101027","Gitea","Gitea","Gitea migration SSRF through ALLOWED_DOMAINS address check bypass","HIGH",7.7,"2026-10-06",0],["CVE-2026-104626","Gitea","Gitea","Gitea fork workflow job revival through later approval","HIGH",8.8,"2026-10-06",0],["CVE-2026-103059","Gitea","Gitea","Gitea built-in SSH server authentication bypass through key case folding","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-104632","Gitea","Gitea","Gitea fork workflow approval bypass through cancel and rerun","HIGH",8.8,"2026-10-06",0],["CVE-2026-79818","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in C","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-79817","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Clien","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-79815","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agen","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-79816","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-79814","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Local Arbitrary File Write Leading to Local Privilege Escalation in ClearPass Policy Manag","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-79813","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Local Privilege Escalation in ClearPass Client Software","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-79812","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Local Denial-of-Service Vulnerability in the OnGuard Agent of ClearPass Poli","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-79811","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API","HIGH",7.2,"2026-10-06",0],["CVE-2026-79809","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authoriza","HIGH",7.3,"2026-10-06",0],["CVE-2026-79810","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Man","HIGH",7.2,"2026-10-06",0],["CVE-2026-79807","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege ","HIGH",7.8,"2026-10-06",0],["CVE-2026-79808","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard ","HIGH",7.8,"2026-10-06",0],["CVE-2026-79806","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent","HIGH",7.8,"2026-10-06",0],["CVE-2026-79805","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modificat","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-79803","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manage","HIGH",8.8,"2026-10-06",0],["CVE-2026-79802","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Command Injection Vulnerability in the ClearPass Policy Manager Client Software","HIGH",8.8,"2026-10-06",0],["CVE-2026-79800","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Pol","HIGH",8.8,"2026-10-06",0],["CVE-2026-79801","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass P","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-79799","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manage","HIGH",8.8,"2026-10-06",0],["CVE-2026-79797","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Improper Access Control in HPE Networking ClearPass Android Client Application","HIGH",8.8,"2026-10-06",0],["CVE-2026-79798","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Manageme","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-79796","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authentication Bypass Vulnerabilities in ClearPass Policy Manager","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-79794","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-76754","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Po","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76753","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76751","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Una","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76752","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Una","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76750","Hewlett Packard Enterprise (HPE)","ClearPass Policy Manager (CPPM)","Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web ","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76749","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Unauthenticated Sensitive Information Disclosure in AOS-S","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-76748","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Authenticated Privilege Escalation Vulnerability in the API of AOS-S","HIGH",8.8,"2026-10-06",0],["CVE-2026-76747","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-76746","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure i","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-76745","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Executio","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-76744","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76743","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Authentication Bypass Vulnerability in the Management Interface of AOS-S","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76742","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Authentication Bypass in the Web Management Interface of AOS-S","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-76741","Hewlett Packard Enterprise (HPE)","AOS-Switch (AOS-S)","Authenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-S","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106444","handlebars-lang","handlebars.js","Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106513","MISP","MISP","MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Config","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-106443","Kozea","WeasyPrint","WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE","HIGH",8.8,"2026-10-06",0],["CVE-2026-96890","GitHub","Enterprise Server","Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that ","HIGH",8.7,"2026-10-06",0],["CVE-2026-103620","GitHub","Enterprise Server","Missing authorization in GitHub Enterprise Server allowed repository writers to replace de","MEDIUM",6,"2026-10-06",0],["CVE-2026-106442","hydra-ecosystem","hydra","Hydra instantiate target blacklist bypasses permit code execution","HIGH",7.8,"2026-10-06",0],["CVE-2026-106441","hydra-ecosystem","hydra","Hydra logging configuration permits unsafe callable resolution","HIGH",7.8,"2026-10-06",0],["CVE-2026-103778","Dell","Command | Configure (DCC)","Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cry","MEDIUM",6.2,"2026-10-06",0],["CVE-2026-106511","MultiversX Labs S.R.L.","multisig-improved","CVE-2026-106511","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-106440","hydra-ecosystem","hydra","Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_meth","HIGH",7.8,"2026-10-06",0],["CVE-2026-104073","netbox-community","netbox","NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-82162","Dell","Command | Configure (DCC)","Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling o","HIGH",7.4,"2026-10-06",0],["CVE-2026-106439","hydra-ecosystem","hydra","Hydra: Mutable instantiate policy sets allow target blocklist bypass","HIGH",8.5,"2026-10-06",0],["CVE-2026-106512","MISP","sachertortephp","MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Fil","HIGH",8.4,"2026-10-06",0],["CVE-2026-70414","Dell","Command | Configure (DCC)","Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-106234","Google","Chrome","Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106251","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allow","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106269","Google","Chrome","Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to","HIGH",8.8,"2026-10-06",0],["CVE-2026-106272","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106310","Google","Chrome","Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106345","Google","Chrome","Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remo","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106355","Google","Chrome","Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allow","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106236","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106294","Google","Chrome","Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-106325","Google","Chrome","Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106334","Google","Chrome","Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote atta","HIGH",8.8,"2026-10-06",0],["CVE-2026-106385","Google","Chrome","Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106390","Google","Chrome","Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 1","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106195","Google","Chrome","Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 al","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-106256","Google","Chrome","Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowe","HIGH",8.8,"2026-10-06",0],["CVE-2026-106316","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allow","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106320","Google","Chrome","Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106339","Google","Chrome","Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote ","LOW",3.1,"2026-10-06",0],["CVE-2026-106371","Google","Chrome","Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 1","HIGH",8.8,"2026-10-06",0],["CVE-2026-106413","Google","Chrome","Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106270","Google","Chrome","Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106288","Google","Chrome","Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106305","Google","Chrome","UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allow","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106343","Google","Chrome","Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.805","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106350","Google","Chrome","Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remot","HIGH",8.8,"2026-10-06",0],["CVE-2026-106418","Google","Chrome","Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106179","Google","Chrome","UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106237","Google","Chrome","Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote a","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106249","Google","Chrome","Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106331","Google","Chrome","Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106368","Google","Chrome","UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106374","Google","Chrome","Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106380","Google","Chrome","UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attack","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106220","Google","Chrome","Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote att","HIGH",8.8,"2026-10-06",0],["CVE-2026-106221","Google","Chrome","Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a","HIGH",8.3,"2026-10-06",0],["CVE-2026-106259","Google","Chrome","Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allow","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106285","Google","Chrome","UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106296","Google","Chrome","Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allo","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106417","Google","Chrome","Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106186","Google","Chrome","Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prio","HIGH",8.6,"2026-10-06",0],["CVE-2026-106192","Google","Chrome","Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a loc","MEDIUM",4.6,"2026-10-06",0],["CVE-2026-106247","Google","Chrome","Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.3,"2026-10-06",0],["CVE-2026-106264","Google","Chrome","Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome pr","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106399","Google","Chrome","Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacke","LOW",3.3,"2026-10-06",0],["CVE-2026-106422","Google","Chrome","Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106199","Google","Chrome","Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 all","HIGH",8.2,"2026-10-06",0],["CVE-2026-106260","Google","Chrome","Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remo","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106275","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowe","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106287","Google","Chrome","Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106297","Google","Chrome","Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106299","Google","Chrome","Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106362","Google","Chrome","Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106187","Google","Chrome","Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a rem","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106252","Google","Chrome","Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote att","HIGH",8.8,"2026-10-06",0],["CVE-2026-106306","Google","Chrome","Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a loca","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106309","Google","Chrome","Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 all","HIGH",8.8,"2026-10-06",0],["CVE-2026-106394","Google","Chrome","Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attack","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106427","Google","Chrome","Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remo","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106191","Google","Chrome","Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote at","HIGH",8.3,"2026-10-06",0],["CVE-2026-106250","Google","Chrome","Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106312","Google","Chrome","Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106317","Google","Chrome","UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106344","Google","Chrome","Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a rem","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106353","Google","Chrome","Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allo","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106359","Google","Chrome","Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106276","Google","Chrome","UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106338","Google","Chrome","UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.805","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106340","Google","Chrome","Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.","MEDIUM",4.6,"2026-10-06",0],["CVE-2026-106341","Google","Chrome","Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106372","Google","Chrome","Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote att","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106409","Google","Chrome","Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0","HIGH",8.3,"2026-10-06",0],["CVE-2026-106207","Google","Chrome","Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106210","Google","Chrome","Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote ","LOW",3.1,"2026-10-06",0],["CVE-2026-106254","Google","Chrome","Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-106321","Google","Chrome","Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attac","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106351","Google","Chrome","Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 a","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106384","Google","Chrome","Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106386","Google","Chrome","Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106183","Google","Chrome","Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 ","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-106263","Google","Chrome","Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remo","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106295","Google","Chrome","Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allow","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106330","Google","Chrome","Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106337","Google","Chrome","UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106352","Google","Chrome","Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a re","HIGH",8.8,"2026-10-06",0],["CVE-2026-106404","Google","Chrome","Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106271","Google","Chrome","Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote ","HIGH",8.1,"2026-10-06",0],["CVE-2026-106304","Google","Chrome","Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attac","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106388","Google","Chrome","Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106395","Google","Chrome","Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allow","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106398","Google","Chrome","Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106401","Google","Chrome","Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote atta","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106212","Google","Chrome","Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remo","HIGH",8.8,"2026-10-06",0],["CVE-2026-106262","Google","Chrome","Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106292","Google","Chrome","Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.3,"2026-10-06",0],["CVE-2026-106307","Google","Chrome","Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106348","Google","Chrome","Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote att","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106360","Google","Chrome","Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106375","Google","Chrome","Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attack","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106229","Google","Chrome","UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106232","Google","Chrome","UI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106301","Google","Chrome","Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remo","HIGH",8.1,"2026-10-06",0],["CVE-2026-106336","Google","Chrome","Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106373","Google","Chrome","Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a re","HIGH",8.8,"2026-10-06",0],["CVE-2026-106391","Google","Chrome","Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 ","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106403","Google","Chrome","Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a","HIGH",8.1,"2026-10-06",0],["CVE-2026-106205","Google","Chrome","Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 a","HIGH",8.1,"2026-10-06",0],["CVE-2026-106213","Google","Chrome","Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attack","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106226","Google","Chrome","Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106230","Google","Chrome","Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.80","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106367","Google","Chrome","Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allo","HIGH",8.4,"2026-10-06",0],["CVE-2026-106400","Google","Chrome","Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a r","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106209","Google","Chrome","UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106216","Google","Chrome","Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.80","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106277","Google","Chrome","Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote att","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106284","Google","Chrome","Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allow","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106328","Google","Chrome","Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allow","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-106387","Google","Chrome","Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106410","Google","Chrome","Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a rem","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106180","Google","Chrome","Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remo","LOW",3.1,"2026-10-06",0],["CVE-2026-106201","Google","Chrome","Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106206","Google","Chrome","Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allo","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-106228","Google","Chrome","Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote at","HIGH",8.3,"2026-10-06",0],["CVE-2026-106289","Google","Chrome","Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106303","Google","Chrome","Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106333","Google","Chrome","Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106188","Google","Chrome","Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a ","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-106280","Google","Chrome","Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allow","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106322","Google","Chrome","Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-106356","Google","Chrome","Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leve","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106370","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowe","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106405","Google","Chrome","Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed","MEDIUM",6,"2026-10-06",0],["CVE-2026-106182","Google","Chrome","UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote att","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106246","Google","Chrome","Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106282","Google","Chrome","UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106302","Google","Chrome","UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106311","Google","Chrome","Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106392","Google","Chrome","Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106416","Google","Chrome","Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106253","Google","Chrome","Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106279","Google","Chrome","Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059","HIGH",7.4,"2026-10-06",0],["CVE-2026-106342","Google","Chrome","Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote atta","HIGH",8.8,"2026-10-06",0],["CVE-2026-106361","Google","Chrome","Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106402","Google","Chrome","Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a re","MEDIUM",4.8,"2026-10-06",0],["CVE-2026-106424","Google","Chrome","Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","MEDIUM",4,"2026-10-06",0],["CVE-2026-106198","Google","Chrome","Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remo","HIGH",8.2,"2026-10-06",0],["CVE-2026-106261","Google","Chrome","Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106290","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowe","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106326","Google","Chrome","Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a loca","MEDIUM",4.4,"2026-10-06",0],["CVE-2026-106354","Google","Chrome","Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106378","Google","Chrome","Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a","HIGH",8.3,"2026-10-06",0],["CVE-2026-106406","Google","Chrome","Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed ","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106196","Google","Chrome","Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allo","HIGH",7.6,"2026-10-06",0],["CVE-2026-106389","Google","Chrome","Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106397","Google","Chrome","Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowe","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-106407","Google","Chrome","Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106408","Google","Chrome","Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 a","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106414","Google","Chrome","Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allo","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106185","Google","Chrome","Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106189","Google","Chrome","Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a r","HIGH",7.3,"2026-10-06",0],["CVE-2026-106224","Google","Chrome","Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a rem","LOW",3.1,"2026-10-06",0],["CVE-2026-106244","Google","Chrome","Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a r","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106335","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106415","Google","Chrome","Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106217","Google","Chrome","Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a rem","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106225","Google","Chrome","Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote","HIGH",8.8,"2026-10-06",0],["CVE-2026-106266","Google","Chrome","Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remo","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106363","Google","Chrome","Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remo","HIGH",8.3,"2026-10-06",0],["CVE-2026-106381","Google","Chrome","Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 all","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106425","Google","Chrome","Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remo","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106223","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowe","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106241","Google","Chrome","Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 al","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106242","Google","Chrome","Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106283","Google","Chrome","Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attac","HIGH",8.8,"2026-10-06",0],["CVE-2026-106291","Google","Chrome","Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remo","HIGH",8.8,"2026-10-06",0],["CVE-2026-106300","Google","Chrome","Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106314","Google","Chrome","Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a rem","HIGH",8.8,"2026-10-06",0],["CVE-2026-106194","Google","Chrome","Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106267","Google","Chrome","Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote ","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106274","Google","Chrome","Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.3","HIGH",8.8,"2026-10-06",0],["CVE-2026-106313","Google","Chrome","Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 a","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-106315","Google","Chrome","Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106365","Google","Chrome","Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106181","Google","Chrome","Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106208","Google","Chrome","Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106222","Google","Chrome","Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-106238","Google","Chrome","Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106286","Google","Chrome","Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attack","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-106324","Google","Chrome","Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.80","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-106420","Google","Chrome","Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106200","Google","Chrome","Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106204","Google","Chrome","Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to","HIGH",8.8,"2026-10-06",0],["CVE-2026-106265","Google","Chrome","UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote atta","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106349","Google","Chrome","Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106383","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106421","Google","Chrome","Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to","HIGH",8.8,"2026-10-06",0],["CVE-2026-104945","TP-Link Systems Inc.","Tapo C500 v2.0","Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106184","Google","Chrome","Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106190","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106240","Google","Chrome","Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106346","Google","Chrome","Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a re","HIGH",8.8,"2026-10-06",0],["CVE-2026-106357","Google","Chrome","Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.8,"2026-10-06",0],["CVE-2026-106411","Google","Chrome","Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.8,"2026-10-06",0],["CVE-2026-106423","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106233","Google","Chrome","Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","HIGH",8.3,"2026-10-06",0],["CVE-2026-106235","Google","Chrome","Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attack","HIGH",8.8,"2026-10-06",0],["CVE-2026-106257","Google","Chrome","Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker t","HIGH",8.8,"2026-10-06",0],["CVE-2026-106268","Google","Chrome","Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.8,"2026-10-06",0],["CVE-2026-106278","Google","Chrome","Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.8,"2026-10-06",0],["CVE-2026-106318","Google","Chrome","Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106211","Google","Chrome","Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attack","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106227","Google","Chrome","Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker t","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106248","Google","Chrome","Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attack","HIGH",8.8,"2026-10-06",0],["CVE-2026-106255","Google","Chrome","Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106329","Google","Chrome","Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a re","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106379","Google","Chrome","Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote at","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106393","Google","Chrome","Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","HIGH",8.3,"2026-10-06",0],["CVE-2026-106193","Google","Chrome","Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker","HIGH",8.8,"2026-10-06",0],["CVE-2026-106203","Google","Chrome","Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a","HIGH",8.8,"2026-10-06",0],["CVE-2026-106273","Google","Chrome","Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106281","Google","Chrome","Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker t","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106298","Google","Chrome","Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a ","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106332","Google","Chrome","Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106202","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allo","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106231","Google","Chrome","Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106239","Google","Chrome","Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a ","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106323","Google","Chrome","Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 ","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106396","Google","Chrome","Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106419","Google","Chrome","Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a re","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106426","Google","Chrome","Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106214","Google","Chrome","Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106243","Google","Chrome","Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjace","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106293","Google","Chrome","Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106364","Google","Chrome","Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106377","Google","Chrome","Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106412","Google","Chrome","Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote ","HIGH",8.3,"2026-10-06",0],["CVE-2026-106215","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allo","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106258","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allo","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106308","Google","Chrome","Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8","HIGH",8.8,"2026-10-06",0],["CVE-2026-106366","Google","Chrome","Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 all","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-106369","Google","Chrome","Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remot","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-106376","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allo","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-102322","Google","Chrome","Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106245","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote a","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-106327","Google","Chrome","Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote a","HIGH",8.3,"2026-10-06",0],["CVE-2026-106347","Google","Chrome","Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106197","Google","Chrome","Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacke","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106358","Google","Chrome","Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote atta","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106382","Google","Chrome","Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote atta","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-104944","TP-Link Systems Inc.","Tapo C500 v2.0","Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500","HIGH",7.1,"2026-10-06",0],["CVE-2026-86362","Dell","System Update","Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnera","HIGH",8.2,"2026-10-06",0],["CVE-2026-86361","Dell","System Update","Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment","HIGH",8.2,"2026-10-06",0],["CVE-2026-56952","Google","Android","In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission byp","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-56936","Google","Android","In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due t","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-56906","Google","Android","In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. Thi","HIGH",7,"2026-10-06",0],["CVE-2026-55330","Google","Android","In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-55307","Google","Android","In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due ","MEDIUM",4.4,"2026-10-06",0],["CVE-2026-0198","Google","Android","In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing perm","MEDIUM",4.4,"2026-10-06",0],["CVE-2026-105488","Devolutions","Server","Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier all","HIGH",7.1,"2026-10-06",0],["CVE-2026-105485","Devolutions","Server","Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-106033","Red Hat","Red Hat Ansible Automation Platform 2","Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-63697","Dell","System Update","Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation","HIGH",7.6,"2026-10-06",0],["CVE-2026-9226","Devolutions","Server","Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-86360","Dell","System Update","Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathna","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-106123","rabbitmq","rabbitmq-java-client","RabbitMQ Java client: plaintext broker credentials leaked in exception message from Connec","MEDIUM",5.7,"2026-10-06",0],["CVE-2026-83550","Red Hat","Multicluster Global Hub","Postgres-exporter: net/http/pprof exposed on metrics listener","HIGH",7.1,"2026-10-06",0],["CVE-2026-106122","rabbitmq","rabbitmq-java-client","RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers","MEDIUM",6,"2026-10-06",0],["CVE-2026-71168","Dell","System Update","Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathna","HIGH",7.3,"2026-10-06",0],["CVE-2026-106121","rabbitmq","rabbitmq-java-client","RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, c","MEDIUM",4.9,"2026-10-06",0],["CVE-2026-106120","harttle","liquidjs","LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/sl","MEDIUM",6,"2026-10-06",0],["CVE-2026-106119","langchain-ai","langchainjs","LangChain: MongoDBChatMessageHistory query injection can allow cross-session access","MEDIUM",6,"2026-10-06",0],["CVE-2026-106118","SixLabors","ImageSharp","ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes sca","HIGH",7.5,"2026-10-06",0],["CVE-2026-106117","SixLabors","ImageSharp","ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows s","HIGH",7.5,"2026-10-06",0],["CVE-2026-106116","SixLabors","ImageSharp","ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-88252","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via responder connection retry loop during file descriptor e","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-106115","SixLabors","ImageSharp","ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer","HIGH",7.5,"2026-10-06",0],["CVE-2026-106114","SixLabors","ImageSharp","ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-66666","Automattic","WordPress","WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private a","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-106113","SixLabors","ImageSharp","ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram ","HIGH",7.5,"2026-10-06",0],["CVE-2026-106112","SixLabors","ImageSharp","ImageSharp: ICC LUT16 output channel count can write beyond Vector4","HIGH",7.5,"2026-10-06",0],["CVE-2026-106111","SixLabors","ImageSharp","ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-101207","Dell","OpenManage Integration","Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, ","HIGH",8.8,"2026-10-06",0],["CVE-2026-106110","SixLabors","ImageSharp","ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer","HIGH",7.5,"2026-10-06",0],["CVE-2026-106109","quasarframework","quasar","Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output d","MEDIUM",4.1,"2026-10-06",0],["CVE-2026-106107","quasarframework","quasar","Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained","HIGH",8.3,"2026-10-06",0],["CVE-2026-106106","quasarframework","quasar","Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </sc","HIGH",7.1,"2026-10-06",0],["CVE-2026-106105","quasarframework","quasar","Quasar Framework: Development TLS private keys are cached with overly permissive filesyste","HIGH",8.4,"2026-10-06",0],["CVE-2026-106104","quasarframework","quasar","Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Q","HIGH",8.7,"2026-10-06",0],["CVE-2026-106103","quasarframework","quasar","Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile","HIGH",7.1,"2026-10-06",0],["CVE-2026-106102","quasarframework","quasar","Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()","CRITICAL",10,"2026-10-06",0],["CVE-2026-106101","quasarframework","quasar","Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Caus","LOW",3.1,"2026-10-06",0],["CVE-2026-106100","payloadcms","payload","Payload: Field-level write access bypass in Payload on MongoDB","HIGH",7.1,"2026-10-06",0],["CVE-2026-105868","payloadcms","payload","Payload: Uploaded XML files could execute same-origin JavaScript","HIGH",8.6,"2026-10-06",0],["CVE-2026-105867","payloadcms","payload","Payload: Client uploads could overwrite S3 objects","HIGH",7.1,"2026-10-06",0],["CVE-2026-105866","payloadcms","payload","Payload: Unauthenticated account-lockout denial of service","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105865","payloadcms","payload","Payload: Incomplete validation during the upload file lifecycle","HIGH",8.1,"2026-10-06",0],["CVE-2026-105864","payloadcms","payload","Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105863","payloadcms","payload","Payload authentication token field handling issue","CRITICAL",9.2,"2026-10-06",0],["CVE-2026-105862","payloadcms","payload","Payload: Bypassed sanitization of user uploaded SVGs","HIGH",8.7,"2026-10-06",0],["CVE-2026-105861","payloadcms","payload","Payload external upload trust validation issue","HIGH",7.2,"2026-10-06",0],["CVE-2026-105860","payloadcms","payload","Payload: Tenant authorization bypass in Multi-Tenant Plugin","HIGH",7.1,"2026-10-06",0],["CVE-2026-106218","JetBrains","TeamCity","In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE o","HIGH",8.8,"2026-10-06",0],["CVE-2026-106219","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed rea","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105859","payloadcms","payload","Payload: Unauthorized update to collection documents","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-105858","payloadcms","payload","Payload: Remote Code Execution through first-register","HIGH",8.1,"2026-10-06",0],["CVE-2026-105857","payloadcms","payload","Payload: RCE in Payload Form Builder","CRITICAL",10,"2026-10-06",0],["CVE-2026-105856","payloadcms","payload","Payload: SQL injection in SQLite/Postgres","HIGH",8.6,"2026-10-06",0],["CVE-2026-105855","payloadcms","payload","Payload: Field-level password update restrictions were not enforced","HIGH",7.6,"2026-10-06",0],["CVE-2026-105854","payloadcms","payload","Payload: ReDoS in Multipart Content-Type Validation","HIGH",8.7,"2026-10-06",0],["CVE-2026-105853","payloadcms","payload","Payload: Token refresh and password reset responses may expose restricted user fields","HIGH",7.1,"2026-10-06",0],["CVE-2026-104070","SPIP","SPIP Crayons Plugin","SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-105852","payloadcms","payload","Payload relationship-query authorization bypass","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105851","payloadcms","payload","Payload: Field access control bypass on auth collections","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-105850","payloadcms","payload","Payload: Order confirmation validation issue in Payload Ecommerce","HIGH",8.8,"2026-10-06",0],["CVE-2026-105849","payloadcms","payload","Payload: API key disclosure through ordinary document reads","HIGH",7.7,"2026-10-06",0],["CVE-2026-104850","modelcontextprotocol","typescript-sdk","MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen ","HIGH",7.5,"2026-10-06",0],["CVE-2026-105848","payloadcms","payload","Payload: Insufficient Access Control in Stripe REST Proxy","MEDIUM",6.4,"2026-10-06",0],["CVE-2026-105847","payloadcms","payload","Payload: Polymorphic join queries could disclose hidden fields","HIGH",7.1,"2026-10-06",0],["CVE-2026-105846","payloadcms","payload","Payload: Untrusted redirect URL parameter exploit","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-105957","SourceCodester","Performance Indicator System","SourceCodester Performance Indicator System view_product.php sql injection","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105845","payloadcms","payload","Payload: SQL Injection in SQLite and Postgres","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-105844","payloadcms","payload","Payload: Prototype pollution in Payload Import Export plugin","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-105806","payloadcms","payload","Payload: Improper access control for MCP API keys","HIGH",8.6,"2026-10-06",0],["CVE-2026-26287","external-secrets","external-secrets","External Secrets Operator: label enforcement bypass in webhook generator enables secret ex","HIGH",7.1,"2026-10-06",0],["CVE-2026-105950","getformwork","formwork","getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-63690","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authenticat","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-63691","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorizati","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-105805","payloadcms","payload","Payload: Sort queries could expose protected field information","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105804","payloadcms","payload","Payload: Password hashes use insufficient PBKDF2 iterations","MEDIUM",5.7,"2026-10-06",0],["CVE-2026-63689","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensi","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-70411","Dell","Container Storage Modules (CSM)","Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authent","HIGH",7.1,"2026-10-06",0],["CVE-2026-61411","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensi","HIGH",7.7,"2026-10-06",0],["CVE-2026-76105","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficient","HIGH",7.7,"2026-10-06",0],["CVE-2026-67270","Dell","Container Storage Modules (CSM)","Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certif","HIGH",8.2,"2026-10-06",0],["CVE-2026-67273","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutraliz","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-61421","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded ","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-104069","danielbrendel","hortusfox-web","HortusFox < 6.2 Remote Code Execution via Theme Import","HIGH",8.6,"2026-10-06",0],["CVE-2026-105801","openapi-generators","openapi-python-client","openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation","HIGH",8.4,"2026-10-06",0],["CVE-2026-54472","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded ","CRITICAL",9.8,"2026-10-06",0],["CVE-2025-8352","ESET spol. s.r.o","ESET PROTECT On-Prem","Denial-of-service vulnerability in ESET PROTECT On-Prem","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105800","i18next","i18next-http-backend","i18next-http-backend incomplete URL validation permits SSRF","LOW",3.7,"2026-10-06",0],["CVE-2026-67269","Dell","Container Storage Modules (CSM)","Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improp","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-105799","langchain-ai","langchainjs","LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values","LOW",2.3,"2026-10-06",0],["CVE-2026-105922","vllm-project","vLLM","vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-63692","Dell","Container Storage Modules","Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authenticat","CRITICAL",10,"2026-10-06",0],["CVE-2026-63688","Dell","Dell Container Storage Modules (CSM)","Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authen","CRITICAL",10,"2026-10-06",0],["CVE-2026-105798","microsoft","simplechat","SimpleChat: Stored XSS via group document filename in inline onclick handler","HIGH",8.7,"2026-10-06",0],["CVE-2026-105797","microsoft","simplechat","SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spaw","HIGH",8.8,"2026-10-06",0],["CVE-2026-105796","microsoft","kiota","Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP gene","HIGH",8.8,"2026-10-06",0],["CVE-2026-105795","microsoft","kiota","Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests","LOW",3.1,"2026-10-06",0],["CVE-2026-105921","Kusalkasilva","Learning-Management-System","Kusalkasilva Learning-Management-System search_class.php sql injection","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105794","microsoft","msquic","MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-105793","microsoft","UFO","Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-105792","microsoft","UFO","Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105791","microsoft","UFO","Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injecti","HIGH",7.5,"2026-10-06",0],["CVE-2026-105790","microsoft","UFO","Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinni","MEDIUM",6.4,"2026-10-06",0],["CVE-2026-105789","microsoft","UFO","Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-105788","microsoft","UFO","Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and l","HIGH",8.8,"2026-10-06",0],["CVE-2026-106040","kvcache-ai","Mooncake","Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC","HIGH",8.8,"2026-10-06",0],["CVE-2026-106041","kvcache-ai","Mooncake","Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-106039","kvcache-ai","Mooncake","Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-106038","kvcache-ai","Mooncake","Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs","HIGH",8.8,"2026-10-06",0],["CVE-2026-106037","kvcache-ai","Mooncake","Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-85523","Felisify Information Technologies Industry and Trade Inc.","SambaBox","OS Command Injection in Felisify Informatics' SambaBox","HIGH",8.8,"2026-10-06",0],["CVE-2026-34498","Johnson Controls","Illustra Standard - L4L China","L4L","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-91140","Progress Software","Autonomous REST Connector GenAI Agents","OS command injection in Progress Software Autonomous REST Connector GenAI Agents","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-87975","djangoproject","Django","Privilege abuse in model formsets with editable primary keys","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-106026","H. Peter Anvin","tftp-hpa","tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule","MEDIUM",6.3,"2026-10-06",0],["CVE-2026-105842","Uwe Ohse","lrzsz","lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-105840","Uwe Ohse","lrzsz","lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()","HIGH",7.7,"2026-10-06",0],["CVE-2026-105841","Uwe Ohse","lrzsz","lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode","HIGH",7.7,"2026-10-06",0],["CVE-2026-105839","sezero","libmikmod","libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD","HIGH",8.5,"2026-10-06",0],["CVE-2026-105838","sezero","libmikmod","libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-105837","sezero","libmikmod","libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow","HIGH",8.5,"2026-10-06",0],["CVE-2026-87890","djangoproject","Django","Potential request forgery via spatial lookup byte values","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-84429","djangoproject","Django","Potential denial-of-service vulnerability in HTTP header parsing","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-77050","djangoproject","Django","Potential denial-of-service vulnerability in get_supported_language_variant()","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-82924","Pusula Communication, IT, and Internet Industry and Trade Co. Ltd.","Expert Mail","PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105920","Kusalkasilva","Learning-Management-System","Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php s","MEDIUM",6.9,"2026-10-06",0],["CVE-2025-15591","OpenText","Content Management","Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-12380","Akıllı Ticaret Software Technologies Ltd. Co.","E-Commerce Pack","Reflected XSS in Akıllı Ticaret's E-Commerce Pack","MEDIUM",6.1,"2026-10-06",0],["CVE-2026-105919","Kusalkasilva","Learning-Management-System","Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105835","planka","planka","PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-105836","Webkul","QloApps","QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105834","rundeck","rundeck","Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source","HIGH",7.1,"2026-10-06",0],["CVE-2026-106016","Mozilla","Firefox","Mitigation bypass in the File Handling component","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-82531","smarty-php","smarty","Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache","CRITICAL",9.2,"2026-10-06",0],["CVE-2026-56596","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","LOW",3.5,"2026-10-06",0],["CVE-2026-105918","Kusalkasilva","Learning-Management-System","Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-75820","GNU","Aspell","Integer Truncation Leading to Heap Corruption in GNU Aspell","LOW",1.8,"2026-10-06",0],["CVE-2026-75819","GNU","Aspell","Out-of-bounds Read in GNU Aspell","LOW",1.8,"2026-10-06",0],["CVE-2026-75818","GNU","Aspell","Heap Buffer Overflow in GNU Aspell's prezip utility","LOW",1.8,"2026-10-06",0],["CVE-2026-103831","TrueLayer","TrueLayer Magento 2 Plugin","Insecure deserialization in the TrueLayer Magento 2 plugin","HIGH",7.5,"2026-10-06",0],["CVE-2026-105985","craftcms","cms","Authenticated RCE via render-components Entry Type overrides","HIGH",8.7,"2026-10-06",0],["CVE-2026-84854","wibu-systems-ag","wibukey","Out of Bound Write on WibuKey for Windows","HIGH",7,"2026-10-06",0],["CVE-2026-80327","Ping Identity","PingGateway","Open Redirect in PingGateway Fragment Filter","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-98372","Linux","Linux","xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()","","","2026-10-06",0],["CVE-2026-98371","Linux","Linux","xfrm: iptfs: fix runt reassembly panic from short inner tot_len","","","2026-10-06",0],["CVE-2026-98369","Linux","Linux","xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject(","HIGH",7.8,"2026-10-06",0],["CVE-2026-98370","Linux","Linux","xfrm: fix compat ALLOCSPI request use-after-free","","","2026-10-06",0],["CVE-2026-98368","Linux","Linux","esp: downgrade zerocopy managed frags before mutating skb frags","HIGH",7.8,"2026-10-06",0],["CVE-2026-98367","Linux","Linux","RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept","HIGH",7.8,"2026-10-06",0],["CVE-2026-98366","Linux","Linux","RDMA/rxe: validate access flags before swapping the MR's PD","HIGH",7.8,"2026-10-06",0],["CVE-2026-98364","Linux","Linux","xfrm: hold net_device reference under RCU in bundle creation","HIGH",7.8,"2026-10-06",0],["CVE-2026-98365","Linux","Linux","RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-98363","Linux","Linux","firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS","","","2026-10-06",0],["CVE-2026-98362","Linux","Linux","clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate","","","2026-10-06",0],["CVE-2026-98361","Linux","Linux","RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths","HIGH",7.8,"2026-10-06",0],["CVE-2026-98360","Linux","Linux","RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds","HIGH",7,"2026-10-06",0],["CVE-2026-98358","Linux","Linux","IB/iser: reject a remote invalidation of an unregistered direction","","","2026-10-06",0],["CVE-2026-98359","Linux","Linux","RDMA/core: Reject unregistering netdevs in ib_get_eth_speed","HIGH",7,"2026-10-06",0],["CVE-2026-98357","Linux","Linux","IB/isert: wait for deferred control PDU completions before releasing the connection","HIGH",8.1,"2026-10-06",0],["CVE-2026-98356","Linux","Linux","RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup","","","2026-10-06",0],["CVE-2026-98355","Linux","Linux","RDMA/rtrs: guard against null kobj name","","","2026-10-06",0],["CVE-2026-98354","Linux","Linux","RDMA/mad: Fix receive buffer leak when PKey enforcement fails","","","2026-10-06",0],["CVE-2026-98352","Linux","Linux","RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted","","","2026-10-06",0],["CVE-2026-98353","Linux","Linux","RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","","","2026-10-06",0],["CVE-2026-98351","Linux","Linux","wifi: virt_wifi: free skb when disconnected","","","2026-10-06",0],["CVE-2026-98350","Linux","Linux","wifi: brcmfmac: cyw: pass PMKID to firmware if present","","","2026-10-06",0],["CVE-2026-98349","Linux","Linux","wifi: libipw: reject too-short beacon and probe responses","HIGH",7.1,"2026-10-06",0],["CVE-2026-98347","Linux","Linux","IB/IPoIB: Avoid restoring OPER_UP after multicast flush","","","2026-10-06",0],["CVE-2026-98348","Linux","Linux","wifi: libipw: reject too-short association responses","HIGH",7.1,"2026-10-06",0],["CVE-2026-98346","Linux","Linux","wifi: cfg80211: don't get the radio mask for netdev-less wdevs","","","2026-10-06",0],["CVE-2026-98345","Linux","Linux","wifi: cfg80211: check IP header size in cfg80211_classify8021d()","","","2026-10-06",0],["CVE-2026-98343","Linux","Linux","dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()","","","2026-10-06",0],["CVE-2026-98344","Linux","Linux","dmaengine: Fix device kref underflow in dma_chan_put()","","","2026-10-06",0],["CVE-2026-98342","Linux","Linux","dmaengine: wait for RCU readers before releasing dma_device","","","2026-10-06",0],["CVE-2026-98341","Linux","Linux","wifi: cfg80211: don't free driver-owned scan requests","HIGH",7.8,"2026-10-06",0],["CVE-2026-98340","Linux","Linux","wifi: cfg80211: only group hidden BSSes with beacon entries","","","2026-10-06",0],["CVE-2026-98338","Linux","Linux","wifi: cfg80211: ibss: ref BSS entry for joined event","","","2026-10-06",0],["CVE-2026-98339","Linux","Linux","wifi: cfg80211: don't filter by BSS type when removing stale entries","HIGH",8.8,"2026-10-06",0],["CVE-2026-98337","Linux","Linux","wifi: mac80211: don't start a ROC while scanning","","","2026-10-06",0],["CVE-2026-98336","Linux","Linux","wifi: mac80211: don't offload TC setup on AP_VLAN interfaces","","","2026-10-06",0],["CVE-2026-98335","Linux","Linux","wifi: mac80211: abort chanswitch when leaving a mesh","","","2026-10-06",0],["CVE-2026-98333","Linux","Linux","wifi: mac80211: reset the LED state when ifup fails","","","2026-10-06",0],["CVE-2026-98334","Linux","Linux","wifi: mac80211: reset state when starting AP fails","","","2026-10-06",0],["CVE-2026-98332","Linux","Linux","wifi: mac80211: only operate on TDLS peers in the TDLS code","","","2026-10-06",0],["CVE-2026-98331","Linux","Linux","wifi: mac80211: unlist vifs when their netdev is unregistered","HIGH",7,"2026-10-06",0],["CVE-2026-98330","Linux","Linux","wifi: cfg80211: get the wiphy out of a dying network namespace","HIGH",7,"2026-10-06",0],["CVE-2026-98328","Linux","Linux","wifi: mac80211: add HE 6 GHz capability in the scan elems len","","","2026-10-06",0],["CVE-2026-98329","Linux","Linux","wifi: mac80211: don't allow injecting frames wider than the chanctx","","","2026-10-06",0],["CVE-2026-98327","Linux","Linux","wifi: mac80211: mesh: reset the CSA state when leaving","","","2026-10-06",0],["CVE-2026-98326","Linux","Linux","wifi: mac80211: mesh: release the channel if start fails","","","2026-10-06",0],["CVE-2026-98325","Linux","Linux","wifi: mac80211: set up the TX info early to fix failure paths","","","2026-10-06",0],["CVE-2026-98323","Linux","Linux","RDMA/siw: Bound fragmented header copies by the remaining length","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-98324","Linux","Linux","dmaengine: pxa: fix double counting of the hw descriptors","HIGH",7.8,"2026-10-06",0],["CVE-2026-98322","Linux","Linux","netfilter: nft_nat: fully initialise new_addr in netmap setup","","","2026-10-06",0],["CVE-2026-98321","Linux","Linux","netfilter: nf_nat: unregister and release hooks on error","","","2026-10-06",0],["CVE-2026-98320","Linux","Linux","netfilter: flowtable: hold reference on ct until flow is released","HIGH",7.8,"2026-10-06",0],["CVE-2026-98318","Linux","Linux","smb: client: validate absolute native symlink targets before NT fixups","HIGH",7.8,"2026-10-06",0],["CVE-2026-98319","Linux","Linux","drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr","","","2026-10-06",0],["CVE-2026-98317","Linux","Linux","neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","","","2026-10-06",0],["CVE-2026-98316","Linux","Linux","ALSA: bcd2000: Fix race between rawmidi and disconnect","","","2026-10-06",0],["CVE-2026-98315","Linux","Linux","ntfs: protect runlist updates with the runlist lock","HIGH",7.8,"2026-10-06",0],["CVE-2026-98313","Linux","Linux","drm/msm/dp: skip PUSH_IDLE when the link was never enabled","","","2026-10-06",0],["CVE-2026-98314","Linux","Linux","ALSA: pcm: set timer->private_data before registering the PCM timer","","","2026-10-06",0],["CVE-2026-98312","Linux","Linux","ALSA: 6fire: fix OOB write from device-reported iso length","","","2026-10-06",0],["CVE-2026-98311","Linux","Linux","wifi: virt_wifi: don't transfer operstate before register","HIGH",7.8,"2026-10-06",0],["CVE-2026-98310","Linux","Linux","drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory","","","2026-10-06",0],["CVE-2026-98308","Linux","Linux","ALSA: hda: trace PCM open only after assigning a stream","","","2026-10-06",0],["CVE-2026-98309","Linux","Linux","drm/vc4: Use managed KMS polling to fix UAF on unbind","","","2026-10-06",0],["CVE-2026-98307","Linux","Linux","wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","","","2026-10-06",0],["CVE-2026-98306","Linux","Linux","seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation","","","2026-10-06",0],["CVE-2026-98305","Linux","Linux","net: dsa: mxl862xx: disable the stats poll on teardown","HIGH",7.8,"2026-10-06",0],["CVE-2026-98304","Linux","Linux","net: bcmgenet: restore the hardware filters on open","","","2026-10-06",0],["CVE-2026-98303","Linux","Linux","ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup","","","2026-10-06",0],["CVE-2026-98302","Linux","Linux","net: fddi: skfp: fix NULL deref when setting the MAC address while down","","","2026-10-06",0],["CVE-2026-98300","Linux","Linux","tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().","","","2026-10-06",0],["CVE-2026-98301","Linux","Linux","net: bridge: mst: move switchdev call outside rcu","","","2026-10-06",0],["CVE-2026-98299","Linux","Linux","tcp: do not let tcp_rmem be set below 4096","","","2026-10-06",0],["CVE-2026-98298","Linux","Linux","dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()","","","2026-10-06",0],["CVE-2026-98296","Linux","Linux","Bluetooth: btintel_pcie: validate TX skb length in send_sync","","","2026-10-06",0],["CVE-2026-98297","Linux","Linux","Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","","","2026-10-06",0],["CVE-2026-98295","Linux","Linux","Bluetooth: coredump: Quiesce dump work on unregister","","","2026-10-06",0],["CVE-2026-98294","Linux","Linux","Bluetooth: hci_qca: Do not write to the serial port after it is closed","","","2026-10-06",0],["CVE-2026-98293","Linux","Linux","Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()","","","2026-10-06",0],["CVE-2026-98291","Linux","Linux","Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit","","","2026-10-06",0],["CVE-2026-98292","Linux","Linux","Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","","","2026-10-06",0],["CVE-2026-98290","Linux","Linux","Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup","HIGH",7.5,"2026-10-06",0],["CVE-2026-98289","Linux","Linux","af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","","","2026-10-06",0],["CVE-2026-98288","Linux","Linux","net: stmmac: fix TSO header length truncation","","","2026-10-06",0],["CVE-2026-98286","Linux","Linux","drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","","","2026-10-06",0],["CVE-2026-98287","Linux","Linux","pppoatm: ensure a writable skb header and linear data","","","2026-10-06",0],["CVE-2026-98285","Linux","Linux","net: bridge: vlan: fix bugs caused by switchdev deletion errors","","","2026-10-06",0],["CVE-2026-98284","Linux","Linux","netlink: do not free nlk->groups while lockless readers can use it","","","2026-10-06",0],["CVE-2026-98283","Linux","Linux","KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()","HIGH",8.8,"2026-10-06",0],["CVE-2026-98282","Linux","Linux","powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba","HIGH",8.8,"2026-10-06",0],["CVE-2026-98281","Linux","Linux","futex: Also allocate private hash on vfork()","HIGH",7.8,"2026-10-06",0],["CVE-2026-98279","Linux","Linux","btrfs: handle lack of space when cleaning up verity items","","","2026-10-06",0],["CVE-2026-98280","Linux","Linux","drm/xe/i2c: Disable IRQ on unbind","","","2026-10-06",0],["CVE-2026-98278","Linux","Linux","net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check","","","2026-10-06",0],["CVE-2026-98277","Linux","Linux","eth: fbnic: ring the doorbell if a burst ends in a drop","","","2026-10-06",0],["CVE-2026-98275","Linux","Linux","net: ethernet: cortina: Ack RX overrun interrupt correctly","","","2026-10-06",0],["CVE-2026-98276","Linux","Linux","net: lock the socket in sock_gettstamp()","HIGH",7.8,"2026-10-06",0],["CVE-2026-98274","Linux","Linux","net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()","","","2026-10-06",0],["CVE-2026-98273","Linux","Linux","x86/kprobes: Fix crash when probing CS CALL instructions","","","2026-10-06",0],["CVE-2026-98271","Linux","Linux","net: skbuff: do not leave stale header offsets after pskb_carve()","","","2026-10-06",0],["CVE-2026-98272","Linux","Linux","net: mvpp2: prevent buffer overflow in page_pool allocation","","","2026-10-06",0],["CVE-2026-98270","Linux","Linux","drm/amdgpu: check ras and obj before dereference","","","2026-10-06",0],["CVE-2026-98269","Linux","Linux","btrfs: abort transaction on failure to update inode for hole punching and reflinking","","","2026-10-06",0],["CVE-2026-98267","Linux","Linux","9p: Fix v9fs_issue_write() to update i_size and remote_i_size","","","2026-10-06",0],["CVE-2026-98268","Linux","Linux","perf: Fix null pointer access in is_include_guest_event()","","","2026-10-06",0],["CVE-2026-98266","Linux","Linux","ALSA: core: Fix potential UAF after asynchronous card release","","","2026-10-06",0],["CVE-2026-98265","Linux","Linux","ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity","","","2026-10-06",0],["CVE-2026-98264","Linux","Linux","ALSA: virtio: reset device before deleting virtqueues","","","2026-10-06",0],["CVE-2026-98262","Linux","Linux","ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY","","","2026-10-06",0],["CVE-2026-98263","Linux","Linux","ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type","","","2026-10-06",0],["CVE-2026-98261","Linux","Linux","cifs: Fix server use-after-free in cifs_chan_skip_or_disable()","HIGH",8.1,"2026-10-06",0],["CVE-2026-98259","Linux","Linux","fs/dax: check zero or empty entry before converting xarray entry","","","2026-10-06",0],["CVE-2026-98260","Linux","Linux","exec: Cleanup POSIX timers right after de_thread()","HIGH",7.8,"2026-10-06",0],["CVE-2026-98258","Linux","Linux","posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list","HIGH",7.8,"2026-10-06",0],["CVE-2026-98256","Linux","Linux","signal: Prevent exec() race","HIGH",7.8,"2026-10-06",0],["CVE-2026-98257","Linux","Linux","rds: ib: use rds_conn_drop() on protocol version mismatch","HIGH",7.5,"2026-10-06",0],["CVE-2026-98255","Linux","Linux","tcp: exclude old ACKs from tcp fast path","","","2026-10-06",0],["CVE-2026-98253","Linux","Linux","RDMA/ucma: Serialize join and leave on copy_to_user failure","HIGH",7.8,"2026-10-06",0],["CVE-2026-98254","Linux","Linux","swiotlb: use the adjusted address for the highmem page lookup","HIGH",7.8,"2026-10-06",0],["CVE-2026-98252","Linux","Linux","RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()","HIGH",7,"2026-10-06",0],["CVE-2026-98250","Linux","Linux","nfsd: fix handling of NFSEXP_PNFS in the netlink codepath","","","2026-10-06",0],["CVE-2026-98251","Linux","Linux","openvswitch: avoid reallocating confirmed conntrack labels","HIGH",7.8,"2026-10-06",0],["CVE-2026-98249","Linux","Linux","arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc","","","2026-10-06",0],["CVE-2026-98247","Linux","Linux","Bluetooth: hci_codec: validate vendor codec count length","","","2026-10-06",0],["CVE-2026-98248","Linux","Linux","arm64: percpu: Fix LSE operations on {8,16}-bit types","","","2026-10-06",0],["CVE-2026-98246","Linux","Linux","Bluetooth: hci_sync: Serialize local codec list cleanup","","","2026-10-06",0],["CVE-2026-98244","Linux","Linux","btrfs: clear free space tree creation state on rebuild failure","","","2026-10-06",0],["CVE-2026-98245","Linux","Linux","btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()","","","2026-10-06",0],["CVE-2026-98243","Linux","Linux","dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3","HIGH",7.1,"2026-10-06",0],["CVE-2026-98242","Linux","Linux","dma-buf: Fix silent overflow for phys vec to sgt","","","2026-10-06",0],["CVE-2026-98240","Linux","Linux","net: ip_tunnel: initialize `options_len` before referencing options","","","2026-10-06",0],["CVE-2026-98241","Linux","Linux","ipv6: xfrm: use full sockets in local error paths","HIGH",7.8,"2026-10-06",0],["CVE-2026-98239","Linux","Linux","net: lan743x: fix RX checksum use-after-free","HIGH",8.1,"2026-10-06",0],["CVE-2026-98237","Linux","Linux","net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain","","","2026-10-06",0],["CVE-2026-98238","Linux","Linux","net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()","","","2026-10-06",0],["CVE-2026-98236","Linux","Linux","net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value","","","2026-10-06",0],["CVE-2026-98234","Linux","Linux","net/sched: hhf: cap hh_flows_limit at change time","","","2026-10-06",0],["CVE-2026-98235","Linux","Linux","net/sched: act_api: release tail references on DELACTION failure","","","2026-10-06",0],["CVE-2026-98233","Linux","Linux","net/packet: clear RX owner on VNET header error","","","2026-10-06",0],["CVE-2026-98231","Linux","Linux","xfrm: serialize state GC with device state flush","","","2026-10-06",0],["CVE-2026-98232","Linux","Linux","scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()","","","2026-10-06",0],["CVE-2026-98230","Linux","Linux","xfrm: use hlist_del_init_rcu for state_cache and state_cache_input","HIGH",7,"2026-10-06",0],["CVE-2026-98228","Linux","Linux","mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","HIGH",7.8,"2026-10-06",0],["CVE-2026-98229","Linux","Linux","xfrm: save input state data before secpath resets","HIGH",7.8,"2026-10-06",0],["CVE-2026-98227","Linux","Linux","memstick: ms_block: destroy io_queue workqueue on removal","","","2026-10-06",0],["CVE-2026-98226","Linux","Linux","mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count","","","2026-10-06",0],["CVE-2026-98225","Linux","Linux","mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem","","","2026-10-06",0],["CVE-2026-98224","Linux","Linux","mm/vma: correctly unaccount on mmap_prepare() failure","","","2026-10-06",0],["CVE-2026-98223","Linux","Linux","mm: filemap: retain mapped dropbehind folios","","","2026-10-06",0],["CVE-2026-98222","Linux","Linux","KEYS: encrypted: fix integer overflow of datablob_len","","","2026-10-06",0],["CVE-2026-98221","Linux","Linux","KEYS: trusted: Fix tpm2_load_cmd() boundary check","","","2026-10-06",0],["CVE-2026-98220","Linux","Linux","sched_ext: Fix NULL sched deref in kfunc sub-sched error paths","","","2026-10-06",0],["CVE-2026-98218","Linux","Linux","i2c: atr: fix dangling adapter pointer on add failure","","","2026-10-06",0],["CVE-2026-98219","Linux","Linux","sched_ext: Close the pre-enable ops error claim window","","","2026-10-06",0],["CVE-2026-98217","Linux","Linux","IB/mlx4: Fix use-after-free on pkey sysfs registration failure","","","2026-10-06",0],["CVE-2026-98216","Linux","Linux","IB/hfi1: Fix the PIO_CRED credit-return mmap","HIGH",7.1,"2026-10-06",0],["CVE-2026-98215","Linux","Linux","selinux: preserve user SID across nested backing files","","","2026-10-06",0],["CVE-2026-98214","Linux","Linux","selinux: recheck intermediate backing files on mprotect()","","","2026-10-06",0],["CVE-2026-98213","Linux","Linux","mmc: core: Cancel SDIO IRQ work before freeing host","","","2026-10-06",0],["CVE-2026-98212","Linux","Linux","mmc: hsq: Fix use-after-free in retry work","","","2026-10-06",0],["CVE-2026-98211","Linux","Linux","mmc: mmci: Fix use-after-free in busy-timeout work","","","2026-10-06",0],["CVE-2026-98210","Linux","Linux","mmc: mxcmmc: cancel data work and watchdog on remove","","","2026-10-06",0],["CVE-2026-98208","Linux","Linux","mmc: sdio_uart: fix xmit_fifo leak when the port table is full","","","2026-10-06",0],["CVE-2026-98209","Linux","Linux","mmc: sdhci-of-aspeed: Remove children before releasing SDC resources","","","2026-10-06",0],["CVE-2026-98207","Linux","Linux","mmc: spi: reset bytes_xfered before retrying CRC failures","","","2026-10-06",0],["CVE-2026-98206","Linux","Linux","Input: cyttsp5 - clamp the HID report size before memcpy","","","2026-10-06",0],["CVE-2026-98205","Linux","Linux","Input: evdev - zero absinfo before partial copy in EVIOCSABS","","","2026-10-06",0],["CVE-2026-98204","Linux","Linux","Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()","","","2026-10-06",0],["CVE-2026-98202","Linux","Linux","Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound","","","2026-10-06",0],["CVE-2026-98203","Linux","Linux","Input: soc_button_array - check btns_desc->package.count","","","2026-10-06",0],["CVE-2026-98200","Linux","Linux","hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()","","","2026-10-06",0],["CVE-2026-98201","Linux","Linux","Input: zero ff_effect before compat copy in input_ff_effect_from_user","","","2026-10-06",0],["CVE-2026-98199","Linux","Linux","hwmon: (pmbus/core) increase number of phases and add new mask","","","2026-10-06",0],["CVE-2026-98197","Linux","Linux","hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove","HIGH",7,"2026-10-06",0],["CVE-2026-98198","Linux","Linux","hwmon: (pwm-fan) Stop RPM timer before freeing tach data","","","2026-10-06",0],["CVE-2026-98196","Linux","Linux","wifi: brcmsmac: fix UAF in brcms_free_timer()","","","2026-10-06",0],["CVE-2026-98194","Linux","Linux","wifi: libertas_tf: fix UAF in lbtf_free_adapter()","","","2026-10-06",0],["CVE-2026-98195","Linux","Linux","wifi: iwlegacy: fix broadcast stations deallocation","","","2026-10-06",0],["CVE-2026-98193","Linux","Linux","wifi: libipw: reject TKIP frames without a full MIC","","","2026-10-06",0],["CVE-2026-98191","Linux","Linux","wifi: wlcore: release runtime PM ref on regdomain config failure","","","2026-10-06",0],["CVE-2026-98192","Linux","Linux","wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown","","","2026-10-06",0],["CVE-2026-98190","Linux","Linux","wifi: wilc1000: fix out-of-bounds read in P2P public action frames","","","2026-10-06",0],["CVE-2026-98188","Linux","Linux","wifi: p54: validate curve data length in the calibration curve converters","","","2026-10-06",0],["CVE-2026-98189","Linux","Linux","wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()","","","2026-10-06",0],["CVE-2026-98187","Linux","Linux","wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST","","","2026-10-06",0],["CVE-2026-98186","Linux","Linux","wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length","","","2026-10-06",0],["CVE-2026-98185","Linux","Linux","wifi: mwifiex: validate scan response extents","","","2026-10-06",0],["CVE-2026-98183","Linux","Linux","wifi: mac80211: avoid out-of-bounds read for empty PREQ elements","","","2026-10-06",0],["CVE-2026-98184","Linux","Linux","wifi: mwifiex: prevent authentication frame length truncation","","","2026-10-06",0],["CVE-2026-98182","Linux","Linux","wifi: mac80211: refuse to make a monitor active when it has no queue","","","2026-10-06",0],["CVE-2026-98181","Linux","Linux","drm/gud: fix out-of-bounds write in gud_plane_atomic_check()","","","2026-10-06",0],["CVE-2026-98180","Linux","Linux","drm/msm: RCU-free the scheduler-containing ring and VM objects","HIGH",7.1,"2026-10-06",0],["CVE-2026-98179","Linux","Linux","drm/amdgpu: fix rmmio iounmap skipped on device removal","","","2026-10-06",0],["CVE-2026-98178","Linux","Linux","drm/amdgpu: Skip KFD mapping clear before initialization","","","2026-10-06",0],["CVE-2026-98176","Linux","Linux","drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","","","2026-10-06",0],["CVE-2026-98177","Linux","Linux","drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","","","2026-10-06",0],["CVE-2026-98175","Linux","Linux","smb: client: cancel reconnect work in clean_demultiplex_info()","HIGH",7.5,"2026-10-06",0],["CVE-2026-98174","Linux","Linux","smb: client: fix rlist race and missing initialization","HIGH",7.5,"2026-10-06",0],["CVE-2026-98173","Linux","Linux","smb: client: fix use-after-free of iface in cifs_try_adding_channels()","HIGH",7.5,"2026-10-06",0],["CVE-2026-98172","Linux","Linux","smb: client: fix smbd_connection leak on cifs_get_tcp_session() error","","","2026-10-06",0],["CVE-2026-98170","Linux","Linux","smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()","","","2026-10-06",0],["CVE-2026-98171","Linux","Linux","smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs","HIGH",8.8,"2026-10-06",0],["CVE-2026-98169","Linux","Linux","smb: client: fix potential OOB read in smb3_enum_snapshots()","HIGH",7.1,"2026-10-06",0],["CVE-2026-98168","Linux","Linux","smb: client: fix reparse buffer bounds in cifs_query_reparse_point()","","","2026-10-06",0],["CVE-2026-98167","Linux","Linux","smb: client: fix server->total_read for compound encrypted PDUs","","","2026-10-06",0],["CVE-2026-98166","Linux","Linux","drm/ttm: fix swapped-out resources never leaving their bulk_move range","HIGH",7.8,"2026-10-06",0],["CVE-2026-104399","StylemixThemes","Motors","WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-94206","danielberkompas","cloak_ecto","Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds","MEDIUM",6.3,"2026-10-06",0],["CVE-2026-95105","danielberkompas","cloak","Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by","HIGH",8.2,"2026-10-06",0],["CVE-2026-105317","Cozmoslabs","Paid Member Subscriptions","WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-105071","Royal Plugins","SiteVault – Backup, Restore, Migration &amp; Cloning","WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Da","HIGH",7.5,"2026-10-06",0],["CVE-2026-105061","Bởi brandtoss","WP Mailster","WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-105070","Dimitri Grassi","Salon booking system","WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-06",0],["CVE-2026-105059","royalnavneet","Delete All Comments of wordpress","WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerabi","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105057","Ben Marshall","Zero Spam","WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105058","John James Jacoby","WP User Profiles","WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-06",0],["CVE-2026-104814","epiphyt","Form Block","WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-104757","Javier Carazo","Import and export users and customers","WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vul","HIGH",7.2,"2026-10-06",0],["CVE-2026-104672","Nexcess","GiveWP","WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-104747","Edge-Themes","Haaken","WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability","HIGH",8.1,"2026-10-06",0],["CVE-2026-104670","ThimPress","LearnPress","WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-104405","Nexcess","GiveWP","WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability","HIGH",8.1,"2026-10-06",0],["CVE-2026-104406","picu","picu","WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability","HIGH",7.3,"2026-10-06",0],["CVE-2026-104395","picu","picu","WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-104387","blubrry","PowerPress Podcasting","WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability","HIGH",7.2,"2026-10-06",0],["CVE-2026-104394","Syed Balkhi","Charitable","WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-104385","Adrian Tobey","Groundhogg","WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-102387","XServer","Xserver Migrator","WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-102915","Marco van Wieren","WPO365","WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-100518","WebFactory","Advanced Google reCAPTCHA","WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-95594","Cozy Vision Technologies Pvt. Ltd.","SMS Alert Order Notifications","WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerabili","HIGH",8.1,"2026-10-06",0],["CVE-2026-97308","WebFactory","Login Lockdown","WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability","MEDIUM",4.8,"2026-10-06",0],["CVE-2026-95526","RealMag777","BEAR","WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability","HIGH",7.3,"2026-10-06",0],["CVE-2026-94675","Fluent Forms Free vs Pro","Fluent Forms Pro Add On Pack","WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulne","HIGH",7.1,"2026-10-06",0],["CVE-2026-62072","Progress Planner","Progress Planner","WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability","HIGH",8.8,"2026-10-06",0],["CVE-2026-48199","Beplusthemes","Sermon'e","WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-48197","PublishPress","PublishPress Capabilities","WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability","HIGH",7.2,"2026-10-06",0],["CVE-2026-42637","Payplug","PayPlug for WooCommerce (Official)","WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerabili","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-42638","Awesomemotive","Easy Digital Downloads","WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-42636","WP Legal Pages","WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site ","HIGH",7.1,"2026-10-06",0],["CVE-2026-42635","wpgenie","WooCommerce Simple Auctions","WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulner","HIGH",7.1,"2026-10-06",0],["CVE-2026-42418","Socialrocket","Social Rocket","WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-42634","bPlugins","Video Background Block – Use video as background in the section.","WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3","HIGH",7.1,"2026-10-06",0],["CVE-2026-42417","reputeinfosystems","ARMember Premium","WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-42415","p-themes","Porto Theme - Functionality","WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-42416","AndonDesign","UDesign Core","WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-42414","CridioStudio","ListingPro","WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-42413","DaftPlug","Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate","WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive ","HIGH",7.5,"2026-10-06",0],["CVE-2026-41562","norvisgabriel","Norvis Backup","WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-41560","wxdlabs","WXD Backup Lite","WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-41561","Adrian Lin","Museder RestoreOne","WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-41559","Pluginjoy","SafeSnap – Verified WordPress Backup &amp; Restore","WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data ","HIGH",7.5,"2026-10-06",0],["CVE-2026-40807","Aman","CF7 Views &#8211; Complete Entry Management for Contact Form 7","WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross","HIGH",7.1,"2026-10-06",0],["CVE-2026-41555","Weblizar – WordPress Themes & Plugin","Newsletter Subscription Form – User Subscriptions Form, Capture Email","WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= ","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-40806","Plugin Devs","Blog, Posts and Category Filter for Elementor","WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scrip","HIGH",7.1,"2026-10-06",0],["CVE-2026-39798","ThemetechMount","TrueBooker","WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39796","Flipper Code – WordPress Development Company","Advanced Posts Listing – Show Post List Easily","WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access C","HIGH",7.5,"2026-10-06",0],["CVE-2026-39797","Data443 Risk Mitigation, Inc.","GDPR Framework By Data443","WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-39795","brewlabs","SendPress Newsletters","WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-39794","WC Lovers","WooCommerce Multivendor Marketplace – REST API","WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access C","HIGH",7.5,"2026-10-06",0],["CVE-2026-39792","Mitchell Bennis","Simple File List","WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability","HIGH",8.6,"2026-10-06",0],["CVE-2026-39793","Nicu Micle","Simple JWT Login","WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability","HIGH",8.8,"2026-10-06",0],["CVE-2026-39791","Mailjet","Mailjet Email Marketing","WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-39790","e4jvikwp","VikRentCar","WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39787","10Web","10Web Social Photo Feed","WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39788","Shamim Hasan","Front End PM","WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39785","Serhii Pasyuk","Gmedia Photo Gallery","WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-39781","Dan Rossiter","Document Gallery","WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39784","nicdark","Hotel Booking","WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39780","Youzify","Youzify","WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39778","themeansar","Ansar Import – One Click Starter Sites – for Elementor &amp; Themes","WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 ","HIGH",7.1,"2026-10-06",0],["CVE-2026-39776","wpshopmart","Tabs","WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability","HIGH",8,"2026-10-06",0],["CVE-2026-39774","Tourfic AI Studio","Tourfic Pro","WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-06",0],["CVE-2026-39775","DexignZone","JobZilla - Job Board WordPress Theme","WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnera","HIGH",8.8,"2026-10-06",0],["CVE-2026-39773","AmentoTech","Doctreat Core","WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability","CRITICAL",10,"2026-10-06",0],["CVE-2026-39771","MightyNetworks vs BuddyBoss","Buddyboss Platform","WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-39772","bestwebsoft","Captcha by BestWebSoft","WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-39770","AmentoTech","Doctreat","WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability","CRITICAL",10,"2026-10-06",0],["CVE-2026-39769","Iqonic Designs","Graphina – Charts and Graphs For Elementor","WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-39767","baseapp","WPBase Cache","WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39766","reputeinfosystems","ARForms","WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39765","WebAppick","Challan","WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability","HIGH",7.2,"2026-10-06",0],["CVE-2026-39762","Patterns In The Cloud","Autoship Cloud for WooCommerce Subscription Products","WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken A","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39764","RadiusTheme","Radius Booking — Booking Calendar for Appointments &amp; Services","WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 -","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-39761","eLightUp","Meta Box AIO","WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-39759","AmentoTech","Workreap Core","WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-39757","AmentoTech","Taskbot","WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-39758","Midtrans","Midtrans-WooCommerce","WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39756","Wappointment team","Wappointment","WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerab","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39755","revmakx","WP Duplicate","WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-39753","AmentoTech","Taskbot","WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-39754","About Piotnet","Piotnet Addons For Elementor","WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerab","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39752","BlueGlass Interactive AG","Jobs for WordPress","WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability","HIGH",7.7,"2026-10-06",0],["CVE-2026-39750","weDevs","StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkou","HIGH",7.1,"2026-10-06",0],["CVE-2026-39751","Payplug","PayPlug for WooCommerce (Official)","WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulne","HIGH",7.5,"2026-10-06",0],["CVE-2026-39749","digitalpoint","App for Cloudflare®","WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39748","ThemeMove","EduMall","WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39746","fs-code","Booknetic","WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-39747","WofficeIO","Woffice","WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-39745","bestweblayout","Contact Form to DB by BestWebSoft","WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) v","HIGH",7.1,"2026-10-06",0],["CVE-2026-39730","Marcin","Wise Chat","WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39731","code4life","Database for CF7","WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39729","WisdmLabs","Edwiser Bridge","WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability","HIGH",7.2,"2026-10-06",0],["CVE-2026-39728","instapagedev","Instapage Plugin","WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerabil","HIGH",7.2,"2026-10-06",0],["CVE-2026-39726","Lumise NEO","Lumise Product Designer","WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabili","HIGH",7.1,"2026-10-06",0],["CVE-2026-39727","Saravana Kumar K","WC Fields Factory","WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-39724","veppa","HTTP Requests Manager","WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerabilit","HIGH",7.1,"2026-10-06",0],["CVE-2026-39720","mapster","Mapster WP Maps","WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39722","VibeThemes","WPLMS","WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39719","DeKnows","PDF Smart Viewer for Elementor","WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SS","HIGH",7.2,"2026-10-06",0],["CVE-2026-32581","mooberrydreams","Mooberry Book Manager","WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32579","kognetiks","Kognetiks Chatbot for WordPress","WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerab","CRITICAL",10,"2026-10-06",0],["CVE-2026-32580","wpgenie","WooCommerce Lottery","WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-32578","techsupport","ECPay Ecommerce for WooCommerce","WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vu","HIGH",7.1,"2026-10-06",0],["CVE-2026-32577","N-Media","Frontend File Manager","WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32574","EDGARROJAS","Smart Forms","WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32575","Fantastic Plugins","SUMO Affiliates Pro","WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32572","weDevs","WP User Frontend Pro","WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32571","Colabrio","Ohio Extra","WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-32570","DaftPlug","Progressify - Progressive Web App (PWA)","WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (","HIGH",7.1,"2026-10-06",0],["CVE-2026-32568","JMAPlugins","WooCommerce Designer Pro","WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerab","CRITICAL",9.9,"2026-10-06",0],["CVE-2026-32569","Joomunited","WP Media folder","WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-32557","Bot Verification bookingwp.com: Verifying that you are not a robot...","WooCommerce Appointments","WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-25433","Tobias @Saleswonder.biz","WP2LEADS","WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-25434","Tobias @Saleswonder.biz","WP2LEADS","WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability","HIGH",8.5,"2026-10-06",0],["CVE-2026-4889","RDL Technologies","eLoanApp Platform","SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies","HIGH",7.8,"2026-10-06",0],["CVE-2026-105809","SourceCodester","Simple Student Information System","SourceCodester Simple Student Information System Profile Field register.php cross site scr","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105879","Crocoblock","JetElements For Elementor","WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105808","SourceCodester","Simple Student Information System","SourceCodester Simple Student Information System searchresults.php clean cross site script","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-103346","Tomlister","Payflex Payment Gateway","WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabili","HIGH",7.1,"2026-10-06",0],["CVE-2026-105305","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: device authorization grant bypasses per-client minim","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-105807","SourceCodester","Simple Student Information System","SourceCodester Simple Student Information System searchquery.php sql injection","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-85153","Schmooze","Schmooze dating mobile Application","Information Disclosure Vulnerability in Schmooze dating mobile Application","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-59357","Cloud Foundry","UAA","Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-59358","Cloud Foundry","UAA","UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentia","HIGH",7.6,"2026-10-06",0],["CVE-2026-105778","Tenda","AC5","Tenda AC5 Wifi setWifi stack-based overflow","CRITICAL",9.4,"2026-10-06",0],["CVE-2026-105701","Mauro Cassani","ACPT (Premium)","ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API ","HIGH",8.8,"2026-10-06",0],["CVE-2026-94293","Murrelektronik","Software AAS Edge Client all versions","Missing authentication for critical function in the aas-edge-client REST API","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-57559","Qualcomm, Inc.","Snapdragon","Use After Free in DSP_Services","HIGH",7.8,"2026-10-06",0],["CVE-2026-57555","Qualcomm, Inc.","Snapdragon","Use After Free in DSP Service","HIGH",7.8,"2026-10-06",0],["CVE-2026-57554","Qualcomm, Inc.","Snapdragon","Use After Free in DSP Service","HIGH",7.8,"2026-10-06",0],["CVE-2026-57546","Qualcomm, Inc.","Snapdragon","Buffer Over-read in WLAN HAL","HIGH",7.5,"2026-10-06",0],["CVE-2026-57545","Qualcomm, Inc.","Snapdragon","Untrusted Pointer Dereference in Graphics","HIGH",7.8,"2026-10-06",0],["CVE-2026-57537","Qualcomm, Inc.","Snapdragon","Use After Free in DSP Service","HIGH",7.8,"2026-10-06",0],["CVE-2026-25302","Qualcomm, Inc.","Snapdragon","Improper Verification of Cryptographic Signature in Boot","HIGH",7.1,"2026-10-06",0],["CVE-2026-25291","Qualcomm, Inc.","Snapdragon","Use After Free in Graphics","HIGH",7.8,"2026-10-06",0],["CVE-2026-25274","Qualcomm, Inc.","Snapdragon","Use After Free in Windows WLAN Host","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-25273","Qualcomm, Inc.","Snapdragon","Out-of-bounds Write in Camera Driver","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-25272","Qualcomm, Inc.","Snapdragon","Out-of-bounds Write in Camera Driver","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-25270","Qualcomm, Inc.","Snapdragon","Out-of-bounds Write in Camera Driver","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-25269","Qualcomm, Inc.","Snapdragon","Out-of-bounds Write in Camera Driver","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-25267","Qualcomm, Inc.","Snapdragon","Missing Authorization in Core","HIGH",7.8,"2026-10-06",0],["CVE-2026-25263","Qualcomm, Inc.","Snapdragon","Out of Bounds write in Linux Camera","MEDIUM",6.6,"2026-10-06",0],["CVE-2026-86786","","Slider Pro","Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_ima","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-89289","","Fast Courier","Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update R","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-94278","","File Media Renamer","File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-94270","","Deema Payment Gateway","Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-94271","","Deema Payment Gateway","Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverifi","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-94299","","elegro Crypto Payment","elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Cal","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105776","bhagya3929","Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL","bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.ph","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105775","vllm-project","vLLM","vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-75962","saadiqbal","Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email","HIGH",7.2,"2026-10-06",0],["CVE-2026-105708","","imgproxy","imgproxy SVG svg.go sanitizeElement cross site scripting","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-41563","Dawer Drew","Sitemovr","WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-97300","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-41558","WP Synchro","WP Migration Plugin DB & Files – WP Synchro","WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulner","HIGH",7.5,"2026-10-06",0],["CVE-2026-39760","Creative interactive media","Real 3D FlipBook","WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-06",0],["CVE-2026-39789","WP Manage Ninja","Fluent Affiliate Pro","WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-39723","Green Invoice","Morning for WooCommerce","WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-39599","wallstrdev","WDS MCP Content Manager","WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-32582","iatoai","IATO MCP","WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-32576","ZWEISCHNEIDER","Faktur Pro for WooCommerce","WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105072","WP Manage Ninja","FluentBooking Pro","WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-06",0],["CVE-2026-105707","","uptrace","uptrace user_handler.go Login information exposure","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105706","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System cross-site request forgery","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105705","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System add_drug.php cross site scripting","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105704","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Auth Guard improper authentication","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105703","PHPGurukul","User Registration & Login and User Management System","PHPGurukul User Registration & Login and User Management System Change Password change-pas","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-105621","jishenghua","jshERP","jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDet","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105611","chillzhuang","SpringBlade","chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-105610","chillzhuang","SpringBlade","chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authoriz","MEDIUM",5.1,"2026-10-06",0],["CVE-2026-105573","newbee-ltd","newbee-mall","newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105572","","PickMall Lilishop","PickMall Lilishop Buyer Invoice List receipt authorization","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105571","","PickMall Lilishop","PickMall Lilishop Mobile Binding bindMobile improper authorization","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105487","yogeshojha","reNgine","yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105486","OSSRS","srs","OSSRS srs System API api.go systemAPI.Run missing authentication","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-104380","","Punk","Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET ro","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-104044","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via crafted passkey kerberos authentication request","MEDIUM",6.2,"2026-10-06",0],["CVE-2026-104043","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via undersized packet parsing in nss responder","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-104042","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via out-of-bounds read in pam responder","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-104041","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via unbounded negative cache growth","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-104040","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: information disclosure via odata injection in entra id lookups","MEDIUM",4.4,"2026-10-06",0],["CVE-2026-104039","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-105484","TOTOLINK","X6000R","TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection","CRITICAL",10,"2026-10-06",0],["CVE-2026-105472","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Booking book.php sql injection","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-104038","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via missing sid extension in certificate mapping","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-104037","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via packet length underflow in autofs responder","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-92821","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: access control bypass via premature ldap access rule evaluation","MEDIUM",6.8,"2026-10-06",0],["CVE-2026-104036","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin","MEDIUM",5.8,"2026-10-06",0],["CVE-2026-104035","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via memory exhaustion in kcm responder","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-104034","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via use-after-free in kcm ticket renewal","MEDIUM",4.7,"2026-10-06",0],["CVE-2026-104033","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: access control bypass via improper ldap shadow expiration check","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-104032","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via unprivileged autofs cache invalidation","MEDIUM",5.5,"2026-10-06",0],["CVE-2026-104031","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via memory exhaustion in autofs responder","MEDIUM",5.5,"2026-10-06",0],["CVE-2025-45871","","","LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the Work","HIGH",8.1,"2026-10-06",0],["CVE-2025-71383","","","Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (","CRITICAL",9.8,"2026-10-06",0],["CVE-2025-71384","","","Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to exec","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-77178","","","Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in","CRITICAL",9.1,"2026-10-06",0],["CVE-2026-95140","","","kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileContr","HIGH",7.5,"2026-10-06",0],["CVE-2026-95153","","","An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via","MEDIUM",4.9,"2026-10-06",0],["CVE-2026-105786","laurent22","joplin","Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation ","HIGH",8.5,"2026-10-06",0],["CVE-2026-105471","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-82988","Viewsonic","vCast","CVE-2026-82988","HIGH",7.5,"2026-10-06",0],["CVE-2026-82989","Viewsonic","vCast","CVE-2026-82989","CRITICAL",9.8,"2026-10-06",0],["CVE-2026-105785","laurent22","joplin","Joplin Server password reset accepts tokens issued for unrelated purposes","MEDIUM",4.8,"2026-10-06",0],["CVE-2026-105784","laurent22","joplin","Joplin whiteboard card rendering allows CSS injection into application chrome","MEDIUM",4.6,"2026-10-06",0],["CVE-2026-105783","laurent22","joplin","Joplin Web Clipper pairing allows cross-origin theft of a permanent API token","HIGH",8,"2026-10-06",0],["CVE-2026-105782","scrapy","scrapy","Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware","HIGH",7.5,"2026-10-06",0],["CVE-2026-105764","immich-app","immich","Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE","HIGH",7.7,"2026-10-06",0],["CVE-2026-105763","twentyhq","twenty","Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metada","CRITICAL",9.6,"2026-10-06",0],["CVE-2026-105762","langgenius","dify","Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endp","HIGH",8.3,"2026-10-06",0],["CVE-2026-105761","langgenius","dify","Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers","HIGH",7.1,"2026-10-06",0],["CVE-2026-105760","vllm-project","vllm","vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105759","vllm-project","vllm","vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens i","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-104852","ardatan","graphql-tools","GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`","HIGH",8.2,"2026-10-06",0],["CVE-2026-105758","vllm-project","vllm","vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105757","vllm-project","vllm","vLLM: Structured-output request errors escape the request boundary and terminate the share","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105756","vllm-project","vllm","vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP de","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105755","vllm-project","vllm","vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled req","MEDIUM",4.2,"2026-10-06",0],["CVE-2026-105754","vllm-project","vllm","vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105753","vllm-project","vllm","vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reu","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-105752","vllm-project","vllm","vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache","LOW",3.1,"2026-10-06",0],["CVE-2026-105470","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_q","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105469","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-93321","moby","BuildKit","Malformed LLB file operation can crash buildkitd","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-93315","moby","BuildKit","BuildKit proxy CA cleanup can be disrupted by build steps","MEDIUM",5.8,"2026-10-06",0],["CVE-2026-103433","Docker","Docker Buildx","Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitio","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-103546","MongoDB, Inc.","Mongodb Controllers for Kubernetes","Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator","LOW",2.3,"2026-10-06",0],["CVE-2026-105468","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105751","docling-project","docling","Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend","MEDIUM",6.9,"2026-10-06",0],["CVE-2026-105750","docling-project","docling","Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","MEDIUM",5.9,"2026-10-06",0],["CVE-2026-0461","AMD","Zynq™ UltraScale+ MPSoCs","Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraSca","HIGH",7.5,"2026-10-06",0],["CVE-2026-105749","docling-project","docling","Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CP","MEDIUM",6.5,"2026-10-06",0],["CVE-2026-0482","AMD","Alveo™ Accelerator Cards","In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when en","MEDIUM",5.4,"2026-10-06",0],["CVE-2026-105748","docling-project","docling","Docling: Crafted DoclingDocument JSON embeds local image files into converted output","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-105747","docling-project","docling","Docling: METS-GBS archive member limit enforced after full member enumeration (memory exha","MEDIUM",4.3,"2026-10-06",0],["CVE-2026-105746","docling-project","docling","Docling: KServe v2 OCR engine does not enforce enable_remote_services","LOW",2.2,"2026-10-06",0],["CVE-2026-21589","Atlassian","Bamboo Data Center","This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Man","CRITICAL",9.3,"2026-10-06",1],["CVE-2026-91107","OS4ED","openSIS-Classic","openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)","CRITICAL",9.3,"2026-10-06",0],["CVE-2026-105745","docling-project","docling","Docling: Plugin entry points are imported before the allow_external_plugins check","MEDIUM",6.7,"2026-10-06",0],["CVE-2026-105744","docling-project","docling","Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) wh","HIGH",7.5,"2026-10-06",0],["CVE-2026-105743","docling-project","docling","Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resol","MEDIUM",4,"2026-10-06",0],["CVE-2026-105742","docling-project","docling","Docling: Configured HTTP headers sent to every remote image host named by a document","LOW",3.7,"2026-10-06",0],["CVE-2026-105444","dotnet","eShop","dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection","MEDIUM",5.3,"2026-10-06",0],["CVE-2026-105741","langflow-ai","langflow","Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write","HIGH",7.1,"2026-10-05",0],["CVE-2026-105740","langflow-ai","langflow","Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary O","CRITICAL",9.9,"2026-10-05",0],["CVE-2026-105438","","O2OA","O2OA General url ActionUploadExcelWithUrl server-side request forgery","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105773","Canimaan Software","ClamXAV","Canimaan Software ClamXAV local privilege escalation","HIGH",7.3,"2026-10-05",0],["CVE-2026-105699","langflow-ai","langflow","Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers","HIGH",7.1,"2026-10-05",0],["CVE-2026-102262","Newell Brands","DYMO ID","Newell Brands DYMO ID parent directory open to path traversal through improper spheres of ","HIGH",7,"2026-10-05",0],["CVE-2026-101893","Newell Brands","DYMO ID","Newell Brands DYMO ID document parsing failing file type extension authentication check","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105447","Red Hat","Red Hat Quay 3","Quay: quay: global read-only superuser can access build trigger write credentials","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-84900","HP Inc","ThinPro 8.1","HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-77226","Camunda","Camunda 7","Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint","CRITICAL",9.2,"2026-10-05",0],["CVE-2026-105698","langflow-ai","langflow","Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_i","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105768","chainguard-dev","apko","apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root","MEDIUM",6.3,"2026-10-05",0],["CVE-2026-105697","langflow-ai","langflow","Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurati","CRITICAL",9.9,"2026-10-05",0],["CVE-2026-93326","moby","BuildKit","Crafted Git build source can bypass certain policy validation","MEDIUM",6,"2026-10-05",0],["CVE-2026-105696","penpot","penpot","Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105695","penpot","penpot","Penpot: Missing authorization in chunked-upload assembly lets another authenticated user c","MEDIUM",5.9,"2026-10-05",0],["CVE-2026-105694","penpot","penpot","Penpot: Stored XSS via Unsanitised SVG Uploads","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105693","penpot","penpot","Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-71297","Red Hat","Multicluster Engine for Kubernetes","Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105692","penpot","penpot","Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did ","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105691","penpot","penpot","Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color","CRITICAL",9.9,"2026-10-05",0],["CVE-2026-105690","penpot","penpot","Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains val","MEDIUM",5.9,"2026-10-05",0],["CVE-2026-105689","penpot","penpot","Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook del","MEDIUM",6,"2026-10-05",0],["CVE-2026-105688","penpot","penpot","Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on ","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-105687","penpot","penpot","Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — miss","MEDIUM",4.9,"2026-10-05",0],["CVE-2026-105767","Chainguard","Chainguard Academy (edu)","Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into","LOW",2.1,"2026-10-05",0],["CVE-2026-105686","penpot","penpot","Penpot: Repeated chunk index causes temporary-storage amplification","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105766","Chainguard","Chainguard Academy (edu)","Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP","LOW",2.3,"2026-10-05",0],["CVE-2026-105392","Lybbn","Django-Vue-Lyadmin","Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105684","penpot","penpot","Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity,","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-105683","TryGhost","Ghost","Ghost: Path Traversal Vulnerability in Ghost ImageSize Service","LOW",3.8,"2026-10-05",0],["CVE-2026-105389","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted ","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105682","TryGhost","Ghost","Ghost: Server-Side Request Forgery in Webhook Trigger","LOW",2.7,"2026-10-05",0],["CVE-2026-105681","TryGhost","Ghost","Ghost: Authorization Bypass in Comments Feature","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105680","TryGhost","Ghost","Ghost: Authorization Issue Allowed Author Role to Delete any Post","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105679","TryGhost","Ghost","Ghost: Stored XSS via File Uploads on Local Storage","HIGH",7.3,"2026-10-05",0],["CVE-2026-105678","TryGhost","Ghost","Ghost: Editors Could Promote Staff Users to Their Own Role","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-94201","ash-project","ash","Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash","HIGH",8.2,"2026-10-05",0],["CVE-2026-105677","TryGhost","Ghost","Ghost: Remote Code Execution via Theme Translation Files","HIGH",7.2,"2026-10-05",0],["CVE-2026-105676","TryGhost","Ghost","Ghost: Path Traversal via Locale Setting","MEDIUM",4.9,"2026-10-05",0],["CVE-2026-105388","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-104029","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via out-of-bounds read in autofs responder","LOW",3.3,"2026-10-05",0],["CVE-2026-105675","TryGhost","Ghost","Ghost: Invite Token Disclosure in Ghost Admin API","HIGH",7.5,"2026-10-05",0],["CVE-2026-105652","TryGhost","Ghost","Ghost: Password Hash Ordering Disclosure in Ghost Admin API","LOW",3.1,"2026-10-05",0],["CVE-2026-105651","TryGhost","Ghost","Ghost: Stored XSS via Bookmark Card Images","HIGH",7.3,"2026-10-05",0],["CVE-2026-105650","TryGhost","Ghost","Ghost: Stored XSS via oEmbed Photo Responses","HIGH",8.1,"2026-10-05",0],["CVE-2026-104030","Red Hat","Red Hat Enterprise Linux 10","Sssd: sssd: denial of service via out-of-bounds read during passkey parsing","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-71299","Red Hat","Multicluster Engine for Kubernetes","Maestro: maestro: rest api write endpoints registered without authentication middleware","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-71298","Red Hat","Multicluster Engine for Kubernetes","Maestro: sql identifier injection via properties.* search filter and orderby field","MEDIUM",6.4,"2026-10-05",0],["CVE-2026-105649","TryGhost","Ghost","Ghost: Stored XSS via SVG Uploads Bypassing Sanitization","HIGH",7.3,"2026-10-05",0],["CVE-2026-105648","TryGhost","Ghost","Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses","MEDIUM",4,"2026-10-05",0],["CVE-2026-105647","TryGhost","Ghost","Ghost: Server-Side Request Forgery in Bookmark Fetching","MEDIUM",4,"2026-10-05",0],["CVE-2026-100506","WP Spell Check","WP Spell Check","WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-05",0],["CVE-2026-100511","Vektor Inc.","VK Google Job Posting Manager","WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerabili","HIGH",8.8,"2026-10-05",0],["CVE-2026-103066","WP BASE","WP BASE Booking","WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","HIGH",8.5,"2026-10-05",0],["CVE-2026-97257","PressTigers","Simple Event Planner","WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-05",0],["CVE-2026-103337","Kirillbdev","WC Ukraine Shipping","WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103348","Smackcoders Inc.","WP Ultimate Exporter","WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-05",0],["CVE-2026-93617","WP Sunshine","Sunshine Photo Cart","WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability","HIGH",7.2,"2026-10-05",0],["CVE-2026-105326","Red Hat","Red Hat Hardened Images","Cups: cups: argument injection in mailto notifier via notify-recipient-uri","LOW",2.5,"2026-10-05",0],["CVE-2026-105646","TryGhost","Ghost","Ghost: Regular Expression Denial of Service in Content Import","MEDIUM",4.9,"2026-10-05",0],["CVE-2026-105645","TryGhost","Ghost","Ghost: Regular Expression Denial of Service in External Media Inliner","MEDIUM",4.9,"2026-10-05",0],["CVE-2026-105712","GnuPG","GnuPG","gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. Whe","LOW",3.6,"2026-10-05",0],["CVE-2026-105644","TryGhost","Ghost","Ghost: Stored XSS via SVG Files in Content Imports","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-105643","TryGhost","Ghost","Ghost: Stored XSS via Embed Card Previews","HIGH",7.3,"2026-10-05",0],["CVE-2026-105387","girishsaraf","Online-Appointment-Booking-System","girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql inj","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-28648","Google","Android","In Settings, there is a possible permission bypass due to a confused deputy. This could le","HIGH",7.8,"2026-10-05",0],["CVE-2026-28647","Google","Android","In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission","HIGH",7.8,"2026-10-05",0],["CVE-2026-28641","Google","Android","In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, ther","HIGH",7.8,"2026-10-05",0],["CVE-2026-28640","Google","Android","In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a","HIGH",7.8,"2026-10-05",0],["CVE-2026-28625","Google","Android","In multiple locations, there is a possible permission bypass due to a logic error in the c","HIGH",7.8,"2026-10-05",0],["CVE-2026-104714","Apache Software Foundation","Apache Struts","Apache Struts: Shared message formatter exposes date and time values across concurrent req","HIGH",8.8,"2026-10-05",0],["CVE-2026-104713","Apache Software Foundation","Apache Struts","Apache Struts: Unbounded request body read in the REST plugin","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104712","Apache Software Foundation","Apache Struts","Apache Struts: Disproportionate response size when rendering BigDecimal request parameters","HIGH",7.5,"2026-10-05",0],["CVE-2026-104711","Apache Software Foundation","Apache Struts","Apache Struts: OGNL injection in the legacy RESTful action mapper","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-105642","TryGhost","Ghost","Ghost: Remote Code Execution via Bookmark Card Images","HIGH",8.8,"2026-10-05",0],["CVE-2026-105386","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem print.php get sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-58880","Google","Android","In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code executio","HIGH",7,"2026-10-05",0],["CVE-2026-58865","Google","Android","In multiple functions of PduParser.java, there is a possible persistent denial of service ","HIGH",7.5,"2026-10-05",0],["CVE-2026-58859","Google","Android","In multiple places, there is a possible denial of service due to an uncaught exception. Th","HIGH",7.8,"2026-10-05",0],["CVE-2026-58856","Google","Android","In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible ou","LOW",3.3,"2026-10-05",0],["CVE-2026-58854","Google","Android","In multiple locations, there is a possible memory corruption due to type confusion. This c","HIGH",7.8,"2026-10-05",0],["CVE-2026-58841","Google","Android","In multiple functions of VirtualAudioControllerTest.java, there is a possible permission b","HIGH",7.8,"2026-10-05",0],["CVE-2026-58835","Google","Android","In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buff","HIGH",8.8,"2026-10-05",0],["CVE-2026-58834","Google","Android","In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persist","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-58815","Google","Android","In multiple locations, there is a possible out of bounds write due to an incorrect bounds ","HIGH",7.8,"2026-10-05",0],["CVE-2026-55286","Google","Android","In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an in","HIGH",7.8,"2026-10-05",0],["CVE-2026-55280","Google","Android","In multiple locations, there is a possible out-of-bounds write due to uninitialized data. ","HIGH",8.8,"2026-10-05",0],["CVE-2026-55270","Google","Android","In dialInternal in multiple locations, there is a possible permission bypass due to a conf","HIGH",7.8,"2026-10-05",0],["CVE-2026-55269","Google","Android","In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to","HIGH",7.8,"2026-10-05",0],["CVE-2026-55266","Google","Android","In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resou","HIGH",7.8,"2026-10-05",0],["CVE-2026-55265","Google","Android","In multiple functions of PduParser.java, there is a possible out of bounds read due to a m","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-49937","Google","Android","In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to","HIGH",7.8,"2026-10-05",0],["CVE-2026-49933","Google","Android","In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in t","HIGH",7.8,"2026-10-05",0],["CVE-2026-49885","Google","Android","In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an inte","HIGH",7.8,"2026-10-05",0],["CVE-2026-49880","Google","Android","In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to ","HIGH",7.8,"2026-10-05",0],["CVE-2026-49878","Google","Android","In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds","HIGH",7.2,"2026-10-05",0],["CVE-2026-45524","Google","Android","In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missi","HIGH",8.8,"2026-10-05",0],["CVE-2026-28667","Google","Android","In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missin","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-105641","makeplane","plane","Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deploy","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-105640","makeplane","plane","Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105639","makeplane","plane","Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation tok","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-105638","makeplane","plane","Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-103349","Rymera Web Co","Product Feed PRO for WooCommerce","WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnera","HIGH",7.2,"2026-10-05",0],["CVE-2026-97303","Apps Mav","Scratch & Win – Giveaways and Contests","WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control v","HIGH",7.6,"2026-10-05",0],["CVE-2026-103334","Etoile Web Design Incorporated","Five Star Restaurant Reservations","WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vul","HIGH",7.5,"2026-10-05",0],["CVE-2026-103352","WP BASE","WP BASE Booking","WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-05",0],["CVE-2026-97070","CozyThemes","Cozy Blocks","WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerab","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-97275","VillaTheme","BuildKit – Product Builder for WooCommerce – Custom PC Builder","WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 ","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-97283","Liquid Web / StellarWP","Advanced Post Manager","WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-97305","Themeisle","AI Chatbot for WordPress – Hyve Lite","WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object Re","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-97309","Webful Creations","RepairBuddy","WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability","HIGH",7.1,"2026-10-05",0],["CVE-2026-100509","Webful Creations","RepairBuddy","WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-100515","VillaTheme","Photo Reviews for WooCommerce","WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vuln","HIGH",7.1,"2026-10-05",0],["CVE-2026-102383","VillaTheme","Lookzy","WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103085","WP User Manager","WP User Manager","WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103086","Stiofan","UsersWP","WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-97304","Arraytics","Timetics","WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105637","makeplane","plane","Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-4","CRITICAL",9.6,"2026-10-05",0],["CVE-2026-105636","makeplane","plane","Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)","CRITICAL",9.9,"2026-10-05",0],["CVE-2026-105635","makeplane","plane","Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Jo","HIGH",7.4,"2026-10-05",0],["CVE-2026-105634","makeplane","plane","Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles","HIGH",8.1,"2026-10-05",0],["CVE-2026-105633","makeplane","plane","Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope","HIGH",7.1,"2026-10-05",0],["CVE-2026-105632","makeplane","plane","Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private ","HIGH",8.7,"2026-10-05",0],["CVE-2026-93323","moby","BuildKit","Oversized Dockerfile or .dockerignore can exhaust buildkitd memory","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-105631","makeplane","plane","Plane: asset download endpoints scope file lookups to the workspace (not the project / pub","HIGH",7.5,"2026-10-05",0],["CVE-2026-105630","makeplane","plane","Plane: Stored XSS via SVG attachment served inline on the application origin (account take","HIGH",8.7,"2026-10-05",0],["CVE-2026-93322","moby","BuildKit","Malformed MergeOp can crash the BuildKit daemon","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105629","makeplane","plane","Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Loo","HIGH",7.1,"2026-10-05",0],["CVE-2026-105628","makeplane","plane","Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset End","HIGH",7.6,"2026-10-05",0],["CVE-2026-93320","moby","BuildKit","BuildKit improperly handles special files in build snapshots","MEDIUM",6,"2026-10-05",0],["CVE-2026-104979","makeplane","plane","Plane: Cross-tenant stored XSS in intake enables account takeover","HIGH",8.7,"2026-10-05",0],["CVE-2026-104978","makeplane","plane","Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acc","HIGH",8.2,"2026-10-05",0],["CVE-2026-78413","Rapid7","Velociraptor","Velociraptor privilege escalation via SysmonLogForward client monitoring artifact","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-104977","makeplane","plane","Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (","HIGH",7.7,"2026-10-05",0],["CVE-2026-93319","moby","BuildKit","A malicious frontend can cause a daemon panic","MEDIUM",5.7,"2026-10-05",0],["CVE-2026-104976","makeplane","plane","Plane: SSRF in Gitea OAuth","HIGH",8.7,"2026-10-05",0],["CVE-2026-93318","moby","BuildKit","Cache poisoning via unvalidated image layer DiffIDs","HIGH",7.5,"2026-10-05",0],["CVE-2026-105385","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem transaction_details.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-104975","makeplane","plane","Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints","HIGH",7.1,"2026-10-05",0],["CVE-2026-93317","moby","BuildKit","Container blob cache can accept unverified content","MEDIUM",5.9,"2026-10-05",0],["CVE-2026-104974","makeplane","plane","Plane: Disabled User Auto-Reactivation on Login","HIGH",8.1,"2026-10-05",0],["CVE-2026-93316","moby","BuildKit","Starting daemon with --cdi-disabled flag can lead to panic on specific builds","HIGH",7.1,"2026-10-05",0],["CVE-2026-104973","makeplane","plane","Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery","HIGH",7.6,"2026-10-05",0],["CVE-2026-104905","NeoRazorX","facturascripts","FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect","MEDIUM",6.1,"2026-10-05",0],["CVE-2026-101919","Red Hat","Multicluster Engine for Kubernetes","Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to contro","HIGH",8.8,"2026-10-05",0],["CVE-2025-15643","Jose Fernandez","Adsmonetizer","WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-05",0],["CVE-2026-78411","Rapid7","Velociraptor","Velociraptor Server Metadata update with Insufficient Permission Check","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105384","UNION","HospitalManagementSystem","UNION HospitalManagementSystem patient_info.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-42700","GhozyLab","Image Slider Widget","WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104971","makeplane","plane","Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEn","HIGH",8.5,"2026-10-05",0],["CVE-2026-102576","Red Hat","Red Hat Quay 3","Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page","MEDIUM",4.2,"2026-10-05",0],["CVE-2026-102295","Red Hat","Red Hat Quay 3","Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105383","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem controller.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-102282","cthackers","adm-zip","adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalat","HIGH",7.1,"2026-10-05",0],["CVE-2026-104970","makeplane","plane","Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated calle","HIGH",8.1,"2026-10-05",0],["CVE-2026-104969","makeplane","plane","Plane: Cross-Tenant Cycle Issue Hijack via IDOR","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104968","makeplane","plane","Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/","HIGH",8.7,"2026-10-05",0],["CVE-2026-104967","makeplane","plane","Plane: Cross-workspace association destruction and issue mutation/read via unscoped querie","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-104966","makeplane","plane","Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inj","HIGH",8.7,"2026-10-05",0],["CVE-2026-104965","makeplane","plane","Plane: Cross-Tenant Issue Relation Creation via IDOR","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-104964","makeplane","plane","Plane: Cross-Workspace Project Modification via Unscoped Project Lookup","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-78412","Rapid7","Velociraptor","WatchEvent API streams another organization's live events","MEDIUM",4.9,"2026-10-05",0],["CVE-2026-104963","makeplane","plane","Plane: Workspace cycle and module endpoints missing project-membership filter expose priva","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-104962","makeplane","plane","Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing pro","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104961","makeplane","plane","Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-104960","makeplane","plane","Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret pro","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104956","makeplane","plane","Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public de","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105382","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem Account Administration controller.php update_suba","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-104955","makeplane","plane","Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk}","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-104894","makeplane","plane","Plane: Cross-Tenant Module Issue Linking via IDOR","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-104893","makeplane","plane","Plane: Improper validation allows arbitrary modification of API token rate limits","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-12171","cookpete","auto-changelog","auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/","HIGH",8.4,"2026-10-05",0],["CVE-2026-86671","Eclipse Foundation","Eclipse Che","In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factor","HIGH",8.4,"2026-10-05",0],["CVE-2026-102779","joomlafry.com","TF Content for Joomla","Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automatio","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-102777","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker","MEDIUM",6.3,"2026-10-05",0],["CVE-2026-102426","joomshaper.com","SP Page Builder (Pro) extension for Joomla","Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in S","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-102778","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share min","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-102780","joomlafry.com","TF Content for Joomla","Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assig","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-102776","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-102775","phoca.cz","Phoca Cart extension for Joomla","Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in O","HIGH",8.7,"2026-10-05",0],["CVE-2026-102428","ordasoft.com","OrdaSoft Joomla CCK","Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8","CRITICAL",9.3,"2026-10-05",0],["CVE-2026-104892","makeplane","plane","Plane: Plaintext logging of API token","HIGH",8.7,"2026-10-05",0],["CVE-2026-104891","douglasborthwick-crypto","mppx-condition-gate","mppx-condition-gate: Free-access path grants on a self-declared wallet without proving con","HIGH",7.5,"2026-10-05",0],["CVE-2026-104890","Kunstmaan","KunstmaanBundlesCMS","Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators ","HIGH",7.2,"2026-10-05",0],["CVE-2026-105329","","TallCMS","TallCMS PluginManager ThemeManager.php code injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105397","ThimPress","LearnPress","LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanat","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-89039","Grafana","mcp-k6","Arbitrary file read via the convert_playwright_script prompt in mcp-k6","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-79820","Hewlett Packard Enterprise (HPE)","HPE Integrated Lights-Out (iLO) 7","A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7","CRITICAL",9,"2026-10-05",0],["CVE-2026-105421","Kit","Kit (formerly ConvertKit) for WooCommerce","WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Contro","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-92931","Progress Software","@progress/sitefinity-nextjs-sdk","CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK","HIGH",8.8,"2026-10-05",0],["CVE-2026-105315","","django-haystack","django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injec","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-77805","Progress Software","Progress® Telerik® Fiddler® Classic","Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classi","HIGH",7.9,"2026-10-05",0],["CVE-2026-77804","Progress Software","Progress® Telerik® Fiddler® Classic","Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Prog","MEDIUM",6.6,"2026-10-05",0],["CVE-2026-77803","Progress Software","Progress® Telerik® Fiddler® Classic","Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic","LOW",3.6,"2026-10-05",0],["CVE-2026-77802","Progress Software","Progress® Telerik® Fiddler® Classic","HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic","MEDIUM",6.3,"2026-10-05",0],["CVE-2026-39783","WP SYNTEX","Polylang","WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-103684","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105073","Arraytics","WP Event Solution","WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-63270","The Document Foundation","LibreOffice","Environment/ini-file leaks","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-63269","The Document Foundation","LibreOffice","LFI and GET SSRF via GStreamer and HLS playlists","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-63267","The Document Foundation","LibreOffice","LFI and GET SSRF via calcext:data-mappings and csv provider","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-63268","The Document Foundation","LibreOffice","LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-63266","The Document Foundation","LibreOffice","Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functiona","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-63277","The Document Foundation","LibreOffice","RCE via calcext:data-mappings, sql provider and jdbc connector","HIGH",8.5,"2026-10-05",0],["CVE-2026-105307","","Casdoor","Casdoor API Endpoint authz_filter.go ApiFilter missing authentication","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105396","heymrun","heym","Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-94669","WP ManageNinja LLC","Fluent Forms Pro Add On Pack","WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerabil","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105291","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross s","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105290","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side reques","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-59788","Zabbix","Zabbix","Stored XSS vulnerability in OAuth configuration form","MEDIUM",5.6,"2026-10-05",0],["CVE-2026-59787","Zabbix","Zabbix","SNMP trap injection in zabbix_trap_receiver.pl","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-59786","Zabbix","Zabbix","Active agent heartbeat missing TLS check","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-59785","Zabbix","Zabbix","Hidden host credentials inferable via multiselect.get filtering","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-59783","Zabbix","Zabbix","Server DoS via binary items","LOW",2.3,"2026-10-05",0],["CVE-2026-59782","Zabbix","Zabbix","JavaScript preprocessing memory disclosure","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-39763","Deepak Anand","WP Dummy Content Generator","WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-105289","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialc","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105288","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105287","feelec-yishu","feelcrm-os","feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql inj","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105286","Totolink","A3002MU","Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-19395","qt","Qt for MCUs","An empty <img> attribute value in styled text triggers a parser error that halts the devic","MEDIUM",6.6,"2026-10-05",0],["CVE-2026-105285","Totolink","A3002MU","Totolink A3002MU QoS Rule formIpQoS stack-based overflow","CRITICAL",10,"2026-10-05",0],["CVE-2026-39721","Brainstorm Force","Starter Templates","WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-105284","Totolink","A3002MU","Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization","CRITICAL",10,"2026-10-05",0],["CVE-2026-105064","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103351","Magepeople inc.","Taxi Booking Manager for WooCommerce","WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type ","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-104389","Sirv","Sirv","WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability","HIGH",8.5,"2026-10-05",0],["CVE-2026-104388","Blubrry Podcasting","PowerPress Podcasting","WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-102393","Brainstorm Force","Starter Templates","WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103079","Ahmad","JS Help Desk","WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerab","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-104396","Jeroen Peters","Name Directory","WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-102914","Brainstorm Force","Presto Player","WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104675","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-103084","LeapWorx","Premium Addons for Elementor","WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vul","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104397","Jeroen Peters","Name Directory","WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105060","Themepoints","Logo Showcase","WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104673","Sonaar","MP3 Audio Player for Music, Radio & Podcast by Sonaar","WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross S","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105056","impleCode","eCommerce Product Catalog","WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerabi","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105263","","Shaarli","Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side requ","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-103510","Perforce","P4 (Helix Core)","Authentication bypass via blank auth token in P4Search","CRITICAL",9.5,"2026-10-05",0],["CVE-2026-104408","Groundhogg","Groundhogg","WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability","HIGH",7.6,"2026-10-05",0],["CVE-2026-103335","Deepen Bajracharya","Video Conferencing with Zoom","WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerab","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105055","WP Mailster","WP Mailster","WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-103511","Perforce","P4 (Helix Core)","Arbitrary file-write via extension installation in P4Search","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-97071","VillaTheme","CURCY","WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105062","Brandtoss","WP Admin Audit","WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-103078","Ahmad","JS Help Desk","WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerab","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-103512","Perforce","P4 (Helix Core)","Ticket host-binding bypass via spoofed client IP in P4Search","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-104407","Blubrry Podcasting","PowerPress Podcasting","WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vuln","HIGH",7.1,"2026-10-05",0],["CVE-2026-104811","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution","HIGH",8.4,"2026-10-05",0],["CVE-2026-104386","WPFunnels Team","WP VR","WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104810","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability","HIGH",8.4,"2026-10-05",0],["CVE-2026-105069","Nikki Blight","QR Redirector","WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-104809","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution","HIGH",8.4,"2026-10-05",0],["CVE-2026-104404","Liquid Web / StellarWP","GiveWP","WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-103507","Perforce","P4 (Helix Core)","Arbitrary file-write via log configuration path in P4Search","HIGH",7.5,"2026-10-05",0],["CVE-2026-104808","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 stored Cross-Site Scripting","LOW",1.9,"2026-10-05",0],["CVE-2026-105254","itsourcecode","Online Admission System","itsourcecode Online Admission System schoolyear.php sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-104807","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 stored Cross-Site Scripting","LOW",1.9,"2026-10-05",0],["CVE-2026-100102","Perforce","P4 (Helix Core)","RCE via exposed JDWP debug agent in P4Search","CRITICAL",9.5,"2026-10-05",0],["CVE-2026-105068","Pixelite","Events Manager","WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-104806","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-104805","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Exec","HIGH",8.5,"2026-10-05",0],["CVE-2026-100103","Perfoce","P4 (Helix Core)","Authentication bypass via default auth token in P4Search","CRITICAL",10,"2026-10-05",0],["CVE-2026-104401","Memberful","Memberful - Membership Plugin","WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnera","MEDIUM",4.3,"2026-10-05",0],["CVE-2026-104706","Mitel","Mitel MiVoice Office 400","Mitel MiVoice Office 400 view system files path traversal","HIGH",8.4,"2026-10-05",0],["CVE-2026-105253","itsourcecode","Online Admission System Project","itsourcecode Online Admission System Project login1.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-104400","bPlugins","B Blocks","WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-19185","zephyrproject","zephyr","Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kern","HIGH",7.8,"2026-10-05",0],["CVE-2026-19184","zephyrproject","zephyr","Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size valida","HIGH",8.4,"2026-10-05",0],["CVE-2026-104409","WP Chill","Image Photo Gallery Final Tiles Grid","WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XS","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105251","","vgmstream","vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105250","","vgmstream","vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105249","","vgmstream","vgmstream TXTP File txtp_process.c make_group_random use after free","LOW",2.4,"2026-10-05",0],["CVE-2026-105314","Papermerge","Papermerge","Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal i","HIGH",7.5,"2026-10-05",0],["CVE-2026-105248","","vgmstream","vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105247","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System btn_functions.php course sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-19954","","Net-Whois-Raw","Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that quer","MEDIUM",5.4,"2026-10-05",0],["CVE-2019-25777","","YAML","YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any pa","HIGH",7.3,"2026-10-05",0],["CVE-2017-20285","","YAML","YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method o","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105246","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System btn_functions.php update sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-100727","GROWI, Inc.","GROWI","An improper access control vulnerability exists in GROWI, which allow an unauthenticated a","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105245","sgl-project","sglang","sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission","MEDIUM",6.3,"2026-10-05",0],["CVE-2026-105238","ChatGPTNextWeb","NextChat","ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-13607","","File Uploads Addon for WooCommerce","File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access","MEDIUM",5.9,"2026-10-05",0],["CVE-2026-78371","","File Uploads Addon for WooCommerce","File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File ","MEDIUM",5.9,"2026-10-05",0],["CVE-2026-84169","","UPI QR Code Payment Gateway","UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105237","linlinjava","litemall","linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication","MEDIUM",6.3,"2026-10-05",0],["CVE-2026-105306","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: token introspection audience bypass via dynamic clie","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-105302","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access","MEDIUM",5.7,"2026-10-05",0],["CVE-2026-105233","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Login Flow login.php session fixiation","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105232","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Registration deliverysignup.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105231","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Admin Registration signup.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105230","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system deliverymyord.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105229","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105226","osCommerce","osCommerce2","osCommerce osCommerce2 Newsletter Management newsletters.php include code injection","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105225","osCommerce","osCommerce2","osCommerce osCommerce2 Payment payment.php include code injection","MEDIUM",4.8,"2026-10-05",0],["CVE-2026-105188","code-projects","Human Resource Management System","code-projects Human Resource Management System Live Event History liveEventHistory.php cro","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105187","itsourcecode","Online Admission System","itsourcecode Online Admission System key.php sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105186","itsourcecode","Online Admission System","itsourcecode Online Admission System new.php sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105185","itsourcecode","Online Admission System","itsourcecode Online Admission System examinee.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105184","itsourcecode","Online Admission System","itsourcecode Online Admission System creteria.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105183","itsourcecode","Online Admission System","itsourcecode Online Admission System confirm.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105182","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System btn_functions.php update sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105181","itsourcecode","Online Admission System","itsourcecode Online Admission System register1.php sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105180","","Jeebase","Jeebase UserService info updateUser dynamically-determined object attributes","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105179","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Password add_user.php missing encryption","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-20543","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible information disclosure due to a logic error. This could lead","MEDIUM",5.5,"2026-10-05",0],["CVE-2026-20542","MediaTek, Inc.","MediaTek chipset","In apusys, there is a possible memory corruption due to use after free. This could lead to","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20541","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds read due to a missing permission check. This c","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20540","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds read due to a missing bounds check. This could","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20539","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds read due to a missing bounds check. This could","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20538","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds read due to a missing permission check. This c","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20537","MediaTek, Inc.","MediaTek chipset","In aidl, there is a possible memory corruption due to use after free. This could lead to l","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20536","MediaTek, Inc.","MediaTek chipset","In aidl, there is a possible memory corruption due to use after free. This could lead to l","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20535","MediaTek, Inc.","MediaTek chipset","In aidl, there is a possible escalation of privilege due to a missing permission check. Th","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20534","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds read due to an incorrect bounds check. This co","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20533","MediaTek, Inc.","MediaTek chipset","In display, there is a possible escalation of privilege due to an integer overflow. This c","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20532","MediaTek, Inc.","MediaTek chipset","In apu, there is a possible application crash due to double free. This could lead to local","MEDIUM",6.2,"2026-10-05",0],["CVE-2026-20531","MediaTek, Inc.","MediaTek chipset","In apu, there is a possible memory corruption due to use after free. This could lead to lo","HIGH",8.4,"2026-10-05",0],["CVE-2026-20530","MediaTek, Inc.","MediaTek chipset","In display, there is a possible out of bounds write due to a missing bounds check. This co","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20529","MediaTek, Inc.","MediaTek chipset","In battery, there is a possible out of bounds write due to a missing bounds check. This co","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20528","MediaTek, Inc.","MediaTek chipset","In ccci, there is a possible out of bounds write and read due to a missing bounds check. T","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20544","MediaTek, Inc.","MediaTek chipset","In meta, there is a possible out of bounds write due to a missing bounds check. This could","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-20588","MediaTek, Inc.","MediaTek chipset","In mtee, there is a possible escalation of privilege due to a missing bounds check. This c","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20587","MediaTek, Inc.","MediaTek chipset","In mtee, there is a possible escalation of privilege due to type confusion. This could lea","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20579","MediaTek, Inc.","MediaTek chipset","In vdec, there is a possible out of bounds write due to type confusion. This could lead to","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20527","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible system crash due to a missing bounds check. This could lead ","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20526","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds write due to a missing bounds check. This coul","HIGH",7.5,"2026-10-05",0],["CVE-2026-20525","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible system crash due to improper input validation. This could le","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-20524","MediaTek, Inc.","MediaTek chipset","In apu, there is a possible memory corruption due to improper input validation. This could","HIGH",8.4,"2026-10-05",0],["CVE-2026-20523","MediaTek, Inc.","MediaTek chipset","In neuropilot, there is a possible out of bounds write due to a missing bounds check. This","HIGH",8.4,"2026-10-05",0],["CVE-2026-20522","MediaTek, Inc.","MediaTek chipset","In neuropilot, there is a possible out of bounds write due to a missing bounds check. This","HIGH",8.4,"2026-10-05",0],["CVE-2026-20521","MediaTek, Inc.","MediaTek chipset","In Video HAL, there is a possible escalation of privilege due to a missing bounds check. T","HIGH",8.4,"2026-10-05",0],["CVE-2026-20589","MediaTek, Inc.","MediaTek chipset","In venc, there is a possible out of bounds write due to type confusion. This could lead to","MEDIUM",6.7,"2026-10-05",0],["CVE-2026-20586","MediaTek, Inc.","MediaTek chipset","In vdec, there is a possible out of bounds write due to a missing bounds check. This could","HIGH",8.8,"2026-10-05",0],["CVE-2026-20520","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds write due to a missing bounds check. This coul","HIGH",7.5,"2026-10-05",0],["CVE-2026-20519","MediaTek, Inc.","MediaTek chipset","In Modem, there is a possible out of bounds write due to a missing bounds check. This coul","HIGH",7.5,"2026-10-05",0],["CVE-2026-105178","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_esc","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105177","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105176","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System edit_class.php sql injection","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105175","SourceCodester","Drug Recommendation System","SourceCodester Drug Recommendation System Student Registration add_student.php sql injecti","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105294","Legcord","Legcord","Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105295","gitahead","GitAhead","GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass","HIGH",7.7,"2026-10-05",0],["CVE-2026-105292","chaterm","Chaterm","Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback","MEDIUM",6,"2026-10-05",0],["CVE-2026-105293","Legcord","Legcord","Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers","CRITICAL",9.2,"2026-10-05",0],["CVE-2026-105223","maclof","kubernetes-client","maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105174","","Gerapy","Gerapy Project Management views.py project_create path traversal","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105173","code-projects","Human Resource Management","code-projects Human Resource Management Event Creation EventStore.php cross site scripting","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105172","itsourcecode","Online Admission System","itsourcecode Online Admission System login1.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-37719","","","An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arb","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-78860","","","An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the sto","HIGH",7.8,"2026-10-05",0],["CVE-2026-78861","","","An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardc","HIGH",7.7,"2026-10-05",0],["CVE-2026-78862","","","An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UAR","MEDIUM",6.8,"2026-10-05",0],["CVE-2026-88391","","","Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Conso","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-88392","","","Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allo","HIGH",7.5,"2026-10-05",0],["CVE-2026-88393","","","WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-88394","","","WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export","HIGH",7.5,"2026-10-05",0],["CVE-2026-88395","","","GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the ","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-88396","","","ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpo","HIGH",7.2,"2026-10-05",0],["CVE-2026-88397","","","ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /ad","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-88424","","","FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order","CRITICAL",9.8,"2026-10-05",0],["CVE-2026-95165","","","Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization na","MEDIUM",6.1,"2026-10-05",0],["CVE-2026-95166","","","In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cro","MEDIUM",5.4,"2026-10-05",0],["CVE-2026-95263","","","Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend adminis","HIGH",7.2,"2026-10-05",0],["CVE-2026-95264","","","Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with a","MEDIUM",6.5,"2026-10-05",0],["CVE-2026-95265","","","Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor","HIGH",7.5,"2026-10-05",0],["CVE-2026-105171","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Role Attribute admin.php authorization","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105170","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Admin Signup signup.php missing authentication","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105169","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Take Order delivery.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105168","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105167","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system donate.php sql injection","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105221","defunkt","gist","Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105222","alexpechkarev","google-maps","alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_veri","CRITICAL",9.1,"2026-10-05",0],["CVE-2026-105220","klembot","twinejs","Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files","HIGH",8.5,"2026-10-05",0],["CVE-2026-105166","kishor-23","food-waste-management-system","kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql in","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105165","devopspolis","secrets-replicator","devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assi","MEDIUM",5.3,"2026-10-05",0],["CVE-2026-105164","NASA","cFS","NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds","MEDIUM",5.1,"2026-10-05",0],["CVE-2026-105163","crossplane","crossplane-runtime","crossplane crossplane-runtime ImageConfig client.go Get toctou","MEDIUM",6.9,"2026-10-05",0],["CVE-2026-105219","mwilliamson","mammoth.js","Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser","HIGH",8.7,"2026-10-04",0],["CVE-2026-105218","go-pay","gopay","gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client","CRITICAL",9.1,"2026-10-04",0],["CVE-2026-105216","micro","go-micro","go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper","CRITICAL",9.1,"2026-10-04",0],["CVE-2026-105217","cockpit-hq","cockpit","Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php","LOW",2.3,"2026-10-04",0],["CVE-2026-105161","invariant-systems-ai","aiir","invariant-systems-ai aiir Policy Gate signature verification","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105086","WWBN","AVideo","WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-104402","farvisun","Mindio Magic MCP","WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability","MEDIUM",4.3,"2026-10-04",0],["CVE-2026-105089","WWBN","AVideo","WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-105224","YesWiki","yeswiki","YesWiki before 4.6.7 Stored XSS via Bazar valeur Action","MEDIUM",5.1,"2026-10-04",0],["CVE-2026-105158","RainyGao","DocSys","RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sq","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105215","zitadel","zitadel","ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-105214","zitadel","zitadel","Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification","LOW",2.3,"2026-10-04",0],["CVE-2026-105212","zitadel","zitadel","ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment","HIGH",8.7,"2026-10-04",0],["CVE-2026-105213","zitadel","zitadel","ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations","HIGH",8.8,"2026-10-04",0],["CVE-2026-105211","zitadel","zitadel","ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode","CRITICAL",9.2,"2026-10-04",0],["CVE-2026-105209","zitadel","zitadel","ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmen","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-105210","zitadel","zitadel","ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers","HIGH",8.8,"2026-10-04",0],["CVE-2026-105207","zitadel","zitadel","ZITADEL before 4.17.3 Account Takeover via External IdP Linking","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-105208","zitadel","zitadel","ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens","HIGH",8.7,"2026-10-04",0],["CVE-2026-105206","zitadel","zitadel","ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Servic","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105205","siyuan-note","siyuan","SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105157","RainyGao","DocSys","RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105156","","YzmCMS","YzmCMS MD5 system.func.php password weak password hash","MEDIUM",6.3,"2026-10-04",0],["CVE-2026-105149","","mooSocial","mooSocial all-products sql injection","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105148","SciPhi-AI","R2R","SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105147","SciPhi-AI","R2R","SciPhi-AI R2R JWT Secret hard-coded credentials","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105146","Comsenz","Discuz!","Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection","MEDIUM",5.1,"2026-10-04",0],["CVE-2026-97307","StylemixThemes","Cost Calculator Builder","WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-10-04",0],["CVE-2026-105145","Weaviate","Verba","Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-103344","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","HIGH",7.1,"2026-10-04",0],["CVE-2026-103355","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","CRITICAL",9.3,"2026-10-04",0],["CVE-2026-105144","","Drogon","Drogon Static File Router StaticFileRouter.cc route path traversal","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105141","topoteretes","cognee","topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105137","","Laradock","Laradock Build Process Dockerfile code download","LOW",2.3,"2026-10-04",0],["CVE-2026-103062","Cozmoslabs","TranslatePress","WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-04",0],["CVE-2026-97276","VeronaLabs","WP Statistics","WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-04",0],["CVE-2026-103354","Liquid Web / StellarWP","Gutenberg Blocks by Kadence Blocks","WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XS","HIGH",7.1,"2026-10-04",0],["CVE-2026-105135","InternLM","MindSearch","InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection","CRITICAL",10,"2026-10-04",0],["CVE-2026-97332","","User Private Files","User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-104118","","Razorpay for WooCommerce","Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-104119","","Simple Shopping Cart","Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials","LOW",3.5,"2026-10-04",0],["CVE-2026-86817","","Five Star Business Profile and Schema","Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure ","MEDIUM",4.9,"2026-10-04",0],["CVE-2026-93549","","CoCart","CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass","HIGH",8.8,"2026-10-04",0],["CVE-2026-17005","","Horizontal scrolling announcements","Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field","MEDIUM",6.8,"2026-10-04",0],["CVE-2026-105134","Ahsay","AhsayCBS","Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection","CRITICAL",10,"2026-10-04",1],["CVE-2026-105133","Ahsay","AhsayCBS","Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication","MEDIUM",6.9,"2026-10-04",1],["CVE-2026-105099","Omega Solution","CoinEx Crypto","Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting","MEDIUM",5.1,"2026-10-04",0],["CVE-2026-105098","Omega Solution","CoinEx Crypto","Omega Solution CoinEx Crypto Support Ticket API customer information disclosure","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-88779","NetScaler","ADC","Memory overflow vulnerability leading to Denial of Service","HIGH",8.7,"2026-10-04",1],["CVE-2026-105097","Omega Solution","CoinEx Crypto","Omega Solution CoinEx Crypto Customer Information API customer-currency authorization","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105131","mayswind","ezBookkeeping","mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105096","Omega Solution","CoinEx Crypto","Omega Solution CoinEx Crypto Customer Profile API customer authorization","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105130","laradashboard","laradashboard","LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit","MEDIUM",6.3,"2026-10-04",0],["CVE-2026-105128","laradashboard","laradashboard","LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105129","laradashboard","laradashboard","LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API","HIGH",7.1,"2026-10-04",0],["CVE-2026-105127","laradashboard","laradashboard","LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints","MEDIUM",6.9,"2026-10-04",0],["CVE-2026-105125","laradashboard","laradashboard","LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint","MEDIUM",6.3,"2026-10-04",0],["CVE-2026-105126","laradashboard","laradashboard","LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering","HIGH",8.6,"2026-10-04",0],["CVE-2026-105124","vincent-peugnet","wcms","W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments","MEDIUM",5.3,"2026-10-04",0],["CVE-2026-105123","vincent-peugnet","wcms","W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API","HIGH",8.7,"2026-10-04",0],["CVE-2026-96451","Ultimate Member","Ultimate Member","WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability","HIGH",8.8,"2026-10-03",0],["CVE-2026-103065","Themeum","Kirki","WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability","HIGH",8.2,"2026-10-03",0],["CVE-2026-103342","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","HIGH",7.1,"2026-10-03",0],["CVE-2026-105122","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-105120","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-105121","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-105118","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession","LOW",2.3,"2026-10-03",0],["CVE-2026-105119","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows","HIGH",7.6,"2026-10-03",0],["CVE-2026-105117","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-105116","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-105115","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface","HIGH",8.8,"2026-10-03",0],["CVE-2026-105113","nezhahq","nezha","Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock","HIGH",7.1,"2026-10-03",0],["CVE-2026-105114","OpenIdentityPlatform","OpenAM","OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-105112","nezhahq","nezha","Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints","MEDIUM",6,"2026-10-03",0],["CVE-2026-105105","NASA-AMMOS","AIT-Core","Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command ","CRITICAL",9.8,"2026-10-03",0],["CVE-2026-104983","Linux Mint","Xreader","Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-71890","Legion of the Bouncy Castle Inc.","BC-JAVA","MLS external commit can remove an arbitrary group member","HIGH",8.7,"2026-10-03",0],["CVE-2026-71891","Legion of the Bouncy Castle Inc.","BC-JAVA","BLS12-381 key validation accepts a public key built on a foreign curve","HIGH",7.1,"2026-10-03",0],["CVE-2026-18040","Legion of the Bouncy Castle Inc.","BC-JAVA","HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-depen","MEDIUM",5.9,"2026-10-03",0],["CVE-2026-71885","Legion of the Bouncy Castle Inc.","BC-JAVA","MLS X.509 credential not bound to the LeafNode signature key","CRITICAL",9.2,"2026-10-03",0],["CVE-2026-71886","Legion of the Bouncy Castle Inc.","BC-JAVA","OpenPGP certification accepted from a subkey without certification authority","HIGH",8.2,"2026-10-03",0],["CVE-2026-71887","Legion of the Bouncy Castle Inc.","BC-JAVA","OpenPGP data signature accepted from a signing subkey without cross-certification","HIGH",8.2,"2026-10-03",0],["CVE-2026-71883","Legion of the Bouncy Castle Inc.","BC-LTS-JAVA","Native AES packet cipher returns the raw AES key on an alias","HIGH",8.2,"2026-10-03",0],["CVE-2026-71888","Legion of the Bouncy Castle Inc.","BC-JAVA","CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent","HIGH",8.7,"2026-10-03",0],["CVE-2026-71889","Legion of the Bouncy Castle Inc.","BC-JAVA","PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate","HIGH",8.7,"2026-10-03",0],["CVE-2026-71892","Legion of the Bouncy Castle Inc.","BC-JAVA","CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-85515","Legion of the Bouncy Castle Inc.","BC-JAVA","OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check","HIGH",8.2,"2026-10-03",0],["CVE-2026-97873","Legion of the Bouncy Castle Inc.","BC-JAVA","Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-104982","Linux Mint","Xreader","Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-92084","beaverbuilder","Beaver Builder Page Builder – Drag and Drop Website Builder","Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution vi","CRITICAL",9.1,"2026-10-03",0],["CVE-2026-92767","zayedbaloch","Twenty20 Image Before-After","Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scri","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-100157","roxnor","WP Ultimate Review","WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_","MEDIUM",6.5,"2026-10-03",0],["CVE-2026-11601","arraytics","WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System","WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification F","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-18443","storeapps","Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalatio","HIGH",8.8,"2026-10-03",0],["CVE-2026-104313","wpclever","WPC Estimated Delivery Date for WooCommerce","WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via ","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-94505","nelio","Nelio Content – Editorial Calendar & Social Media Auto-Posting","Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary R","HIGH",8.1,"2026-10-03",0],["CVE-2026-96267","osamaesh","WP Visitor Statistics (Real Time Traffic)","WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'full","HIGH",7.5,"2026-10-03",0],["CVE-2026-103519","roxnor","WP Ultimate Review","WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vi","MEDIUM",5.4,"2026-10-03",0],["CVE-2026-87115","e4jvikwp","VikAppointments Services Booking Calendar","VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Delet","CRITICAL",9.1,"2026-10-03",0],["CVE-2026-75028","arraytics","WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System","WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style'","HIGH",7.5,"2026-10-03",0],["CVE-2026-93889","wardee","Mail logging & Catcher","Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mai","HIGH",7.2,"2026-10-03",0],["CVE-2026-93896","syammohanm","WPFront Notification Bar","WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-15795","cyberchimps","Responsive Starter Templates – Elementor Templates & Starter Sites","Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sh","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-92974","10web","Photo Gallery by 10Web – Mobile-Friendly Image Gallery","Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Paramete","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-97660","wpclever","WPC Product Options for WooCommerce","WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting","HIGH",7.2,"2026-10-03",0],["CVE-2026-103421","amauric","WPMobile.App – Android and iOS App Builder","WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/sea","MEDIUM",5.4,"2026-10-03",0],["CVE-2026-97343","burstbv","Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)","Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link ","MEDIUM",4.3,"2026-10-03",0],["CVE-2026-96962","","Pie Register","Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code","LOW",3.7,"2026-10-03",0],["CVE-2026-89236","","SaveTo Wishlist Lite","SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Par","HIGH",8.6,"2026-10-03",0],["CVE-2026-91078","","TillKit","TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN","HIGH",8.2,"2026-10-03",0],["CVE-2026-92437","","Mailchimp for WooCommerce","Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-92923","","Unlimited Elements for Elementor","Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_","MEDIUM",6.3,"2026-10-03",0],["CVE-2026-94238","","Loco Translate","Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter","MEDIUM",6.8,"2026-10-03",0],["CVE-2026-94239","","Loco Translate","Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration","MEDIUM",6.8,"2026-10-03",0],["CVE-2026-86832","","MetForm","MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-86834","","MetForm","MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integratio","LOW",3.7,"2026-10-03",0],["CVE-2026-88782","","Kubio AI Page Builder","Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribu","MEDIUM",6.8,"2026-10-03",0],["CVE-2026-88783","","Kubio AI Page Builder","Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content","HIGH",8.8,"2026-10-03",0],["CVE-2026-103514","","WP 2FA","WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay","HIGH",7.5,"2026-10-03",0],["CVE-2026-80517","","WP Ultimate CSV Importer","WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload","LOW",3.5,"2026-10-03",0],["CVE-2026-80518","","WP Ultimate CSV Importer","WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable ","LOW",3.7,"2026-10-03",0],["CVE-2026-85015","","Unlimited Elements for Elementor","Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Tr","MEDIUM",6.6,"2026-10-03",0],["CVE-2026-85568","","Unlimited Elements for Elementor","Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Paramet","MEDIUM",6.8,"2026-10-03",0],["CVE-2026-101159","","WP Ultimate Review","WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission","HIGH",7.5,"2026-10-03",0],["CVE-2026-101160","","WP Ultimate Review","WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating","HIGH",7.5,"2026-10-03",0],["CVE-2026-101161","","WP Ultimate Review","WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews ","HIGH",7.5,"2026-10-03",0],["CVE-2026-101162","","WP Ultimate Review","WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-103293","","MPG","MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import","MEDIUM",6.8,"2026-10-03",0],["CVE-2026-103888","wpclever","WPC Smart Quick View for WooCommerce","WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-103909","codepeople","Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More","Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Param","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-100148","widgetpack","Rich Showcase for Google Reviews","Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site ","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-101357","rainbowgeek","SEOPress – AI SEO Plugin & On-site SEO","SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_g","MEDIUM",4.9,"2026-10-03",0],["CVE-2026-96575","ivijanstefan","Transliterator – Multilingual and Multi-script Text Conversion","Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content ","HIGH",7.2,"2026-10-03",0],["CVE-2026-100149","wpzoom","WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons","WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenti","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-101923","villatheme","Photo Reviews for WooCommerce","Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitra","HIGH",8.1,"2026-10-03",0],["CVE-2026-87091","uscnanbu","Welcart e-Commerce","Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement ","HIGH",7.2,"2026-10-03",0],["CVE-2025-12828","ultrapressorg","Ultra Addons Lite for Elementor","Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-100152","smub","All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Que","MEDIUM",6.5,"2026-10-03",0],["CVE-2026-97337","wpinsider-1","Simple Membership","Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and","HIGH",7.5,"2026-10-03",0],["CVE-2026-101928","magicplugins","Magic Tooltips For Contact Form 7","Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting ","HIGH",7.2,"2026-10-03",0],["CVE-2026-96564","rainbowgeek","SEOPress – AI SEO Plugin & On-site SEO","SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name","HIGH",7.2,"2026-10-03",0],["CVE-2026-96650","wpchill","Strong Testimonials","Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_","HIGH",7.2,"2026-10-03",0],["CVE-2026-103913","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Store","HIGH",7.5,"2026-10-03",0],["CVE-2026-93430","gdragon","GD Rating System","GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'u","HIGH",7.2,"2026-10-03",0],["CVE-2026-97341","wp-buy","Visitor Traffic Real Time Statistics","Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site","HIGH",7.2,"2026-10-03",0],["CVE-2026-91108","alttextai","Alt Text AI – Automatically generate image alt text for SEO and accessibility","Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Po","MEDIUM",4.3,"2026-10-03",0],["CVE-2026-97344","roxnor","Wp Social Login and Register Social Counter","Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored ","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-11399","wpcodefactory","Helpdesk Support Ticket System for WooCommerce","Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference","MEDIUM",4.3,"2026-10-03",0],["CVE-2026-92538","thimpress","LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-92727","wpdevteam","EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents","EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-92826","nosilver4u","EWWW Image Optimizer","EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter K","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-92977","devowl","Real Cookie Banner: GDPR & ePrivacy Cookie Consent","Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross","HIGH",7.2,"2026-10-03",0],["CVE-2026-97644","trainingbusinesspros","Groundhogg — CRM, Newsletters, and Marketing Automation","Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identit","HIGH",8.8,"2026-10-03",0],["CVE-2026-92536","properfraction","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Rest","HIGH",8.8,"2026-10-03",0],["CVE-2026-92551","properfraction","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress","Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Rest","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-93428","ultimatemember","Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Fie","HIGH",7.5,"2026-10-03",0],["CVE-2026-92243","vinod-dalvi","Ivory Search – WordPress Search Plugin","Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter","MEDIUM",6.1,"2026-10-03",0],["CVE-2026-94378","psmplugins","SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent","SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name'","MEDIUM",6.4,"2026-10-03",0],["CVE-2026-94539","psmplugins","SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent","SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter","MEDIUM",6.5,"2026-10-03",0],["CVE-2026-100180","jegtheme","Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress","Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment","MEDIUM",5.4,"2026-10-03",0],["CVE-2026-95865","beaverbuilder","Beaver Builder Page Builder – Drag and Drop Website Builder","Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via '","MEDIUM",6.5,"2026-10-03",0],["CVE-2026-96270","ultimatemember","Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Para","HIGH",7.2,"2026-10-03",0],["CVE-2026-105090","Formbricks","Formbricks","Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-105083","ImageMagick","ImageMagick","ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE","LOW",1.8,"2026-10-03",0],["CVE-2026-79113","aswf","OpenAPV","OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-105080","C4illin","ConvertX","In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead ","CRITICAL",9.4,"2026-10-03",0],["CVE-2026-105029","uvdesk","support-center-bundle","UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-105030","rajnandan1","kener","Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-104478","getformwork","formwork","Formwork before 2.3.13 Path Traversal via BackupController Download and Delete","HIGH",7.1,"2026-10-03",0],["CVE-2026-104479","mindstellar","shopclass","Shopclass before 6.2.0 Stored XSS via Listing Description Field","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-104477","showdownjs","showdown","Showdown through 2.1.0 XSS via unescaped quote in href and src attributes","MEDIUM",5.3,"2026-10-03",0],["CVE-2026-104475","idurar","idurar-erp-crm","IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-104476","backdrop","backdrop","Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive","HIGH",8.2,"2026-10-03",0],["CVE-2026-104474","litespeedtech","openlitespeed","OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update","MEDIUM",5.4,"2026-10-03",0],["CVE-2026-104433","kvcache-ai","Mooncake","Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString","HIGH",8.7,"2026-10-03",0],["CVE-2026-105051","Irdeto","Denuvo Anti-Tamper","Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPU","LOW",1.9,"2026-10-03",0],["CVE-2026-105050","PeaZip","PeaZip","PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injectio","HIGH",7.1,"2026-10-03",0],["CVE-2026-105049","Zilliz","Attu","Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for","MEDIUM",5.8,"2026-10-03",0],["CVE-2026-84411","MikroTik","RouterOS","MikroTik RouterOS Integer Underflow","CRITICAL",9.3,"2026-10-03",0],["CVE-2026-105048","Zilliz","Attu","The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to pr","MEDIUM",4,"2026-10-03",0],["CVE-2026-94591","Armatura LLC","Armatura One","Armatura LLC Armatura One Use of Hard-coded Cryptographic Key","HIGH",8.6,"2026-10-03",0],["CVE-2026-94592","Armatura LLC","Armatura One","Armatura LLC Armatura One Use of Hard-coded Credentials","HIGH",8.6,"2026-10-03",0],["CVE-2026-105046","Kentico","Xperience","Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administr","MEDIUM",4.3,"2026-10-03",0],["CVE-2026-94593","Armatura LLC","Armatura One","Armatura LLC Armatura One Insertion of Sensitive Information into Log File","HIGH",8.5,"2026-10-03",0],["CVE-2026-94594","Armatura LLC","Armatura One","Armatura LLC Armatura One Insertion of Sensitive Information into Log File","MEDIUM",5.1,"2026-10-03",0],["CVE-2026-95102","Monta","monta.app","Monta monta.app Missing Authentication for Critical Function","CRITICAL",9.3,"2026-10-03",0],["CVE-2026-105043","MathWorks","Simulink","MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that a","LOW",3.6,"2026-10-03",0],["CVE-2026-97363","Monta","monta.app","Monta monta.app Improper Restriction of Excessive Authentication Attempts","HIGH",8.7,"2026-10-03",0],["CVE-2026-97212","Monta","monta.app","Monta monta.app Insufficient Session Expiration","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-93474","Monta","monta.app","Monta monta.app Insufficiently Protected Credentials","MEDIUM",6.9,"2026-10-03",0],["CVE-2026-104055","Canonical","postgresql-operator","Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-75937","Digi International","IX Family","OS Command Injection in Digi Accelerated Linux (DAL OS)","CRITICAL",9.4,"2026-10-02",0],["CVE-2026-82045","UTMStack","UTMStack","UTMStack < 11.2.16 JPQL Injection via searchPropertyValues","HIGH",7.1,"2026-10-02",0],["CVE-2026-104874","aio-libs","multidict","Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-82044","UTMStack","UTMStack","UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-82043","UTMStack","UTMStack","UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-82042","UTMStack","UTMStack","UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter","CRITICAL",9.3,"2026-10-02",0],["CVE-2026-82041","UTMStack","UTMStack","UTMStack < 11.2.16 Missing Authorization via Command WebSocket","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-104019","AWS","sagemaker-distribution","OS command injection in the Studio Space startup validation script in Amazon SageMaker Dis","CRITICAL",9.3,"2026-10-02",0],["CVE-2026-104873","langchain-ai","langgraph","LangGraph SDK custom auth silently ignores actions= on resource decorators","HIGH",7.6,"2026-10-02",0],["CVE-2026-103918","middleapi","orpc","@orpc/zod: Prototype injection in smart coercion","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-82040","UTMStack","UTMStack","UTMStack < 11.2.16 SSRF via IdentityProviderService","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-103036","middleapi","orpc","@orpc/json-schema: Prototype injection in smart coercion","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-82039","UTMStack","UTMStack","UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter","HIGH",8.7,"2026-10-02",0],["CVE-2026-104994","aquasec","Trivy","Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they","LOW",2.5,"2026-10-02",0],["CVE-2026-104872","open-telemetry","opentelemetry-js-contrib","Multiple @opentelemetry/instrumentation-* packages expose database username via unconditio","MEDIUM",5.8,"2026-10-02",0],["CVE-2026-104871","angular","angular-cli","Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104988","Red Hat","Red Hat Certificate System 10","Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificat","HIGH",8.1,"2026-10-02",0],["CVE-2026-104991","Alanaktion","phproject","Phproject < 1.8.7 Missing Authorization via Issues REST API","HIGH",7.1,"2026-10-02",0],["CVE-2026-12392","Canonical","MAAS","RPC secret disclosure via vendor data endpoint in Canonical MAAS","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-39718","Webriti","Wallstreet","WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability","HIGH",8.8,"2026-10-02",0],["CVE-2026-103958","AWS","loom","Server-side request forgery in the tool server and remote agent connection handling in Loo","HIGH",8.3,"2026-10-02",0],["CVE-2026-103957","AWS","loom","Server-side request forgery in the OAuth2 discovery handling in Loom for AWS","HIGH",8.2,"2026-10-02",0],["CVE-2026-96940","Microsoft","Microsoft Exchange Server 2016 Cumulative Update 23","Microsoft Exchange Server Elevation of Privilege Vulnerability","HIGH",8.8,"2026-10-02",0],["CVE-2026-103956","AWS","loom","Missing authentication for critical function in Loom for AWS","CRITICAL",10,"2026-10-02",0],["CVE-2020-37278","Weaver","e-Bridge","Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile","HIGH",8.7,"2026-10-02",0],["CVE-2014-125130","Damjan","CodeArt Google MP3 Audio Player","CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php","HIGH",8.7,"2026-10-02",0],["CVE-2023-54405","H3C","CVM","H3C CVM Unauthenticated File Upload via fileUpload/upload Token","CRITICAL",9.3,"2026-10-02",0],["CVE-2026-19856","","All in One SEO","All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-104861","nodeca","probe-image-size","probe-image-size: Quadratic-time Denial of Service in the SVG Parser","HIGH",7.5,"2026-10-02",0],["CVE-2026-104859","nrwl","nx","Nx: OS command injection in the @nx/docker release pipeline","HIGH",7.3,"2026-10-02",0],["CVE-2026-102795","Apache Software Foundation","Apache Traffic Server","Apache Traffic Server: SNI to Host header matching policy is not properly enforced","HIGH",7,"2026-10-02",0],["CVE-2026-104855","bytecodealliance","wasmtime","Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state","LOW",2,"2026-10-02",0],["CVE-2026-59265","Apache Software Foundation","Apache OpenOffice","Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system take","HIGH",8.8,"2026-10-02",0],["CVE-2026-102626","LimeSurvey","LimeSurvey","LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question at","HIGH",7.2,"2026-10-02",0],["CVE-2026-104854","nrwl","nx","Nx daemon and plugin worker sockets are accessible to other local users","HIGH",8.5,"2026-10-02",0],["CVE-2026-104853","nrwl","nx","Nx: Path traversal in nx migrate package-migrations extraction","MEDIUM",5.8,"2026-10-02",0],["CVE-2026-104851","fsspec","filesystem_spec","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Executi","HIGH",8.8,"2026-10-02",0],["CVE-2026-104849","tinylibs","tinypool","Tinypool: Prototype Pollution Gadget to RCE in run() options","CRITICAL",9.5,"2026-10-02",0],["CVE-2026-104848","tinylibs","tinypool","Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution","CRITICAL",9.5,"2026-10-02",0],["CVE-2026-104914","MISP","MISP","MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Pa","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-103623","Google","Chrome","Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote att","HIGH",8.8,"2026-10-02",0],["CVE-2026-103627","Google","Chrome","Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker ","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-103631","Google","Chrome","Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacke","HIGH",8.8,"2026-10-02",0],["CVE-2026-103622","Google","Chrome","Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to","HIGH",8.8,"2026-10-02",0],["CVE-2026-103624","Google","Chrome","Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 a","HIGH",8.3,"2026-10-02",0],["CVE-2026-103625","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to ","HIGH",8.8,"2026-10-02",0],["CVE-2026-103629","Google","Chrome","Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-103621","Google","Chrome","Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote a","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-103626","Google","Chrome","Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.9","CRITICAL",9.6,"2026-10-02",0],["CVE-2026-103630","Google","Chrome","Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker ","CRITICAL",9.6,"2026-10-02",0],["CVE-2026-103628","Google","Chrome","Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote atta","CRITICAL",9.6,"2026-10-02",0],["CVE-2026-103648","demsking","image-downloader","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-do","CRITICAL",9.1,"2026-10-02",0],["CVE-2026-104912","MISP","MISP","MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data","HIGH",7.1,"2026-10-02",0],["CVE-2026-96613","Meari","IoT Cloud Platform OpenAPI Service","Missing Authorization in Meari IoT Cloud Platform OpenAPI Service","HIGH",7.1,"2026-10-02",0],["CVE-2026-104847","ProseMirror","prosemirror-view","ProseMirror: XSS vulnerability in prosemirror-view's paste handling","HIGH",8.5,"2026-10-02",0],["CVE-2026-104910","MISP","MISP","MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104846","lxsmnsyc","seroval","Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (byp","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-101104","Meari","IoT Cloud Platform OpenAPI Service","Missing Authorization in Meari IoT Cloud Platform OpenAPI Service","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104908","MISP","MISP","MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and D","HIGH",7.1,"2026-10-02",0],["CVE-2026-104845","lxsmnsyc","seroval","Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization","HIGH",7.5,"2026-10-02",0],["CVE-2026-104907","MISP","MISP","MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-104906","MISP","MISP","MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output","MEDIUM",6.2,"2026-10-02",0],["CVE-2026-104844","postcss","postcss-selector-parser","PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","MEDIUM",5.9,"2026-10-02",0],["CVE-2026-104843","astral-sh","uv","uv: Path traversal on Windows through wheel extraction","MEDIUM",5.9,"2026-10-02",0],["CVE-2026-94484","vercel","next.js","Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitu","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-94485","vercel","next.js","Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicPar","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104901","MISP","MISP","MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Serv","MEDIUM",5.1,"2026-10-02",0],["CVE-2026-94483","vercel","next.js","Next.js: Server-Side Request Forgery in Image Optimization","HIGH",8.3,"2026-10-02",0],["CVE-2026-94543","vercel","next.js","Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104900","MISP","MISP","MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-94544","vercel","next.js","Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and p","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-94486","vercel","next.js","Next.js: Information disclosure in the Next.js development server's Model Context Protocol","LOW",2.3,"2026-10-02",0],["CVE-2026-104638","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem sessions.php improper authentication","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-39717","ThimPress","LearnPress","WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-39601","WPdevelop","Booking Calendar","WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability","LOW",3.7,"2026-10-02",0],["CVE-2026-39600","Mehul Gohil","Aculect AI Companion","WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulner","MEDIUM",4.7,"2026-10-02",0],["CVE-2026-39444","PublishPress","PublishPress Series","WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) v","MEDIUM",5.4,"2026-10-02",0],["CVE-2026-104637","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-39439","Kiera Howe","WebSamurai","WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-32585","airano","Airano MCP Bridge","WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-32584","Chiranjit Hazarika","Smart One Click Setup – Complete Demo Import &amp; Export","WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sens","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-90970","GitLab","GitLab AI Gateway","Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway","CRITICAL",9.9,"2026-10-02",0],["CVE-2026-104625","CodeAstro","Simple Loan Management System","CodeAstro Simple Loan Management System index.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-5782","MRV Technology Foreign Trade Ltd. Co.","TurkHotspot","Reflected XSS in MRV Technology's TurkHotspot","MEDIUM",5.2,"2026-10-02",0],["CVE-2026-104026","Meta Platforms, Inc","Sapling SCM","In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedd","HIGH",7.8,"2026-10-02",0],["CVE-2026-104614","CodeAstro","Simple Pharmacy Management System","CodeAstro Simple Pharmacy Management System delete.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-94422","Fedora","Fedora","xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape","HIGH",8.7,"2026-10-02",0],["CVE-2026-19652","DiviEngine","Divi Membership","Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-93875","Crocoblock","JetAppointment","JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime'","HIGH",7.2,"2026-10-02",0],["CVE-2026-104721","QOS.CH Sarl","Logback-classic","Logback: Incomplete protection against CVE-2026-19880","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104613","CodeAstro","Simple Pharmacy Management System","CodeAstro Simple Pharmacy Management System view.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-85215","GG Soft Software Services Inc.","Paperwork","SQL Injection in GG Soft's Paperwork","HIGH",7.1,"2026-10-02",0],["CVE-2026-66054","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-61374","Apache Software Foundation","Apache Thrift","Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit","HIGH",7.1,"2026-10-02",0],["CVE-2026-63772","Apache Software Foundation","Apache Thrift","Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader tr","HIGH",8.7,"2026-10-02",0],["CVE-2026-66055","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: ","HIGH",8.2,"2026-10-02",0],["CVE-2026-104612","SourceCodester","Student Result Management System","SourceCodester Student Result Management System Announcement new_announcement.php cross si","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-11795","Softtr Informatics Trading Limited Company","E-Commerce Pack","User Enumeration in Softtr's E-Commerce Pack","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-102797","ThemeREX Group","ThemeREX Addons","WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerabil","MEDIUM",6.4,"2026-10-02",0],["CVE-2026-102798","ThemeREX Group","ThemeREX Addons","WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-66081","Apache Software Foundation","Apache Thrift","Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned ","HIGH",8.7,"2026-10-02",0],["CVE-2026-66331","Apache Software Foundation","Apache Thrift","Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-66837","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length","HIGH",8.7,"2026-10-02",0],["CVE-2026-66858","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: ","HIGH",8.7,"2026-10-02",0],["CVE-2026-66859","Apache Software Foundation","Apache Thrift","Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route","HIGH",8.7,"2026-10-02",0],["CVE-2026-83632","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ THttpTransport grows its line buffer without bound","CRITICAL",9.2,"2026-10-02",0],["CVE-2026-104733","ProcessOne","ejabberd","User Impersonation/Authorization Bypass in XMPP Server ejabberd","HIGH",7.4,"2026-10-02",0],["CVE-2026-83663","Apache Software Foundation","Apache Thrift","Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that car","HIGH",8.7,"2026-10-02",0],["CVE-2026-83745","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from th","HIGH",8.7,"2026-10-02",0],["CVE-2026-104611","Tenda","AC9","Tenda AC9 POST Request fast_setting_internet_set stack-based overflow","CRITICAL",9.4,"2026-10-02",0],["CVE-2026-85476","Apache Software Foundation","Apache Thrift","Apache Thrift: c_glib `read_all` spins when the underlying read returns 0","HIGH",8.2,"2026-10-02",0],["CVE-2026-96289","Apache Software Foundation","Apache Thrift","Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have n","HIGH",8.2,"2026-10-02",0],["CVE-2026-96287","Apache Software Foundation","Apache Thrift","Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining b","HIGH",8.2,"2026-10-02",0],["CVE-2026-96286","Apache Software Foundation","Apache Thrift","Apache Thrift: Perl servers end `serve()` when serving one connection fails","HIGH",8.2,"2026-10-02",0],["CVE-2026-96277","Apache Software Foundation","Apache Thrift","Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception","HIGH",8.7,"2026-10-02",0],["CVE-2026-94658","Apache Software Foundation","Apache Thrift","Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (","HIGH",8.7,"2026-10-02",0],["CVE-2026-94657","Apache Software Foundation","Apache Thrift","Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound","HIGH",8.2,"2026-10-02",0],["CVE-2026-94656","Apache Software Foundation","Apache Thrift","Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound","HIGH",8.2,"2026-10-02",0],["CVE-2026-104610","Tenda","HG7","Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow","CRITICAL",10,"2026-10-02",0],["CVE-2026-94655","Apache Software Foundation","Apache Thrift","Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadra","HIGH",8.2,"2026-10-02",0],["CVE-2026-94654","Apache Software Foundation","Apache Thrift","Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an","HIGH",8.2,"2026-10-02",0],["CVE-2026-85209","AVEZ Electronics Communication Training and Consultancy Trade Inc.","Learning Management System (LMS)","IDOR in AVEZ Electronics's LMS","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-94653","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadra","HIGH",8.2,"2026-10-02",0],["CVE-2026-94652","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws be","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-94648","Apache Software Foundation","Apache Thrift","Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound","HIGH",8.2,"2026-10-02",0],["CVE-2026-94646","Apache Software Foundation","Apache Thrift","Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two tri","HIGH",8.7,"2026-10-02",0],["CVE-2026-94638","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-94637","Apache Software Foundation","Apache Thrift","Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame","HIGH",8.2,"2026-10-02",0],["CVE-2026-94636","Apache Software Foundation","Apache Thrift","Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once th","HIGH",8.2,"2026-10-02",0],["CVE-2026-92834","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ WebSocket server transport does not read a full request length","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104609","onetwothreeneth","HospitalManagementSystem","onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-90440","Apache Software Foundation","Apache Thrift","Apache Thrift: An exception escaping a libevent callback stops the D library's non-blockin","HIGH",8.2,"2026-10-02",0],["CVE-2026-87117","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element ","HIGH",8.7,"2026-10-02",0],["CVE-2026-86537","Apache Software Foundation","Apache Thrift","Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthen","HIGH",8.7,"2026-10-02",0],["CVE-2026-86536","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104473","YesWiki","yeswiki","YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages","MEDIUM",5.1,"2026-10-02",0],["CVE-2026-104471","YesWiki","yeswiki","YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import","HIGH",8.6,"2026-10-02",0],["CVE-2026-104472","YesWiki","yeswiki","YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler","HIGH",8.7,"2026-10-02",0],["CVE-2026-104470","YesWiki","yeswiki","YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104468","YesWiki","yeswiki","YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104469","YesWiki","yeswiki","YesWiki before 4.6.7 Session Fixation via Login in AuthController.php","HIGH",7.6,"2026-10-02",0],["CVE-2026-104467","YesWiki","yeswiki","YesWiki before 4.6.7 Authorization Bypass via Public API Mode","CRITICAL",9.2,"2026-10-02",0],["CVE-2026-104465","YesWiki","yeswiki","YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler","MEDIUM",5.1,"2026-10-02",0],["CVE-2026-104466","YesWiki","yeswiki","YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute","MEDIUM",5.1,"2026-10-02",0],["CVE-2026-104464","YesWiki","yeswiki","YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter","HIGH",8.8,"2026-10-02",0],["CVE-2026-104462","YesWiki","yeswiki","YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter","HIGH",8.8,"2026-10-02",0],["CVE-2026-104463","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox","HIGH",8.3,"2026-10-02",0],["CVE-2026-104461","YesWiki","yeswiki","YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField","MEDIUM",5.1,"2026-10-02",0],["CVE-2026-104459","YesWiki","yeswiki","YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104460","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch","HIGH",8.7,"2026-10-02",0],["CVE-2026-104457","YesWiki","yeswiki","YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter","HIGH",8.8,"2026-10-02",0],["CVE-2026-104458","YesWiki","yeswiki","YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses","HIGH",8.3,"2026-10-02",0],["CVE-2026-104456","YesWiki","yeswiki","YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username","HIGH",7.2,"2026-10-02",0],["CVE-2026-104454","YesWiki","yeswiki","YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104455","YesWiki","yeswiki","YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104453","YesWiki","yeswiki","YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104451","YesWiki","yeswiki","YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104452","YesWiki","yeswiki","YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104450","YesWiki","yeswiki","YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action","HIGH",8.2,"2026-10-02",0],["CVE-2026-104448","YesWiki","yeswiki","YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler","HIGH",7.2,"2026-10-02",0],["CVE-2026-104449","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche","HIGH",8.3,"2026-10-02",0],["CVE-2026-104447","YesWiki","yeswiki","YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction","HIGH",7.1,"2026-10-02",0],["CVE-2026-104445","YesWiki","yeswiki","YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing","HIGH",8.8,"2026-10-02",0],["CVE-2026-104446","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104444","YesWiki","yeswiki","YesWiki before 4.6.7 Authorization Bypass via Comments API editComment","HIGH",7.1,"2026-10-02",0],["CVE-2026-104442","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104443","YesWiki","yeswiki","YesWiki before 4.6.7 Scope Bypass via Triples Delete API","HIGH",7.2,"2026-10-02",0],["CVE-2026-104441","YesWiki","yeswiki","YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-86535","Apache Software Foundation","Apache Thrift","Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely","HIGH",8.7,"2026-10-02",0],["CVE-2026-104439","YesWiki","yeswiki","YesWiki before 4.6.7 User Enumeration via Lost-Password Flow","HIGH",7.1,"2026-10-02",0],["CVE-2026-104440","YesWiki","yeswiki","YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104438","YesWiki","yeswiki","YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions","HIGH",8.7,"2026-10-02",0],["CVE-2026-104436","ZcashFoundation","zebra","Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104437","ZcashFoundation","zebra","Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling","HIGH",8.3,"2026-10-02",0],["CVE-2026-104435","ZcashFoundation","zebra","Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output","HIGH",8.3,"2026-10-02",0],["CVE-2026-104432","ZcashFoundation","zebra","Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104434","ZcashFoundation","zebra","Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC","HIGH",7.1,"2026-10-02",0],["CVE-2026-104431","ZcashFoundation","zebra","Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification","HIGH",8.7,"2026-10-02",0],["CVE-2026-104429","ZcashFoundation","zebra","Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104430","ZcashFoundation","zebra","Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount","HIGH",8.7,"2026-10-02",0],["CVE-2026-104428","ZcashFoundation","zebra","Zebra before 11.0.0 Denial of Service via getblock Verbosity 2","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104426","ZcashFoundation","zebra","Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check","HIGH",8.2,"2026-10-02",0],["CVE-2026-104427","ZcashFoundation","zebra","Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry","HIGH",8.2,"2026-10-02",0],["CVE-2026-104425","ZcashFoundation","zebra","Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104423","ZcashFoundation","zebra","Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification","HIGH",8.7,"2026-10-02",0],["CVE-2026-104424","ZcashFoundation","zebra","Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104422","ZcashFoundation","zebra","Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite","HIGH",8.7,"2026-10-02",0],["CVE-2026-104421","ZcashFoundation","zebra","Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104419","ZcashFoundation","zebra","Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104420","ZcashFoundation","zebra","Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104418","TryGhost","Ghost","Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files","HIGH",8.6,"2026-10-02",0],["CVE-2026-104416","TryGhost","Ghost","Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API","HIGH",7.7,"2026-10-02",0],["CVE-2026-104417","TryGhost","Ghost","Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104415","TryGhost","Ghost","Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API","LOW",2.3,"2026-10-02",0],["CVE-2026-104413","TryGhost","Ghost","Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images","HIGH",8.5,"2026-10-02",0],["CVE-2026-104414","TryGhost","Ghost","Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses","HIGH",8.6,"2026-10-02",0],["CVE-2026-104412","TryGhost","Ghost","Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104411","TryGhost","Ghost","Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads","HIGH",8.5,"2026-10-02",0],["CVE-2026-103763","siyuan-note","siyuan","SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104410","siyuan-note","siyuan","SiYuan before 3.8.5 Information Disclosure via /api/export/preview","HIGH",8.7,"2026-10-02",0],["CVE-2026-103762","siyuan-note","siyuan","SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-85088","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Na","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-85087","Apache Software Foundation","Apache Thrift","Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-85086","Apache Software Foundation","Apache Thrift","Apache Thrift: Perl TLS client disables certificate verification by default","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-82459","Apache Software Foundation","Apache Thrift","Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote ","HIGH",8.2,"2026-10-02",0],["CVE-2026-82458","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, ","HIGH",8.7,"2026-10-02",0],["CVE-2026-96288","Apache Software Foundation","Apache Thrift","Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memo","HIGH",8.2,"2026-10-02",0],["CVE-2026-96292","Apache Software Foundation","Apache Thrift","Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtrac","HIGH",8.2,"2026-10-02",0],["CVE-2026-96294","Apache Software Foundation","Apache Thrift","Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection","HIGH",8.7,"2026-10-02",0],["CVE-2026-61373","Apache Software Foundation","Apache Thrift","Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation","HIGH",8.7,"2026-10-02",0],["CVE-2026-96990","Apache Software Foundation","Apache Thrift","Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound","HIGH",8.2,"2026-10-02",0],["CVE-2026-94642","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception","HIGH",8.7,"2026-10-02",0],["CVE-2026-94644","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound","HIGH",8.2,"2026-10-02",0],["CVE-2026-94645","Apache Software Foundation","Apache Thrift","Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded","HIGH",8.2,"2026-10-02",0],["CVE-2026-94650","Apache Software Foundation","Apache Thrift","Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack","HIGH",8.2,"2026-10-02",0],["CVE-2026-94651","Apache Software Foundation","Apache Thrift","Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a p","HIGH",8.2,"2026-10-02",0],["CVE-2026-85483","Apache Software Foundation","Apache Thrift","Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-85493","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth ","HIGH",8.7,"2026-10-02",0],["CVE-2026-85494","Apache Software Foundation","Apache Thrift","Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, ","HIGH",8.7,"2026-10-02",0],["CVE-2026-97876","GNU","grub2","Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base addre","MEDIUM",6.4,"2026-10-02",0],["CVE-2026-104606","itsourcecode","Online Admission System Project","itsourcecode Online Admission System Project confirm.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-91135","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)","CRITICAL",9.2,"2026-10-02",0],["CVE-2026-86326","Moxa","MGate MB3170 Series","An improper verification of cryptographic signature vulnerability exists in protocol gatew","HIGH",8.6,"2026-10-02",0],["CVE-2026-91137","Apache Software Foundation","Apache Thrift","Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements","HIGH",8.7,"2026-10-02",0],["CVE-2026-86325","Moxa","MGate MB3170 Series","A stack-based buffer overflow vulnerability exists in protocol gateways' account managemen","CRITICAL",9.4,"2026-10-02",0],["CVE-2026-59668","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-93925","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative","HIGH",8.7,"2026-10-02",0],["CVE-2026-59667","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-93926","Apache Software Foundation","Apache Thrift","Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pa","HIGH",8.7,"2026-10-02",0],["CVE-2026-94633","Apache Software Foundation","Apache Thrift","Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned na","HIGH",8.7,"2026-10-02",0],["CVE-2026-59666","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-94634","Apache Software Foundation","Apache Thrift","Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default","HIGH",8.2,"2026-10-02",0],["CVE-2026-59665","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-103885","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: Denial of service via crafted telephone number values","HIGH",7.5,"2026-10-02",0],["CVE-2026-103877","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-59662","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-103880","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored pa","HIGH",7.5,"2026-10-02",0],["CVE-2026-59664","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-103878","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: Injection of plaintext responses during StartTLS","HIGH",7.5,"2026-10-02",0],["CVE-2026-59663","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-104403","ThimPress","LearnPress","WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerabil","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-95662","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-103552","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: A unbound client can send a deeply nested search filter that ov","HIGH",7.3,"2026-10-02",0],["CVE-2026-59661","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-59660","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-59659","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-94180","Monetizemore","Advanced Ads","WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-94639","Apache Software Foundation","Apache Thrift","Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death bla","HIGH",8.2,"2026-10-02",0],["CVE-2026-94405","Shahjada","Download Manager","WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-97652","veronalabs","WP Statistics – Simple, privacy-friendly Google Analytics alternative","WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter","MEDIUM",6.1,"2026-10-02",0],["CVE-2026-85492","smub","All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname","MEDIUM",6.1,"2026-10-02",0],["CVE-2026-87920","boldgrid","W3 Total Cache","W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content","HIGH",7.2,"2026-10-02",0],["CVE-2026-94541","amauric","WPMobile.App – Android and iOS App Builder","WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Para","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-102731","Apache Software Foundation","Apache Directory LDAP API","Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode","HIGH",7.5,"2026-10-02",0],["CVE-2026-59673","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-59672","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-94635","Apache Software Foundation","Apache Thrift","Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pr","HIGH",8.7,"2026-10-02",0],["CVE-2026-80298","HAVELSAN Inc.","Sef - AI Chatbot Platform","SQL Injection in HAVELSAN's Sef - AI Chatbot Platform","HIGH",8.8,"2026-10-02",0],["CVE-2026-59671","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-95512","Red Hat","Red Hat Hardened Images","Freetype: freetype: denial of service via repeated subroutine allocations in cid font load","MEDIUM",5.5,"2026-10-02",0],["CVE-2026-80443","HAVELSAN Inc.","Sef - AI Chatbot Platform","Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Plat","HIGH",7.4,"2026-10-02",0],["CVE-2026-59670","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-80337","HAVELSAN Inc.","Sef - AI Chatbot Platform","Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-80464","HAVELSAN Inc.","Sef - AI Chatbot Platform","API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform","MEDIUM",4.9,"2026-10-02",0],["CVE-2026-59669","Repasat","Repasat application","Multiple vulnerabilities in the Repasat application","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-91784","cjbassi","gotop","Argument Injection leading to arbitrary process termination in gotop","MEDIUM",4.8,"2026-10-02",0],["CVE-2026-18036","Legion of the Bouncy Castle Inc.","BC-JAVA","NTRU leaks private key information by reducing secret values with a non-constant-time inte","HIGH",8.2,"2026-10-02",0],["CVE-2026-94432","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated ","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-97637","parorrey","JSON API Auth","JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_c","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-96647","webilia","Listdom: AI-powered Business Directory with Classifieds Ads Listings","Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authentica","MEDIUM",6.4,"2026-10-02",0],["CVE-2026-97338","codename065","Download Manager","Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via D","MEDIUM",6.4,"2026-10-02",0],["CVE-2026-97634","stellarwp","Event Tickets and Registration","Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via ","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-93756","smub","Smash Balloon Social Post Feed – Simple Social Feeds for WordPress","Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via","HIGH",7.2,"2026-10-02",0],["CVE-2026-95670","mihdan","No External Links","No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /","HIGH",7.2,"2026-10-02",0],["CVE-2026-100107","extendthemes","Kubio AI Page Builder","Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comme","HIGH",7.2,"2026-10-02",0],["CVE-2026-96871","kitae-park","Mang Board","Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Paramete","HIGH",7.2,"2026-10-02",0],["CVE-2026-97342","jetmonsters","JetFormBuilder — Dynamic Blocks Form Builder","JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post ","HIGH",7.2,"2026-10-02",0],["CVE-2026-103426","Relevanssi","Relevanssi Premium","Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Param","HIGH",7.2,"2026-10-02",0],["CVE-2026-102002","themeisle","Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form","LOW",3.1,"2026-10-02",0],["CVE-2026-96566","satollo","Newsletter – Send awesome emails from WordPress","Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field P","HIGH",7.2,"2026-10-02",0],["CVE-2026-100182","wpchill","Download Monitor","Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin ","HIGH",7.2,"2026-10-02",0],["CVE-2026-12951","wcmp","MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions","MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Param","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-97641","comesio","Relevanssi – A Better Search","Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content","HIGH",7.2,"2026-10-02",0],["CVE-2026-102772","jtsternberg","CMB2","CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field","HIGH",7.2,"2026-10-02",0],["CVE-2026-95817","apasionados","DoFollow Case by Case","DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment C","HIGH",7.2,"2026-10-02",0],["CVE-2026-97336","jtsternberg","CMB2","CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type","HIGH",7.2,"2026-10-02",0],["CVE-2026-93880","wpsoul","Greenshift – animation and page builder blocks","Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder","MEDIUM",6.1,"2026-10-02",0],["CVE-2026-96567","websoudan","MW WP Form","MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter ","HIGH",7.2,"2026-10-02",0],["CVE-2026-96578","creative-solutions-1","GSpeech TTS – WordPress Text To Speech Plugin","GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content","HIGH",7.2,"2026-10-02",0],["CVE-2026-97663","ivole","Customer Reviews for WooCommerce","Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting ","HIGH",7.2,"2026-10-02",0],["CVE-2026-17508","Legion of the Bouncy Castle Inc.","BC-JAVA","Password-based KDF cost parameters honoured unbounded from untrusted input across the rema","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-17507","Legion of the Bouncy Castle Inc.","BC-JAVA","MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sen","HIGH",8.7,"2026-10-02",0],["CVE-2026-103604","Legion of the Bouncy Castle Inc.","bc-csharp","Quadratic-time escaping when converting X.509 distinguished names to strings","HIGH",8.7,"2026-10-02",0],["CVE-2026-103603","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded HSS public key level count allows huge array allocation during signature verific","HIGH",8.7,"2026-10-02",0],["CVE-2026-103602","Legion of the Bouncy Castle Inc.","bc-csharp","Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts","HIGH",8.2,"2026-10-02",0],["CVE-2026-103601","Legion of the Bouncy Castle Inc.","bc-csharp","CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a","HIGH",8.2,"2026-10-02",0],["CVE-2026-103600","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded ASN.1 nesting depth causes process-terminating stack overflow","HIGH",8.7,"2026-10-02",0],["CVE-2026-63578","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded PBE iteration count when decrypting PKCS#8 private keys","HIGH",7.1,"2026-10-02",0],["CVE-2026-63577","Legion of the Bouncy Castle Inc.","bc-csharp","Name Constraints bypass: directoryName constraint matched at any position in the DN instea","HIGH",8.2,"2026-10-02",0],["CVE-2026-63576","Legion of the Bouncy Castle Inc.","bc-csharp","URI name constraints checked against a mis-parsed host","HIGH",8.2,"2026-10-02",0],["CVE-2026-63575","Legion of the Bouncy Castle Inc.","bc-csharp","PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count","HIGH",7.1,"2026-10-02",0],["CVE-2026-63574","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded allocation from OpenPGP signature and user attribute subpacket lengths","HIGH",8.7,"2026-10-02",0],["CVE-2026-63573","Legion of the Bouncy Castle Inc.","bc-csharp","Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap","HIGH",8.2,"2026-10-02",0],["CVE-2026-63572","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files","HIGH",7.1,"2026-10-02",0],["CVE-2026-63571","Legion of the Bouncy Castle Inc.","bc-csharp","Attribute certificate path validation does not verify the attribute certificate's signatur","HIGH",8.7,"2026-10-02",0],["CVE-2026-63570","Legion of the Bouncy Castle Inc.","bc-csharp","Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links","HIGH",7.1,"2026-10-02",0],["CVE-2026-63569","Legion of the Bouncy Castle Inc.","bc-csharp","MTI/A0 DHAgreement does not validate the peer's ephemeral value","CRITICAL",9.1,"2026-10-02",0],["CVE-2026-63568","Legion of the Bouncy Castle Inc.","bc-csharp","Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion","HIGH",8.7,"2026-10-02",0],["CVE-2026-63567","Legion of the Bouncy Castle Inc.","bc-csharp","IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)","HIGH",8.2,"2026-10-02",0],["CVE-2026-63566","Legion of the Bouncy Castle Inc.","bc-csharp","DTLS handshake reassembler allocates buffer from unchecked 24-bit length","HIGH",8.7,"2026-10-02",0],["CVE-2026-97219","","MStore API","MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-92924","","Unlimited Elements for Elementor","Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via ","MEDIUM",5.4,"2026-10-02",0],["CVE-2026-90987","","Easy PayPal & Stripe Buy Now Button","Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulat","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-91020","","WebToffee Gift Cards for WooCommerce","WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulati","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-90952","","WP Edit Password Protected","WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass vi","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-84740","","The Events Calendar","The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'v","MEDIUM",6.5,"2026-10-02",0],["CVE-2026-85005","","Popup Maker WP","Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Mis","MEDIUM",5.4,"2026-10-02",0],["CVE-2026-79618","","WP User Frontend","WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-13413","","CMP – Coming Soon & Maintenance","CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Log","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-1661","","WP Mail Logging","WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-16001","Legion of the Bouncy Castle Inc.","bc-csharp","IesEngine stream-mode MAC forgery via length-dependent KDF split","HIGH",8.2,"2026-10-02",0],["CVE-2026-16000","Legion of the Bouncy Castle Inc.","bc-csharp","KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used","HIGH",8.7,"2026-10-02",0],["CVE-2026-15999","Legion of the Bouncy Castle Inc.","bc-csharp","AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication","HIGH",8.2,"2026-10-02",0],["CVE-2026-102565","bookingalgorithms","BA Book Everything","BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_se","HIGH",7.2,"2026-10-02",0],["CVE-2026-93029","Webpros","cPanel","There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SS","CRITICAL",9,"2026-10-02",0],["CVE-2026-93697","Webpros","cPanel","There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modi","CRITICAL",9,"2026-10-02",0],["CVE-2026-93698","Webpros","cPanel","Insufficient validation allows arbitrary commands to be executed via the Multilang adminbi","CRITICAL",9.9,"2026-10-02",0],["CVE-2026-97318","","Giveaways and Contests by RafflePress","Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via","MEDIUM",6.1,"2026-10-02",0],["CVE-2026-94298","","BuildKit","BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter","MEDIUM",6.2,"2026-10-02",0],["CVE-2026-97317","","Giveaways and Contests by RafflePress","Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Dis","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-85016","","Unlimited Elements for Elementor","Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Param","MEDIUM",6.8,"2026-10-02",0],["CVE-2026-91022","","Motors","Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color","MEDIUM",6.8,"2026-10-02",0],["CVE-2026-91023","","Motors","Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta","LOW",3.1,"2026-10-02",0],["CVE-2026-91828","","OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","OMGF < 6.3.11 - Unauthenticated DoS via do_optimize","HIGH",7.5,"2026-10-02",0],["CVE-2026-13718","","Tabs Responsive","Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content","MEDIUM",6.8,"2026-10-02",0],["CVE-2026-81740","","Paytm Payment Gateway","Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Call","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-85004","","Popup Maker","Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-90988","","Request a Quote","Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-15896","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi","CRITICAL",9.1,"2026-10-02",0],["CVE-2026-78471","optimizingmatters","Autoptimize","Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author N","MEDIUM",5.4,"2026-10-02",0],["CVE-2026-15897","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege ","HIGH",8.8,"2026-10-02",0],["CVE-2026-90438","kstover","Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RT","HIGH",7.2,"2026-10-02",0],["CVE-2026-92174","gpriday","SiteOrigin Widgets Bundle","SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion vi","HIGH",7.5,"2026-10-02",0],["CVE-2026-84925","ThemeFusion","Avada | Website Builder For WordPress & WooCommerce","Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scrip","MEDIUM",6.1,"2026-10-02",0],["CVE-2026-92820","SaturdayDrive","Ninja Forms - File Uploads","Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload","HIGH",8.1,"2026-10-02",0],["CVE-2026-10026","CTX","CTX Feed Pro","CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution","HIGH",7.2,"2026-10-02",0],["CVE-2026-19660","DiviEngine","Divi Membership","Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parame","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-14378","dplugins","DevKit Pro","DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeo","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-93367","wp-buy","Visitor Traffic Real Time Statistics pro","Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scr","HIGH",7.2,"2026-10-02",0],["CVE-2026-104123","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System btn_functions.php activity sql injection","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104120","modelcontextprotocol","mcp-server-fetch","modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104054","calcom","cal.diy","calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking autho","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104053","itsourcecode","Pet Shop Management System","itsourcecode Pet Shop Management System admin_reservefilter.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-21140","Samsung Mobile","Samsung Mobile Devices","Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows loca","MEDIUM",6.9,"2026-10-02",0],["CVE-2026-104052","itsourcecode","Pet Shop Management System","itsourcecode Pet Shop Management System admin_reject_completed.php sql injection","MEDIUM",5.3,"2026-10-02",0],["CVE-2026-104480","Discord","libdave","Improper MLS Welcome roster validation in Discord libdave allows unauthorized group member","CRITICAL",9.4,"2026-10-02",0],["CVE-2026-103098","GeoVision Inc.","GV-Eye","GV-Eye Sensitive information exposure in URL query parameter Vulnerability","HIGH",7.5,"2026-10-02",0],["CVE-2026-103097","GeoVision Inc.","GV-Eye","GV-Eye Relay Payment API Key Vulnerability","HIGH",7.5,"2026-10-02",0],["CVE-2026-103096","GeoVision Inc.","GV-Eye","GV-Eye Hardcoded API Key Vulnerability","HIGH",7.5,"2026-10-02",0],["CVE-2026-51898","","","sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-51899","","","In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/sched","MEDIUM",4.3,"2026-10-02",0],["CVE-2026-51901","","","SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution contr","HIGH",8.1,"2026-10-02",0],["CVE-2026-51904","","","SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent exec","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-51906","","","In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path ","CRITICAL",9.1,"2026-10-02",0],["CVE-2026-51907","","","In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path tra","HIGH",8.1,"2026-10-02",0],["CVE-2026-51911","","","vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/v","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-51914","","","TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent","HIGH",8.8,"2026-10-02",0],["CVE-2026-51915","","","TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool ","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-51916","","","TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in ","HIGH",7.5,"2026-10-02",0],["CVE-2026-51917","","","FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.","HIGH",7.3,"2026-10-02",0],["CVE-2026-51918","","","FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-51922","","","agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_","CRITICAL",9.8,"2026-10-02",0],["CVE-2026-67989","","","crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-ti","HIGH",7.5,"2026-10-02",0],["CVE-2026-86345","Red Hat","Red Hat Directory Server 11","389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to f","CRITICAL",9,"2026-10-02",0],["CVE-2026-103766","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter","HIGH",8.6,"2026-10-02",0],["CVE-2026-103765","kvcache-ai","Mooncake","Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server","HIGH",8.8,"2026-10-02",0],["CVE-2026-103764","kvcache-ai","Mooncake","Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP","CRITICAL",9.3,"2026-10-02",0],["CVE-2026-103761","kvcache-ai","Mooncake","Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue","HIGH",8.7,"2026-10-02",0],["CVE-2026-103760","kvcache-ai","Mooncake","Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon R","HIGH",8.2,"2026-10-02",0],["CVE-2025-71427","GongRzhe","Office-PowerPoint-MCP-Server","Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage","HIGH",7.6,"2026-10-02",0],["CVE-2026-18397","Thales","SConnect","SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability","CRITICAL",9.4,"2026-10-02",0],["CVE-2026-86344","Red Hat","Red Hat Directory Server 11","389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-oper","HIGH",7.5,"2026-10-02",0],["CVE-2026-27873","Johnson Controls","EasyIO FG","- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Paswo","MEDIUM",5.6,"2026-10-02",0],["CVE-2026-64893","Johnson Controls","EasyIO NEO","- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO","HIGH",7.3,"2026-10-02",0],["CVE-2026-64892","Johnson Controls","Easy IO Neo","- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows C","MEDIUM",6.3,"2026-10-02",0],["CVE-2026-104356","HaschekSolutions","pictshare","PictShare < 3.7.1 Predictable Delete Code via rand()","HIGH",8.2,"2026-10-02",0],["CVE-2026-34494","Johnson Controls","Neo Series MVP2","- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect","HIGH",7.2,"2026-10-02",0],["CVE-2026-34493","Johnson Controls","EasyIO FS32","- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Dat","HIGH",7.2,"2026-10-02",0],["CVE-2026-71449","Johnson Controls","EasyIO FS32",": Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows","CRITICAL",9.3,"2026-10-02",0],["CVE-2026-71448","Johnson Controls","EasyIO FS32",": Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS3","MEDIUM",5.6,"2026-10-02",0],["CVE-2026-71454","CWE-79 - Cross-site Scripting","CAPEC-63","Improper neutralization of input during web page generation ('cross-site scripting') vulne","MEDIUM",5.8,"2026-10-02",0],["CVE-2026-71453","Johnson Controls","EasyIO FS32","- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allo","MEDIUM",5.6,"2026-10-02",0],["CVE-2026-104051","HaschekSolutions","pictshare","PictShare < 3.7.1 Sensitive Information Disclosure via info API","HIGH",8.8,"2026-10-02",0],["CVE-2026-71452","Johnson Controls","EasyIO FS32","- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Inj","HIGH",7.2,"2026-10-02",0],["CVE-2026-104002","AWS","powertools-lambda-python","Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)","MEDIUM",6,"2026-10-02",0],["CVE-2026-71451","Johnson Controls","EasyIO FS32","- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Inje","MEDIUM",5.6,"2026-10-01",0],["CVE-2026-27874","Johnson Controls","EasyIO FS32",": Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exp","MEDIUM",5,"2026-10-01",0],["CVE-2026-102370","TP-Link Systems Inc.","Kasa EC70 V4","Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC7","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-104020","Amazon","ion-python","Uncontrolled recursion in the Ion reader in Amazon Ion Python","HIGH",8.7,"2026-10-01",0],["CVE-2026-96780","patorjk","figlet.js","figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used ","HIGH",8.2,"2026-10-01",0],["CVE-2026-104183","uhop","stream-json","stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-104182","uhop","stream-json","stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every inpu","MEDIUM",6.2,"2026-10-01",0],["CVE-2026-104181","filamentphp","filament","Filament: Multi-factor authentication (app) management actions do not require password rea","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-102514","PeaZip","PeaZip","Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archi","HIGH",8.4,"2026-10-01",0],["CVE-2026-55396","Teledyne FLIR","Aware2","Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2","HIGH",8.5,"2026-10-01",0],["CVE-2026-55395","Teledyne FLIR","Aware2","Hardcoded Passwords in Teledyne FLIR Robots running Aware2","CRITICAL",9.4,"2026-10-01",0],["CVE-2026-55394","Teledyne FLIR","Aware2","Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-55393","Teledyne FLIR","Aware2","Local File Inclusion in Teledyne FLIR Robots running Aware2","CRITICAL",10,"2026-10-01",0],["CVE-2026-14984","Teledyne FLIR","Aware2","Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2","CRITICAL",9.4,"2026-10-01",0],["CVE-2026-14983","Teledyne FLIR","Aware2","Missing Authentication in Teledyne FLIR Robots running Aware2","HIGH",7.1,"2026-10-01",0],["CVE-2026-53964","adfinis","document-merge-service","Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)","HIGH",7.2,"2026-10-01",0],["CVE-2026-55252","openrundev","openrun","OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-55251","netbox-community","devicetype-library","NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requir","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103484","","pgvector","pgvector buffer overflow in IVFFlat index build","HIGH",8.8,"2026-10-01",0],["CVE-2026-102628","Eummena","Cadmos LTI","Cadmos LTI exposure of sensitive information via debug mode","CRITICAL",9.2,"2026-10-01",0],["CVE-2026-100251","Wormhole App","Wormhole","Wormhole.app SSRF","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-93832","Motorola","Setup App","A component of one of the Motorola system applications was exported without permission, al","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-102671","Joyland","Joyland.ai","Joyland AI WebView accepts invalid SSL certificates","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-102670","Joyland","Joyland.ai","Joyland AI enables HTTP","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-102669","Joyland","Joyland.ai","Joyland AI hostname checking disabled","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-54049","sakaiproject","sakai","Sakai Conversations has a Stored XSS Issue","HIGH",8.7,"2026-10-01",0],["CVE-2026-102668","Joyland","Joyland.ai","Joyland AI accepts TLS certificates without validation","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-102667","Joyland","Joyland.ai","Joyland AI WebView command injection","CRITICAL",9,"2026-10-01",0],["CVE-2026-82358","RT-Labs AB","C-Open","RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass","HIGH",7.1,"2026-10-01",0],["CVE-2026-102666","Joyland","Joyland.ai","Joyland AI hard-coded credentials for push notifications","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-82357","RT-Labs AB","C-Open","RT-Labs AB C-Open CANopen NULL pointer dereference","HIGH",7.1,"2026-10-01",0],["CVE-2026-71542","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Stored Cross-Site Scripting (XSS) via the \"title\" parameter in admin/compon","HIGH",8.7,"2026-10-01",0],["CVE-2026-71426","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page \"template\" field","HIGH",7.1,"2026-10-01",0],["CVE-2026-70650","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output deco","HIGH",8.8,"2026-10-01",0],["CVE-2026-56662","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side","CRITICAL",9.6,"2026-10-01",0],["CVE-2026-56661","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint","HIGH",7.5,"2026-10-01",0],["CVE-2026-56660","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-53953","GetSimpleCMS-CE","GetSimpleCMS-CE","GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-104286","Fortinet","FortiMail","An improper limitation of a pathname to a restricted directory ('path traversal') vulnerab","CRITICAL",9.8,"2026-10-01",1],["CVE-2026-27872","Johnson Controls","Easy IO FG","EasyIO FG","MEDIUM",5.6,"2026-10-01",0],["CVE-2026-84682","TP-Link Systems Inc.","Archer AX90 v1","TDDPv2 setProductVer Command Injection in Archer AX90","HIGH",7.7,"2026-10-01",0],["CVE-2026-55232","givanz","Vvveb","Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEm","HIGH",7.6,"2026-10-01",0],["CVE-2026-55230","givanz","Vvveb","Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than ch","HIGH",8.7,"2026-10-01",0],["CVE-2026-55231","givanz","Vvveb","Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read a","HIGH",7.2,"2026-10-01",0],["CVE-2026-15911","confluent","confluent-kafka","Confluent Kafka Python Improper TLS Certificate Validation","HIGH",7.4,"2026-10-01",0],["CVE-2026-104059","lektor","lektor","Lektor 3.3.14 CSRF via Admin API Endpoints","HIGH",7,"2026-10-01",0],["CVE-2026-8618","TP-Link Systems Inc.","Deco M9 Plus V2","Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x9","HIGH",7.7,"2026-10-01",0],["CVE-2026-104058","akhilrex","podgrab","Podgrab Missing Authentication on WebSocket /ws Endpoint","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-104057","akhilrex","podgrab","Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler","HIGH",8.7,"2026-10-01",0],["CVE-2026-104056","Authlib","Authlib","CVE-2026-104056","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-55083","dhis2","dhis2-core","DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-102369","TP-Link Systems Inc.","Tapo C200 v5","Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 &","HIGH",8.7,"2026-10-01",0],["CVE-2026-78578","TP-Link Systems Inc.","Tapo C200 v5","Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Servic","HIGH",7.1,"2026-10-01",0],["CVE-2026-78577","TP-Link Systems Inc.","Tapo C200 v5","Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-9032","TP-Link Systems Inc.","Tapo C200 V5","Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit","HIGH",7.1,"2026-10-01",0],["CVE-2026-103923","KaTeX","KaTeX","KaTeX: Existing prototype pollution can bypass trust restrictions","LOW",2.1,"2026-10-01",0],["CVE-2026-68496","FasterXML","jackson-dataformats-binary","jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLen","HIGH",7.5,"2026-10-01",0],["CVE-2026-68495","FasterXML","jackson-dataformats-binary","jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLeng","HIGH",7.5,"2026-10-01",0],["CVE-2026-104018","Wind River Systems Inc","VxWorks 7","VxWorks 7 improper privilege management","HIGH",8.8,"2026-10-01",0],["CVE-2026-97662","AWS","security-agent-mcp-server","Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbi","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-102294","TP-Link System Inc.","TL-WR841N v14","Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration","HIGH",8.5,"2026-10-01",0],["CVE-2026-103922","ionic-team","capacitor","Capacitor Android and iOS: remote content can be loaded at the app origin via the internal","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-103884","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allow","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-56098","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Rubygem-katello: improper authorization logic allows resource enumeration","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-56097","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Rubygem-katello: sql injection in registry proxy via labels","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-12542","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: command injection in foreman-tail","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-12545","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Rubygem-hammer_cli: command injection via insecure editor invocation","MEDIUM",6.7,"2026-10-01",0],["CVE-2023-54404","colinhacks","zod","Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation","HIGH",8.2,"2026-10-01",0],["CVE-2026-73976","4TUResearchData","djehuty","djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)","HIGH",7.1,"2026-10-01",0],["CVE-2026-21833","HCL Software","AION","HCL AION is susceptible to a Missing \"Content-Security-Policy\" header Vulnerability (CVE-2","LOW",3.7,"2026-10-01",0],["CVE-2026-73975","4TUResearchData","djehuty","djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF tr","HIGH",8.4,"2026-10-01",0],["CVE-2026-77387","geopy","geopy","geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point","MEDIUM",4,"2026-10-01",0],["CVE-2026-103921","ardatan","graphql-tools","GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor","HIGH",7.4,"2026-10-01",0],["CVE-2026-96658","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: foreman: arbitrary code execution via safemode sandbox bypass","HIGH",8.8,"2026-10-01",0],["CVE-2026-96659","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: excessive permissions for viewer role on preview","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-12544","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: ssti and insecure deserialization in foreman-rake configuration","HIGH",7.7,"2026-10-01",0],["CVE-2026-12541","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: command injection in foreman-rake database tasks","HIGH",8.2,"2026-10-01",0],["CVE-2026-101890","Codexonics","Prime Mover","Prime Mover < 2.2.1 Stored XSS via Package Metadata","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-12540","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter","HIGH",8.2,"2026-10-01",0],["CVE-2026-12423","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Foreman: unauthenticated information disclosure via provisioning token validation flaw","HIGH",7.5,"2026-10-01",0],["CVE-2026-12405","Red Hat","Red Hat Satellite 6.16 for RHEL 8","Rubygem-foreman_remote_execution: command injection in job invocations via effective_user ","HIGH",8.8,"2026-10-01",0],["CVE-2026-101889","Codexonics","Prime Mover","Prime Mover < 2.2.1 Path Traversal via wprime-config.json","HIGH",7,"2026-10-01",0],["CVE-2026-63686","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_xml2enc crash on charset conversion failure","HIGH",7.5,"2026-10-01",0],["CVE-2026-101888","Codexonics","Prime Mover","Prime Mover < 2.2.1 Zip Slip Path Traversal File Write","HIGH",8.6,"2026-10-01",0],["CVE-2026-93546","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_dav_fs namespace overflow","HIGH",8.8,"2026-10-01",0],["CVE-2026-79768","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_userdir information disclosure","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-73637","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_auth_digest DoS attack","HIGH",7.3,"2026-10-01",0],["CVE-2026-73636","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_auth_digest one-time-nonce replay attack","HIGH",8.1,"2026-10-01",0],["CVE-2025-31980","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-63718","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling","HIGH",7.5,"2026-10-01",0],["CVE-2026-14316","Fortra","Core Privileged Access Manager (BoKS)","Heap buffer overflow in boks_sshd revoked-key error handling","HIGH",8.1,"2026-10-01",0],["CVE-2026-67172","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","LOW",3.7,"2026-10-01",0],["CVE-2026-67171","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-63292","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_vhost_alias stack overflow","HIGH",7.5,"2026-10-01",0],["CVE-2026-63045","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_proxy_ftp PASV address handling","HIGH",7.5,"2026-10-01",0],["CVE-2026-59797","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-59685","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on C","HIGH",7.5,"2026-10-01",0],["CVE-2026-13043","WatchGuard","Endpoint Security","WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows ","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-58415","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_dav_fs property database read access","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-57941","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-ent","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-56449","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_proxy_html: crash in dump_content","HIGH",7.5,"2026-10-01",0],["CVE-2026-56154","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-56153","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char","HIGH",7.5,"2026-10-01",0],["CVE-2026-48005","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_auth_digest reauthentication attack","HIGH",7.5,"2026-10-01",0],["CVE-2026-47360","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_session: Session cookie not removed during internal redirect","HIGH",7.5,"2026-10-01",0],["CVE-2026-101322","Eclipse Foundation","Eclipse BaSyx AAS Web UI","In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shar","HIGH",8.3,"2026-10-01",0],["CVE-2026-9864","Fortra","Core Privileged Access Manager (BoKS)","Fortra BoKS Server Agent adjoin machine-account password generation vulnerability","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-103690","itsourcecode","Leave Management System","itsourcecode Leave Management System controller.php sql injection","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-46729","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_heartmonitor denial of service","HIGH",7.5,"2026-10-01",0],["CVE-2026-42356","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI direct","LOW",3.7,"2026-10-01",0],["CVE-2026-42528","Apache Software Foundation","Apache HTTP Server","Apache HTTP Server: mod_dav shared lock overflow","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-94620","foundation50","classroom50","Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink i","CRITICAL",9.4,"2026-10-01",0],["CVE-2026-103505","AWS","aws-efs-csi-driver","AWS EFS CSI Driver Mount Option Injection via mounttargetipmap","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-12627","Fortra","Fortra's Core Privileged Access Manager (BoKS)","Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vuln","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-79896","Fortra","BoKS Manager","Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability","HIGH",7.5,"2026-10-01",0],["CVE-2026-17053","zephyrproject","zephyr","SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads m","MEDIUM",4.4,"2026-10-01",0],["CVE-2026-67106","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-56599","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","LOW",2.2,"2026-10-01",0],["CVE-2026-67104","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-67105","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","HIGH",7.4,"2026-10-01",0],["CVE-2026-79898","Fortra","BoKS Manager","Fortra BoKS Manager crlserver command injection vulnerability","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-56589","HCL Software","HCL BigFix Service Management","HCL BigFix Service Management is affected by multiple security vulnerabilities.","HIGH",7.2,"2026-10-01",0],["CVE-2026-97280","Mamunur Rashid","Review Schema","WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103004","vercel","next.js","next.js cache leak on warm `use cache` handlers accessing root param","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-79899","Fortra","BoKS Manager","Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability","HIGH",7.9,"2026-10-01",0],["CVE-2026-103068","ByteCore Stack","ByteCoreStack &#8211; MCP Connector for AI Tools","WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalatio","HIGH",8.8,"2026-10-01",0],["CVE-2026-103347","hcaptcha","hCaptcha for WP","WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-102378","bPlugins","Parallax Section block","WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilit","HIGH",7.1,"2026-10-01",0],["CVE-2026-100517","VillaTheme","Photo Reviews for WooCommerce","WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object Referenc","HIGH",7.5,"2026-10-01",0],["CVE-2026-100514","Pete Nelson","REST API Log","WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerab","HIGH",7.5,"2026-10-01",0],["CVE-2026-97284","Icegram","Icegram","WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability","HIGH",8.8,"2026-10-01",0],["CVE-2026-97297","Apps Mav","Gratisfaction","WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability","HIGH",7.6,"2026-10-01",0],["CVE-2026-97281","weDevs","WP Project Manager","WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-97277","Apps Mav","Social Boost","WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability","HIGH",7.6,"2026-10-01",0],["CVE-2026-97273","Premmerce","Premmerce Wishlist for WooCommerce","WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS)","HIGH",7.1,"2026-10-01",0],["CVE-2026-97269","WPFunnels","WPFunnels","WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerabil","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-97268","Premmerce","Premmerce Wishlist for WooCommerce","WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS)","HIGH",7.1,"2026-10-01",0],["CVE-2026-97258","Aruba.it","Aruba Migration Tool","WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-97260","maxfoundry","MaxGalleria","WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-10-01",0],["CVE-2026-97251","magepeopleteam","Bus Ticket Booking with Seat Reservation","WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Objec","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-95588","AcyMailing Newsletter Team","AcyMailing SMTP Newsletter","WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerabil","HIGH",8.6,"2026-10-01",0],["CVE-2026-62073","Themeisle","WP Full Stripe Free","WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability","HIGH",7.5,"2026-10-01",0],["CVE-2026-94390","Dotstore","Hide Shipping Method For WooCommerce","WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vuln","HIGH",7.2,"2026-10-01",0],["CVE-2026-62071","nickboss","WordPress File Upload","WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-103752","Paul Ryan","Authorizer","WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-103687","rhukster","dom-sanitizer","rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist","MEDIUM",6.9,"2026-10-01",0],["CVE-2024-58388","Sharp Corporation","Multiple Multifunction Printers","Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html","HIGH",8.7,"2026-10-01",0],["CVE-2026-79900","Fortra","BoKS Manager boks-server","Heap overflow in KSL checksum initialization","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-79901","Fortra","BoKS Manager boks-server","Predictable Active Directory service-account passwords in BoKS Manager","CRITICAL",9.9,"2026-10-01",0],["CVE-2026-103686","rhukster","dom-sanitizer","rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-66253","HCL Software","iControl","HCL iControl is affected by a Session Timeout vulnerability","LOW",3.1,"2026-10-01",0],["CVE-2026-66249","HCL Software","iControl","HCL iControl is affected by a Missing Secure Attribute vulnerability","LOW",3.1,"2026-10-01",0],["CVE-2026-66248","HCL Software","iControl","HCL iControl is affected by an Improper Error Handling vulnerability","LOW",3.1,"2026-10-01",0],["CVE-2026-66247","HCL Software","iControl","iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerabil","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-66246","HCL Software","iControl","HCL iControl is affected by multiple security vulnerabilities","HIGH",8.8,"2026-10-01",0],["CVE-2026-102505","","Imager","Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-102504","","Imager","Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-","HIGH",7.5,"2026-10-01",0],["CVE-2026-62058","WPExperts","CF7 Apps","WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-62059","Ultimate Member","Ultimate Member","WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability","HIGH",7.6,"2026-10-01",0],["CVE-2026-62060","captivateaudio","Captivate Sync","WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability","HIGH",7.6,"2026-10-01",0],["CVE-2026-62061","Metagauss","ProfileGrid","WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnera","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-62063","Magepeople inc.","WpTravelly","WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-102394","WPDeveloper","Essential Addons for Elementor","WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vuln","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103339","Wpmet","Metform","WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-102379","VillaTheme","BuildKit – Product Builder for WooCommerce – Custom PC Builder","WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 ","HIGH",8.5,"2026-10-01",0],["CVE-2026-103063","Wpmet","ElementsKit Elementor addons Lite","WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) v","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103345","Shamim Rajani","Pie Register","WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103064","Wpmet","ElementsKit Elementor addons Lite","WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) v","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-102390","VillaTheme","AFFI – Affiliate Marketing for WooCommerce","WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Contr","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-102382","Ahmad","Majestic Support","WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vuln","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-102381","Ahmad","Majestic Support","WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103343","WP ManageNinja LLC","FluentForm","WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103341","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103340","Gemini Labs","Site Reviews","WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103338","Unlimited Elements","Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0","HIGH",8.5,"2026-10-01",0],["CVE-2026-103067","Memberful","Memberful - Membership Plugin","WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSR","HIGH",8,"2026-10-01",0],["CVE-2026-103754","Red Hat","Red Hat Ansible Automation Platform 2","Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows","MEDIUM",5.9,"2026-10-01",0],["CVE-2026-103336","Smackcoders Inc.","WP Ultimate CSV Importer","WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103680","","tnef","Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation","LOW",3.1,"2026-10-01",0],["CVE-2026-103679","","tnef","Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103678","","tnef","Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-103858","MISP","MISP","MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussio","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-94276","Apache Software Foundation","Apache APISIX","Apache APISIX: Openid-connect introspection validation issue","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-94269","Apache Software Foundation","Apache APISIX","Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-94250","Apache Software Foundation","Apache APISIX","Apache APISIX: Batch response aggregation can exhaust worker memory","HIGH",8.2,"2026-10-01",0],["CVE-2026-94220","Apache Software Foundation","Apache APISIX","Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin","LOW",2.1,"2026-10-01",0],["CVE-2026-94212","Apache Software Foundation","Apache APISIX","Apache APISIX: unauthenticated impersonation issue in saml-auth","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-82806","Apache Software Foundation","Apache APISIX","Apache APISIX: cross-request permission pollution via static permission list mutation","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-78242","Apache Software Foundation","Apache APISIX","Apache APISIX: data-mask may fail to redact request headers in logger output","MEDIUM",5.7,"2026-10-01",0],["CVE-2026-88789","Apache Software Foundation","Apache Camel Quarkus","Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream extern","HIGH",8.6,"2026-10-01",0],["CVE-2026-103353","WP ManageNinja LLC","FluentForm","WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103758","obot-platform","obot","Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route","HIGH",8.6,"2026-10-01",0],["CVE-2026-103292","TryGhost","Ghost","Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head","HIGH",8.6,"2026-10-01",0],["CVE-2026-103757","Budibase","budibase","Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation","HIGH",8.3,"2026-10-01",0],["CVE-2026-103291","TryGhost","Ghost","Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103289","TryGhost","Ghost","Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments","HIGH",7.1,"2026-10-01",0],["CVE-2026-103290","TryGhost","Ghost","Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103288","TryGhost","Ghost","Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like","HIGH",7.1,"2026-10-01",0],["CVE-2026-103286","TryGhost","Ghost","Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications","HIGH",8.5,"2026-10-01",0],["CVE-2026-103287","TryGhost","Ghost","Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103285","TryGhost","Ghost","Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103284","TryGhost","Ghost","Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103282","TryGhost","Ghost","Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103283","TryGhost","Ghost","Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling","HIGH",8.6,"2026-10-01",0],["CVE-2026-103281","TryGhost","Ghost","Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103279","TryGhost","Ghost","Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass","HIGH",7.6,"2026-10-01",0],["CVE-2026-103280","TryGhost","Ghost","Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103278","TryGhost","Ghost","Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe","HIGH",8.5,"2026-10-01",0],["CVE-2026-103277","TryGhost","Ghost","Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed","HIGH",8.6,"2026-10-01",0],["CVE-2026-103275","TryGhost","Ghost","Ghost 5.42.2 before 6.58.0 Password Hash Disclosure","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103276","TryGhost","Ghost","Ghost before 6.20.0 File Read via URL Encoding Bypass","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103274","TryGhost","Ghost","Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103272","TryGhost","Ghost","Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API","HIGH",8.7,"2026-10-01",0],["CVE-2026-103273","TryGhost","Ghost","Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103271","TryGhost","Ghost","Ghost 4.0.0 before 6.63.0 Restricted Content Bypass","HIGH",8.7,"2026-10-01",0],["CVE-2026-103268","TryGhost","Ghost","Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset","HIGH",8.7,"2026-10-01",0],["CVE-2026-103269","TryGhost","Ghost","Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103267","TryGhost","Ghost","Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103266","TryGhost","Ghost","Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification","HIGH",7.1,"2026-10-01",0],["CVE-2026-103264","fleetdm","fleet","Fleet before 4.87.0 Authentication Bypass via Device Identifiers","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-103265","fleetdm","fleet","Fleet before 4.89.0 Information Disclosure via MDM Command Results","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103263","tornadoweb","tornado","Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink","HIGH",8.2,"2026-10-01",0],["CVE-2026-103261","tornadoweb","tornado","Tornado before 6.5.9 Denial of Service via Query String","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103262","tornadoweb","tornado","Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient","HIGH",8.7,"2026-10-01",0],["CVE-2026-103260","n8n-io","n8n","n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node","MEDIUM",6.3,"2026-10-01",0],["CVE-2026-103258","n8n-io","n8n","n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103259","n8n-io","n8n","n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials","HIGH",8.5,"2026-10-01",0],["CVE-2026-103257","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node","HIGH",8.1,"2026-10-01",0],["CVE-2026-103255","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase","HIGH",7.1,"2026-10-01",0],["CVE-2026-103256","n8n-io","n8n","n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook","HIGH",7.1,"2026-10-01",0],["CVE-2026-103254","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation","HIGH",7,"2026-10-01",0],["CVE-2026-103253","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table","HIGH",7,"2026-10-01",0],["CVE-2026-103251","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub","HIGH",7.5,"2026-10-01",0],["CVE-2026-103252","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoin","HIGH",7.1,"2026-10-01",0],["CVE-2026-103250","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory","HIGH",7,"2026-10-01",0],["CVE-2026-103248","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase","HIGH",7.1,"2026-10-01",0],["CVE-2026-103249","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103247","n8n-io","n8n","n8n before 1.123.80 Credential Tampering via Duplicate Node IDs","MEDIUM",5.8,"2026-10-01",0],["CVE-2026-103246","n8n-io","n8n","n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspecti","HIGH",8.3,"2026-10-01",0],["CVE-2026-103245","n8n-io","n8n","n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103244","sgoudelis","ground-station","ground-station before 0.8.0 Authentication Bypass via setup.restore","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-103082","LA-Studio","LA-Studio Element Kit for Elementor","WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forger","HIGH",7.2,"2026-10-01",0],["CVE-2026-7176","Crocantickets","Entradium","Multiple vulnerabilities in Entradium by Crocantickets","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-7175","Crocantickets","Entradium","Multiple vulnerabilities in Entradium by Crocantickets","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-7174","Crocantickets","Entradium","Multiple vulnerabilities in Entradium by Crocantickets","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-7173","Crocantickets","Entradium","Multiple vulnerabilities in Entradium by Crocantickets","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-75786","Pandora FMS","Pandora FMS","SQL Injection in Grafana Integration Endpoint (query.php)","HIGH",7.2,"2026-10-01",0],["CVE-2026-64950","Pandora FMS","Pandora FMS","Stored Cross-Site Scripting via Directory Name in File Manager Create Directory","HIGH",8.4,"2026-10-01",0],["CVE-2026-64949","Pandora FMS","Pandora FMS","Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager","HIGH",8.6,"2026-10-01",0],["CVE-2026-64948","Pandora FMS","Pandora FMS","Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Di","HIGH",7.1,"2026-10-01",0],["CVE-2026-64947","Pandora FMS","Pandora FMS","CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File M","HIGH",7.5,"2026-10-01",0],["CVE-2026-92144","wpmudev","Forminator Forms – Contact Form, Payment Form & Custom Form Builder","Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[p","HIGH",7.2,"2026-10-01",0],["CVE-2026-96256","wpdevteam","Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns","Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scrip","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-64946","Pandora FMS","Pandora FMS","CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Man","HIGH",7.4,"2026-10-01",0],["CVE-2026-34190","Pandora FMS","Pandora FMS","CSRF in Alert Command Deletion","MEDIUM",5.9,"2026-10-01",0],["CVE-2026-34189","Pandora FMS","Pandora FMS","CSRF in Event Response Deletion","MEDIUM",5.9,"2026-10-01",0],["CVE-2026-96577","Red Hat","Red Hat OpenShift Container Platform 4.18","Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a","HIGH",7.1,"2026-10-01",0],["CVE-2026-83589","Red Hat","Red Hat OpenShift Container Platform 4.14","Oauth-proxy: open redirect via /\\ and /\\t bypass in post-login redirect","MEDIUM",6.1,"2026-10-01",0],["CVE-2026-103496","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other user","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-103497","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration","MEDIUM",5.5,"2026-10-01",0],["CVE-2026-103493","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was pos","HIGH",8.1,"2026-10-01",0],["CVE-2026-103494","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group","MEDIUM",6.6,"2026-10-01",0],["CVE-2026-103495","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of trans","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-103492","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachme","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103490","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group","HIGH",7.2,"2026-10-01",0],["CVE-2026-103491","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103488","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated user","HIGH",7.1,"2026-10-01",0],["CVE-2026-103489","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notificati","LOW",2,"2026-10-01",0],["CVE-2026-103664","MISP","MISP","MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter","MEDIUM",4.8,"2026-10-01",0],["CVE-2026-103662","MISP","MISP","MISP Reflected XSS in Taxonomy Tag Confirmation Forms","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103431","","collectl","Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data ","HIGH",7.7,"2026-10-01",0],["CVE-2026-103659","MISP","MISP","MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attrib","HIGH",7.1,"2026-10-01",0],["CVE-2026-89424","inisev","Duplicate Post","Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'not","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-89427","spacetime","Ad Inserter – Ad Manager & AdSense Ads","Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter","MEDIUM",6.1,"2026-10-01",0],["CVE-2026-97661","scottpaterson","Business Essentials for Contact Form 7","Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Script","HIGH",7.2,"2026-10-01",0],["CVE-2026-100184","codepeople","Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More","Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Q","MEDIUM",4.7,"2026-10-01",0],["CVE-2026-96268","awesomesupport","Awesome Support – WordPress HelpDesk & Support Plugin","Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gd","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-96813","10web","Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder","Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on M","HIGH",7.2,"2026-10-01",0],["CVE-2026-101925","robin-w","bbp style pack","bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Auth","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-95687","wpclever","WPC Shop as a Customer for WooCommerce","WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Es","HIGH",8.8,"2026-10-01",0],["CVE-2026-85235","wpmudev","Forminator Forms – Contact Form, Payment Form & Custom Form Builder","Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Tex","HIGH",7.2,"2026-10-01",0],["CVE-2026-96573","codepeople","Appointment Hour Booking – Booking Calendar","Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting","HIGH",7.2,"2026-10-01",0],["CVE-2026-15983","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via","HIGH",8.1,"2026-10-01",0],["CVE-2026-90992","davidanderson","Redux Framework","Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'u","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-92244","wpovernight","PDF Invoices & Packing Slips for WooCommerce","PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site","HIGH",7.2,"2026-10-01",0],["CVE-2026-100179","codepeople","Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More","Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL P","MEDIUM",6.1,"2026-10-01",0],["CVE-2026-14995","optimizingmatters","Autoptimize","Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path","HIGH",7.2,"2026-10-01",0],["CVE-2026-103655","MISP","MISP","MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-78249","Fujifilm Business Innovation Corp.","Apeos 3060 / 2560 / 1860 Japan model","A path traversal vulnerability exists in the web management interface of multiple Multifun","MEDIUM",6.8,"2026-10-01",0],["CVE-2026-19807","bytecorestack","ByteCoreStack – MCP Connector for AI Tools","ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_us","HIGH",8.8,"2026-10-01",0],["CVE-2026-15989","WebRehab","Super Forms – Drag & Drop Form Builder","Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-19902","spacetime","Ad Inserter – Ad Manager & AdSense Ads","Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Ref","MEDIUM",6.1,"2026-10-01",0],["CVE-2026-75957","superdav42","Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform","Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' P","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-89047","inisev","Social Media Share Buttons & Social Sharing Icons","Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Sit","MEDIUM",6.1,"2026-10-01",0],["CVE-2026-93882","thimpress","LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Inform","HIGH",7.5,"2026-10-01",0],["CVE-2026-103651","MISP","MISP","MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authenticatio","HIGH",7.6,"2026-10-01",0],["CVE-2025-41753","WAGO","0751-9x01","Path traversal in dynamically created BACnet File Objects","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-103544","datadrivenconstruction","OpenConstructionERP","datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong se","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-90972","","WP Fusion Lite","WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deleti","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-90974","","WP Fusion Lite","WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-92412","","Five Star Restaurant Reviews","Five Star Restaurant Reviews < 2.3.14 - Reflected XSS","HIGH",7.1,"2026-10-01",0],["CVE-2026-96173","","Payments for Hubtel","Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-96200","","Payments for Hubtel","Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Pay","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-96255","","Payments for Hubtel","Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via D","HIGH",7.5,"2026-10-01",0],["CVE-2026-81809","","Paytm Payment Gateway","Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback","HIGH",7.5,"2026-10-01",0],["CVE-2026-86610","","Download Manager","Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon","MEDIUM",6.4,"2026-10-01",0],["CVE-2026-87970","","If-So Dynamic Content","If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes","MEDIUM",4.7,"2026-10-01",0],["CVE-2026-87973","","If-So Dynamic Content","If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name","LOW",3.1,"2026-10-01",0],["CVE-2026-89296","","Pro Like Button","Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter","HIGH",8.6,"2026-10-01",0],["CVE-2026-101147","","Featured Image from URL (FIFU)","Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF","HIGH",8.8,"2026-10-01",0],["CVE-2026-101148","","BackupSheep WordPress Backup Plugin","BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via E","CRITICAL",10,"2026-10-01",0],["CVE-2026-19253","","Cache Enabler","Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_e","HIGH",8.7,"2026-10-01",0],["CVE-2026-81739","","Paytm Payment Gateway","Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback","HIGH",7.5,"2026-10-01",0],["CVE-2026-103543","itsourcecode","Leave Management System","itsourcecode Leave Management System controller.php sql injection","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-80275","Comelit Group S.p.A.","1456B Multi-User Gateway","Comelit 1456B gateway allows low priviledge user to overwrite installer password via unaut","HIGH",8.8,"2026-10-01",0],["CVE-2026-80276","Comelit Group S.p.A.","1456B Multi-User Gateway","Comelit 1456B gateway exposes remote configuration password via unauthenticated management","HIGH",7.5,"2026-10-01",0],["CVE-2026-103542","formtools.org","Form Tools","formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-85679","extendify","Extendify","Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block","HIGH",7.2,"2026-10-01",0],["CVE-2026-88999","davidanderson","Redux Framework","Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-103541","formtools.org","Form Tools","formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-67075","HCLSoftware","Digital Experience","HCL Digital Experience is affected by improper input sanitation","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-103540","formtools.org","Form Tools","formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103539","ZongXR","SuperMarket","ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-82824","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","Path traversal may allow arbitrary files to be viewed, created, modified, or deleted","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-82825","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","Missing proper authentication for critical APIs may allow sensitive information to be obta","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-82826","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","Authentication information or sensitive data may be intercepted in transit","HIGH",8.7,"2026-10-01",0],["CVE-2026-82827","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","A hard-coded JWT signing secret key may allow administrative functions to be abused using ","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-82828","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","Improper authorization may allow a general user to perform operations equivalent to those ","HIGH",8.7,"2026-10-01",0],["CVE-2026-82829","Hitachi Industrial Equipment Systems","Hitachi Coding Software Suite","Hidden accounts or hard-coded credentials may permit unauthorized access without the legit","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-76146","Genians, Inc","Genian SSL PNS (xenics_auther)","Genians, Inc Genian SSL PNS OS Command Injection","HIGH",8.4,"2026-10-01",0],["CVE-2026-76147","Genians, Inc","Genian NAC 4.0.175 Release","Genians, Inc Genian NAC/ZTNA Remote Code Execution","MEDIUM",5.9,"2026-10-01",0],["CVE-2026-76145","Genians, Inc","Genian SSL PNS (frodo-core)","Genians, Inc Genian SSL PNS Improper Privilege Management","HIGH",7.5,"2026-10-01",0],["CVE-2026-76144","Genians, Inc","Genian SSL PNS (frodo-core)","Genians, Inc Genian SSL PNS Unrestricted File Upload","LOW",1.8,"2026-10-01",0],["CVE-2026-76143","Genians, Inc","Genian SSL PNS (frodo-core)","Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass","HIGH",7.3,"2026-10-01",0],["CVE-2026-76142","Genians, Inc","Genian NAC 5.0.75 LTS Release","Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface","CRITICAL",9.3,"2026-10-01",0],["CVE-2026-78210","Octopus Deploy","Octopus Server","In affected versions of Octopus Server, users with certain scoped permission sets could ex","HIGH",7.1,"2026-10-01",0],["CVE-2026-103538","ZongXR","SuperMarket","ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrde","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-92966","latepoint","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via Fi","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-12241","mihail-barinov","Advanced Woo Labels – Product Labels & Badges for WooCommerce","Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authoriza","MEDIUM",5.4,"2026-10-01",0],["CVE-2026-92548","hcabrera","WP Popular Posts","WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'con","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-103536","ZongXR","Supermarket","ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing aut","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103641","Red Hat","Red Hat Enterprise Linux 10","Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder","MEDIUM",5.5,"2026-10-01",0],["CVE-2026-103534","David-Crty","databasement","David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-91109","croixhaug","Simply Schedule Appointments","Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authentica","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-96561","tigroumeow","AI Engine – The Chatbot, AI Framework & MCP for WordPress","AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → ","HIGH",7.2,"2026-10-01",0],["CVE-2026-92245","croixhaug","Simply Schedule Appointments","Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensi","HIGH",7.5,"2026-10-01",0],["CVE-2026-103533","David-Crty","databasement","David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversa","LOW",2.1,"2026-10-01",0],["CVE-2026-101887","arkq","bluez-alsa","BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS","LOW",2.1,"2026-10-01",0],["CVE-2026-92537","satollo","Newsletter – Send awesome emails from WordPress","Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' C","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-13313","ASUS","Router","An Active Debug Code vulnerability in certain ASUS router models allows a remote authentic","HIGH",8.9,"2026-10-01",0],["CVE-2026-14157","ASUS","Router","Use of an Externally Controlled Format String in the ASUS Router modules allow a remote au","CRITICAL",9.4,"2026-10-01",0],["CVE-2026-93495","ASUS","Motherboard(PRIME Z390-A )","Improper initialization in an ASUS certain motherboard allows an physically proximate user","HIGH",7,"2026-10-01",0],["CVE-2026-103532","immich-app","Immich","immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorizati","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103531","","OpenSC","OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-51873","","","Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project functio","HIGH",8.8,"2026-10-01",0],["CVE-2026-51874","","","In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal ","HIGH",7.5,"2026-10-01",0],["CVE-2026-51875","","","In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal ","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-51876","","","DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation fl","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-51878","","","deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifi","MEDIUM",4.3,"2026-10-01",0],["CVE-2026-51879","","","deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifi","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-51880","","","deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live ","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-51881","","","deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot Web","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-51882","","","The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vuln","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-51883","","","The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3","CRITICAL",9.1,"2026-10-01",0],["CVE-2026-51884","","","The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatc","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-51886","","","langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitra","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-51888","","","langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary ","HIGH",7.5,"2026-10-01",0],["CVE-2026-51892","","","infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-51893","","","infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An ","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-51894","","","infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A rea","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-51895","","","Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-51896","","","infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_a","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-51897","","","RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). ","CRITICAL",9.8,"2026-10-01",0],["CVE-2026-103530","decolua","9Router","decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103592","pecee","simple-router","simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers","MEDIUM",6.9,"2026-10-01",0],["CVE-2026-103590","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Length of Stay Fields","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103591","AsyncFuncAI","deepwiki-open","DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file","HIGH",8.7,"2026-10-01",0],["CVE-2026-103589","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Room Type Editor","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103588","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via exceptions field","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103587","Webkul","QloApps","QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters","MEDIUM",5.1,"2026-10-01",0],["CVE-2026-103585","The Wikimedia Foundation","MediaWiki MediaSearch extension","attacker-controlled javascript license URL via XSS","LOW",1.2,"2026-10-01",0],["CVE-2026-103584","The Wikimedia Foundation","MediaWiki CommonsMetadata extension","attacker-controlled javascript license URL via XSS","LOW",1.1,"2026-10-01",0],["CVE-2026-47096","AJA Video Systems","HELO Plus","AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter","MEDIUM",5.3,"2026-10-01",0],["CVE-2026-101283","esnet","iperf3","iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(","CRITICAL",9.2,"2026-10-01",0],["CVE-2026-103001","jpadilla","pyjwt","PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypa","MEDIUM",6.5,"2026-10-01",0],["CVE-2026-101276","esnet","iperf3","iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the serv","CRITICAL",9.2,"2026-10-01",0],["CVE-2026-92172","Meta Platforms, Inc","Meta Horizon OS","Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a pr","HIGH",8.8,"2026-09-30",0],["CVE-2026-92173","Meta Platforms, Inc","Meta Horizon OS","Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to sen","CRITICAL",9.1,"2026-09-30",0],["CVE-2023-54403","Yonyou","U8 CRM","Yonyou U8 CRM Arbitrary File Read via getemaildata.php","HIGH",8.7,"2026-09-30",0],["CVE-2026-102105","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway server-side request forgery","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102106","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway improper authentication","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102107","Kiteworks","Core","Kiteworks Core user impersonation in a file-request feature","MEDIUM",4.6,"2026-09-30",0],["CVE-2024-58387","Inspur","Haiyue HCM Cloud","Inspur HCM Cloud Arbitrary File Read via file/download Endpoint","HIGH",8.7,"2026-09-30",0],["CVE-2026-102108","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway deserialization of untrusted data","HIGH",7.2,"2026-09-30",0],["CVE-2026-102109","Kiteworks","Secure Data Forms","Kiteworks Secure Data Forms SQL injection","HIGH",7.1,"2026-09-30",0],["CVE-2023-54402","iDocView","iDocView","iDocView SSRF via /doc/upload Endpoint Hardcoded Token","HIGH",8.7,"2026-09-30",0],["CVE-2026-102110","Kiteworks","Core","Missing authentication on a Kiteworks appliance setup function","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-102111","Kiteworks","Core","Kiteworks Core Improper Validation of Specified Quantity in Input","MEDIUM",4.9,"2026-09-30",0],["CVE-2026-102112","Kiteworks","Core","Kiteworks Core Local Privilege Escalation","HIGH",7.8,"2026-09-30",0],["CVE-2026-102113","Kiteworks","Core","Kiteworks Core Local Privilege Escalation","HIGH",7.8,"2026-09-30",0],["CVE-2026-102114","Kiteworks","Core","Kiteworks Core OS Command Injection","HIGH",7.2,"2026-09-30",0],["CVE-2026-102115","Kiteworks","Core","Kiteworks Core Authentication Bypass in the Password Reset Workflow","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-102116","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Path Traversal","HIGH",7.2,"2026-09-30",0],["CVE-2026-102117","Kiteworks","Core","Kiteworks Core Remote Code Execution","HIGH",7.2,"2026-09-30",0],["CVE-2026-102118","Kiteworks","Core","Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation","HIGH",7.8,"2026-09-30",0],["CVE-2026-102119","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Path Traversal","HIGH",7.2,"2026-09-30",0],["CVE-2026-102120","Kiteworks","Core","Kiteworks Core OS Command Injection","HIGH",8.8,"2026-09-30",0],["CVE-2026-102121","Kiteworks","Secure Data Forms","Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor","HIGH",8.6,"2026-09-30",0],["CVE-2026-102104","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway server-side request forgery","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102122","Kiteworks","Core","Kiteworks Core Incorrect Authorization","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102123","Kiteworks","Core","Kiteworks Core Path Traversal","HIGH",7.4,"2026-09-30",0],["CVE-2026-102103","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway server-side request forgery","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102124","Kiteworks","Core","Kiteworks Core Missing Authentication for Critical Function","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102125","Kiteworks","Core","Kiteworks Core Sandbox Escape","HIGH",8.8,"2026-09-30",0],["CVE-2026-102126","Kiteworks","Core","Kiteworks Core Stored Cross-site Scripting (XSS)","HIGH",8.1,"2026-09-30",0],["CVE-2026-102127","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference","HIGH",7,"2026-09-30",0],["CVE-2026-102128","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Improper Authentication","HIGH",7.5,"2026-09-30",0],["CVE-2026-102129","Kiteworks","Core","Kiteworks Core Incorrect Privilege Assignment","HIGH",7.2,"2026-09-30",0],["CVE-2026-102130","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Remote Code Execution","HIGH",7.2,"2026-09-30",0],["CVE-2026-102131","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity","HIGH",7.2,"2026-09-30",0],["CVE-2026-102132","Kiteworks","Core","Kiteworks Core Privilege Escalation through Improper Access Control","HIGH",7.2,"2026-09-30",0],["CVE-2026-102133","Kiteworks","Core","Kiteworks Core Arbitrary File Write through Command Injection","MEDIUM",6.6,"2026-09-30",0],["CVE-2026-103000","py-pdf","pypdf","pypdf: Possible large memory usage when retrieving alphabetical page labels","HIGH",8.7,"2026-09-30",0],["CVE-2026-102102","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway server-side request forgery","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102134","Kiteworks","Core","Kiteworks Core Unprotected Alternate Channel","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-102135","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Deserialization of Untrusted Data","MEDIUM",6.6,"2026-09-30",0],["CVE-2026-102136","Kiteworks","Core","Kiteworks Core Command Execution through Configuration Injection","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-102137","Kiteworks","Core","Kiteworks Core Unrestricted Upload of File with Dangerous Type","MEDIUM",4.1,"2026-09-30",0],["CVE-2026-102138","Kiteworks","Core","Kiteworks Core Server-Side Request Forgery (SSRF)","LOW",3.3,"2026-09-30",0],["CVE-2026-102101","Kiteworks","Core","Kiteworks Core deserialization of untrusted data","HIGH",8.1,"2026-09-30",0],["CVE-2026-102139","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Incorrect Authorization","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102140","Kiteworks","Core","Kiteworks Core Insufficient Verification of Data Authenticity","MEDIUM",4.9,"2026-09-30",0],["CVE-2026-102141","Kiteworks","Core","Kiteworks Core Privilege Escalation through External Control of File Name or Path","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-102999","py-pdf","pypdf","pypdf: Possible long runtimes with large amount of embedded files","HIGH",8.7,"2026-09-30",0],["CVE-2026-102142","Kiteworks","Core","Kiteworks Core Remote Code Execution through Server-Side Template Injection","HIGH",7.2,"2026-09-30",0],["CVE-2026-102143","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type","HIGH",7.5,"2026-09-30",0],["CVE-2026-102100","Kiteworks","Core","Kiteworks Core stored XSS","HIGH",8.7,"2026-09-30",0],["CVE-2026-102144","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Uncontrolled Resource Consumption","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102150","Kiteworks","Secure Data Forms","Kiteworks Secure Data Forms Missing Authentication for Critical Function","HIGH",7.2,"2026-09-30",0],["CVE-2026-102149","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Improper Access Control","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-102998","py-pdf","pypdf","pypdf: Possible long runtimes when generating appearance streams","HIGH",8.7,"2026-09-30",0],["CVE-2026-102147","Kiteworks","Core","Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-102146","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injec","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102145","Kiteworks","Core","Kiteworks Core Server-Side Request Forgery through CRLF Injection","MEDIUM",6.6,"2026-09-30",0],["CVE-2026-102097","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway remote code execution","HIGH",7.2,"2026-09-30",0],["CVE-2026-102096","Kiteworks","Core","Kiteworks Core OS command injection","HIGH",7.2,"2026-09-30",0],["CVE-2026-102099","Kiteworks","Core","Kiteworks Core arbitrary file write","HIGH",7.2,"2026-09-30",0],["CVE-2026-102095","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway server-side request forgery","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-102094","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway unsafe reflection","HIGH",7.2,"2026-09-30",0],["CVE-2026-102093","Kiteworks","Core","Kiteworks Core improper privilege management","HIGH",7.2,"2026-09-30",0],["CVE-2026-102092","Kiteworks","Core","Kiteworks Core stored XSS","HIGH",8.7,"2026-09-30",0],["CVE-2026-102997","py-pdf","pypdf","pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)","HIGH",8.7,"2026-09-30",0],["CVE-2026-102091","Kiteworks","Secure Data Forms","Kiteworks Secure Data Forms server-side request forgery","HIGH",7.5,"2026-09-30",0],["CVE-2026-102090","Kiteworks","Core","Kiteworks Core content injection","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102098","Kiteworks","Core","Kiteworks Core SQL Injection","HIGH",7.2,"2026-09-30",0],["CVE-2026-102089","Kiteworks","Email Protection Gateway","Kiteworks Email Protection Gateway path traversal","HIGH",7.2,"2026-09-30",0],["CVE-2026-102996","py-pdf","pypdf","pypdf: Possible large memory usage when parsing font data","HIGH",8.7,"2026-09-30",0],["CVE-2026-102995","py-pdf","pypdf","pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)","HIGH",8.7,"2026-09-30",0],["CVE-2026-102994","py-pdf","pypdf","pypdf: Possible long runtimes/large memory usage when parsing indirect objects","HIGH",8.7,"2026-09-30",0],["CVE-2026-102993","py-pdf","pypdf","pypdf: Possible large memory usage when retrieving Roman page labels","HIGH",8.7,"2026-09-30",0],["CVE-2026-102992","piscinajs","piscina","piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBa","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-102991","sqlalchemy","mako","Mako: Path traversal via drive-letter URI on Windows in TemplateLookup","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-103548","Itron","MV-90 xi","Improperly Stored Credentials","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103387","garycourt","uri-js","garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102990","patrickjuchli","basic-ftp","basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing pa","HIGH",8.2,"2026-09-30",0],["CVE-2026-103547","OpenBSD","OpenBSD","In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authent","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-101885","zeroclaw-labs","ZeroClaw","ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path","HIGH",8.5,"2026-09-30",0],["CVE-2026-101884","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override","HIGH",7.7,"2026-09-30",0],["CVE-2026-101882","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set","HIGH",8.7,"2026-09-30",0],["CVE-2026-101883","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-101881","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node before 2026.7.1 Denial of Service","HIGH",7.1,"2026-09-30",0],["CVE-2026-101879","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node before 2026.7.1-3 Missing Authorization","HIGH",7.1,"2026-09-30",0],["CVE-2026-101880","OpenClaw","OpenClaw Windows Node","OpenClaw Windows Node before 2026.7.1 Authorization Bypass","HIGH",8.7,"2026-09-30",0],["CVE-2026-103399","Red Hat","Red Hat Enterprise Linux 10","Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102392","ThemeHigh","Extra Product Options For WooCommerce | Custom Product Addons and Fields","WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin ","HIGH",7.2,"2026-09-30",0],["CVE-2026-102391","jetmonsters","JetFormBuilder","WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-102377","10Web","Photo Gallery by 10Web","WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-102375","Optimole","Optimole","WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102376","WPMU DEV","Branda","WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-100512","Hook & Filter","Nested Pages","WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-100510","BoldGrid","Post and Page Builder by BoldGrid","WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS)","HIGH",7.1,"2026-09-30",0],["CVE-2026-97290","Sayontan Sinha","Photonic Gallery & Lightbox for Flickr, SmugMug & Others","WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross ","HIGH",7.1,"2026-09-30",0],["CVE-2026-97291","Magazine3","Schema & Structured Data for WP & AMP","WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vuln","HIGH",8.8,"2026-09-30",0],["CVE-2026-97265","Crocoblock. Jetimpex Inc.","JetEngine","WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97256","Greg – SiteOrigin","Page Builder by SiteOrigin","WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-94171","VillaTheme","CURCY","WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-102397","supsystic","Ultimate Maps by Supsystic","WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-103440","The Wikimedia Foundation","MediaWiki PageTriage extension","pagetriagelist discloses suppressed reviewer usernames","LOW",1.2,"2026-09-30",0],["CVE-2026-103439","The Wikimedia Foundation","MediaWiki Wikbase extension","Various rawParams() and escaped() updates to prevent XSS in Wikibase extension","LOW",0.3,"2026-09-30",0],["CVE-2026-103438","The Wikimedia Foundation","MediaWiki Wikistories extension","Various rawParams() and escaped() updates to prevent XSS in Wikistories extension","LOW",0.3,"2026-09-30",0],["CVE-2026-55224","mineadmin","MineAdmin","MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall","HIGH",8.7,"2026-09-30",0],["CVE-2026-55094","taskcluster","taskcluster","Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` ar","HIGH",8.7,"2026-09-30",0],["CVE-2026-103476","yii2-starter-kit","yii2-starter-kit","yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103474","yii2-starter-kit","yii2-starter-kit","yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE","HIGH",8.7,"2026-09-30",0],["CVE-2026-103475","yii2-starter-kit","yii2-starter-kit","yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-103473","denoland","deno","Deno 2.7.0 through 2.9.7 Command Injection via node:child_process","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-103472","Corvusoft","restbed","restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering","HIGH",8.7,"2026-09-30",0],["CVE-2026-103471","Corvusoft","restbed","restbed through 5.0.0 Denial of Service via Unbounded Header Buffering","HIGH",8.7,"2026-09-30",0],["CVE-2026-103437","The Wikimedia Foundation","MediaWiki ReadingLists extension","ReadingLists imported metadata permits JavaScript URL XSS","LOW",1.1,"2026-09-30",0],["CVE-2026-103500","Mozilla","Thunderbird","Heap buffer overflow opening large email","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-103446","The Wikimedia Foundation","MediaWiki WikiLambda extension","WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments","HIGH",7.4,"2026-09-30",0],["CVE-2026-53605","pollen-robotics","reachy-mini-os","Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant","HIGH",7.8,"2026-09-30",0],["CVE-2026-55107","elct9620","kobako","Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → publ","CRITICAL",10,"2026-09-30",0],["CVE-2026-103445","The Wikimedia Foundation","MediaWiki Page_Forms extension","Stored XSS through PageForms #autoedit redirect links","LOW",1.2,"2026-09-30",0],["CVE-2026-87004","Quenary","tugtainer","Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification","HIGH",8.1,"2026-09-30",0],["CVE-2026-62308","Quenary","tugtainer","Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoin","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-55494","Quenary","tugtainer","Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SEC","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-55181","Quenary","tugtainer","Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-103241","vllm-project","vLLM","vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-55176","Soft-Machine-io","security","Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` ","CRITICAL",9,"2026-09-30",0],["CVE-2026-103233","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Admin Area admin authorization","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-46711","Soft-Machine-io","security","Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfilt","HIGH",8.3,"2026-09-30",0],["CVE-2026-75969","PTZOptics","Move 4K 12X","PTZOptics Missing Authentication in Firmware Upload","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-55177","dfpc-coe","CloudTAK","CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched ","HIGH",7.6,"2026-09-30",0],["CVE-2026-103444","The Wikimedia Foundation","MediaWiki WikiForum extension","Stored XSS through system messages in WikiForum","LOW",1.1,"2026-09-30",0],["CVE-2026-102490","Zammad GmbH","Zammad","Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package","HIGH",8.5,"2026-09-30",1],["CVE-2026-102489","Zammad GmbH","Zammad","Undisclosed RCE in Zammad v6.3 and higher","HIGH",8.7,"2026-09-30",1],["CVE-2026-103443","The Wikimedia Foundation","MediaWiki Collection (Book) extension","API permits session-seeded javascript URL XSS","LOW",1.1,"2026-09-30",0],["CVE-2026-19553","Python Software Foundation","CPython","SSLContext.wrap_bio() missing validation of server_hostname parameter","HIGH",7.6,"2026-09-30",0],["CVE-2026-19445","Python Software Foundation","CPython","Use-after-free of a server-side SSLContext when sni_callback switches contexts","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-103232","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103442","The Wikimedia Foundation","MediaWiki CentralAuth extension","MergeAccount PHP object injection via session-key substitution","HIGH",7.2,"2026-09-30",0],["CVE-2026-103231","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103441","The Wikimedia Foundation","MediaWiki Wikibase extension","Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing","HIGH",7.2,"2026-09-30",0],["CVE-2026-47539","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47496","NVIDIA","Virtual GPU Manager","NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (v","HIGH",7.3,"2026-09-30",0],["CVE-2026-47574","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could","HIGH",7.8,"2026-09-30",0],["CVE-2026-47544","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47541","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47536","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47535","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the firmware where a","HIGH",7.8,"2026-09-30",0],["CVE-2026-47521","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47520","NVIDIA","Guest driver","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47519","NVIDIA","Guest driver","NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode laye","HIGH",7.8,"2026-09-30",0],["CVE-2026-47503","NVIDIA","Virtual GPU Manager","NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (v","HIGH",7.8,"2026-09-30",0],["CVE-2026-47499","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kern","HIGH",7.8,"2026-09-30",0],["CVE-2026-47498","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47497","NVIDIA","Virtual GPU Manager","NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) trac","HIGH",7.8,"2026-09-30",0],["CVE-2026-47495","NVIDIA","Virtual GPU Manager","NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kern","HIGH",7.8,"2026-09-30",0],["CVE-2026-47493","NVIDIA","Virtual GPU Manager","NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driv","HIGH",7.8,"2026-09-30",0],["CVE-2026-47562","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",4.4,"2026-09-30",0],["CVE-2026-47531","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",4.4,"2026-09-30",0],["CVE-2026-47526","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","MEDIUM",4.4,"2026-09-30",0],["CVE-2026-47604","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47603","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47584","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47581","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47568","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47567","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, whe","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47566","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47557","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47555","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47549","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47534","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47517","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver whe","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47506","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color tr","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47492","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-47518","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure micro","MEDIUM",6,"2026-09-30",0],["CVE-2026-47586","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-47565","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-47547","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47546","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-103470","Internet2","Grouper","In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to creat","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-47543","NVIDIA","GeForce","VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47542","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47538","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47537","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47533","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47532","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47529","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47527","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47525","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47524","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47522","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47515","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47509","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","MEDIUM",6.7,"2026-09-30",0],["CVE-2026-47598","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel mod","HIGH",7,"2026-09-30",0],["CVE-2026-47596","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7,"2026-09-30",0],["CVE-2026-47582","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","HIGH",7,"2026-09-30",0],["CVE-2026-47602","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.1,"2026-09-30",0],["CVE-2026-47576","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module throug","HIGH",7.7,"2026-09-30",0],["CVE-2026-47554","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.1,"2026-09-30",0],["CVE-2026-47580","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","HIGH",7.3,"2026-09-30",0],["CVE-2026-47601","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-sourc","HIGH",7.8,"2026-09-30",0],["CVE-2026-47600","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47599","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47597","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-sourc","HIGH",7.8,"2026-09-30",0],["CVE-2026-47595","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47594","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivil","HIGH",7.8,"2026-09-30",0],["CVE-2026-47593","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer wh","HIGH",7.8,"2026-09-30",0],["CVE-2026-47592","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47591","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47590","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivil","HIGH",7.8,"2026-09-30",0],["CVE-2026-47589","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivil","HIGH",7.8,"2026-09-30",0],["CVE-2026-47588","NVIDIA","RTX, Quadro, NVS","NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user co","HIGH",7.8,"2026-09-30",0],["CVE-2026-47587","NVIDIA","RTX, Quadro, NVS","NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user co","HIGH",7.8,"2026-09-30",0],["CVE-2026-47585","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","HIGH",7.8,"2026-09-30",0],["CVE-2026-47583","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","HIGH",7.8,"2026-09-30",0],["CVE-2026-47579","NVIDIA","GeForce","The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driv","HIGH",7.8,"2026-09-30",0],["CVE-2026-47578","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer wh","HIGH",7.8,"2026-09-30",0],["CVE-2026-47577","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where ","HIGH",7.8,"2026-09-30",0],["CVE-2026-47575","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG ","HIGH",7.8,"2026-09-30",0],["CVE-2026-47573","NVIDIA","GeForce","NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-","HIGH",7.8,"2026-09-30",0],["CVE-2026-47572","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47571","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handl","HIGH",7.8,"2026-09-30",0],["CVE-2026-47570","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an","HIGH",7.8,"2026-09-30",0],["CVE-2026-47569","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47563","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47561","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47560","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47559","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47558","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47556","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47553","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47552","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47551","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47550","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer wh","HIGH",7.8,"2026-09-30",0],["CVE-2026-47548","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47545","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47540","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47530","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47528","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware w","HIGH",7.8,"2026-09-30",0],["CVE-2026-47523","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47516","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivil","HIGH",7.8,"2026-09-30",0],["CVE-2026-47514","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47513","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47512","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47511","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47510","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47508","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47507","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47505","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer wh","HIGH",7.8,"2026-09-30",0],["CVE-2026-47504","NVIDIA","GeForce","NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outda","HIGH",7.8,"2026-09-30",0],["CVE-2026-47502","NVIDIA","GeForce","NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kern","HIGH",7.8,"2026-09-30",0],["CVE-2026-47501","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47500","NVIDIA","GeForce","NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mod","HIGH",7.8,"2026-09-30",0],["CVE-2026-47494","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to","HIGH",7.8,"2026-09-30",0],["CVE-2026-47491","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-47489","NVIDIA","GeForce","NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer wher","HIGH",7.8,"2026-09-30",0],["CVE-2026-55174","shrec","UltrafastSecp256k1","UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-103436","apcupsd","apcupsd","apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/ups","LOW",3.7,"2026-09-30",0],["CVE-2026-103432","apcupsd","apcupsd","apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cg","HIGH",8.1,"2026-09-30",0],["CVE-2026-103230","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injec","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-80490","","Algorithm-AhoCorasick-XS","Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length ","","","2026-09-30",0],["CVE-2026-100280","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom tem","LOW",3.1,"2026-09-30",0],["CVE-2026-100277","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a not","HIGH",8.9,"2026-09-30",0],["CVE-2026-100278","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and ","MEDIUM",4.9,"2026-09-30",0],["CVE-2026-100279","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored c","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-100275","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification to","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-100276","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's vis","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-100273","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger all","HIGH",8.2,"2026-09-30",0],["CVE-2026-100274","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notificati","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-100270","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disc","LOW",3.3,"2026-09-30",0],["CVE-2026-100271","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allow","LOW",2.7,"2026-09-30",0],["CVE-2026-100272","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification templa","MEDIUM",4.9,"2026-09-30",0],["CVE-2026-100267","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-100268","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from ","HIGH",7.7,"2026-09-30",0],["CVE-2026-100269","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list cou","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-100264","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclose","LOW",2.7,"2026-09-30",0],["CVE-2026-100265","JetBrains","Rider","In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills witho","MEDIUM",4.8,"2026-09-30",0],["CVE-2026-100266","JetBrains","Hub","In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to ","HIGH",7.7,"2026-09-30",0],["CVE-2026-100262","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-on","HIGH",7.6,"2026-09-30",0],["CVE-2026-100263","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header ","MEDIUM",4.7,"2026-09-30",0],["CVE-2026-100259","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed e","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-100260","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-100261","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possibl","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-100258","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-100255","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover wa","HIGH",8.1,"2026-09-30",0],["CVE-2026-100256","JetBrains","IntelliJ IDEA","In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints wa","HIGH",7.8,"2026-09-30",0],["CVE-2026-100257","JetBrains","YouTrack","In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible dur","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-100254","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute","HIGH",8.8,"2026-09-30",0],["CVE-2026-100253","JetBrains","TeamCity","In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code ex","HIGH",8.8,"2026-09-30",0],["CVE-2026-103229","AdithyaYelloju","Restaurant-Management-System","AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysq","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-102427","ordasoft.com","OrdaSoft Joomla CCK","Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla","CRITICAL",10,"2026-09-30",0],["CVE-2026-94545","vercel","satori","Satori-generated SVG has improper escaping","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103397","Liquid-co","OpenSave","OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-103398","Liquid-co","OpenSave","OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path","HIGH",8.6,"2026-09-30",0],["CVE-2026-103396","mlogclub","bbs-go","bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103270","ModelTC","LightLLM","LightLLM through 1.2.0 Missing Authentication on RL Control Routes","HIGH",8.7,"2026-09-30",0],["CVE-2026-103395","ModelTC","LightLLM","LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-103243","ModelTC","LightLLM","LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-76570","joomcode.com","JCTables extension for Joomla","Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries ","CRITICAL",10,"2026-09-30",0],["CVE-2026-102984","withastro","astro","Astro: Malformed port in the Host header can crash the Node adapter","HIGH",8.2,"2026-09-30",0],["CVE-2026-102983","withastro","astro","Astro: Netlify Image CDN allowlist bypass enables SSRF","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-102717","Eclipse Foundation","NetX Duo","MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash","HIGH",7.5,"2026-09-30",0],["CVE-2026-47097","AJA Video Systems","HELO Plus","AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle","HIGH",8.7,"2026-09-30",0],["CVE-2026-103227","","GPAC","GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103389","MISP","MISP","MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph","MEDIUM",6.2,"2026-09-30",0],["CVE-2026-103388","MISP","MISP","MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field","MEDIUM",6.2,"2026-09-30",0],["CVE-2026-18782","Trex Digital Smart Manufacturing Systems Inc.","Trex MES","SQL Injection in Trex Digital Manufacturing's Trex MES","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-103226","Artifex","Ghostscript","Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-18783","Trex Digital Smart Manufacturing Systems Inc.","Trex MES","Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Tr","HIGH",8.8,"2026-09-30",0],["CVE-2026-97259","WP Hosting AS","Pay with Vipps for WooCommerce","WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object Referenc","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-101295","Red Hat","Assisted Installer for Red Hat OpenShift Container Platform 2","Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extr","HIGH",7.3,"2026-09-30",0],["CVE-2026-62084","Jeff Starr","User Submitted Posts","WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerabili","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-62097","WPTasty","Business Directory","WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-103222","Blosc","C-Blosc2","Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-93903","litespeedtech","LiteSpeed Web Server","LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validati","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-103118","","GraphicsMagick","GraphicsMagick WPG File wpg.c ExtractPostscript recursion","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-82307","Dolusoft Software Technologies","SOPLOG","Multiple Vulnerabilities in Dolusoft Software's SOPLOG","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-93547","vaadin","vaadin","Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Pr","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-91860","vaadin","vaadin","Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-76504","Cisco","Cisco Catalyst SD-WAN Manager","Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability","CRITICAL",9.8,"2026-09-30",1],["CVE-2026-103117","OS4ED","openSIS-Classic","OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-86778","Maksisoft Technology, IT, and Software Industry and Trade Inc.","Maksisoft Gym","Username Enumeration in Maksisoft Technology's Maksisoft Gym","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103116","OS4ED","openSIS-Classic","OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102398","supsystic","Popup by Supsystic","WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-102399","supsystic","Photo Gallery by Supsystic","WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) ","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-102396","supsystic","Ultimate Maps by Supsystic","WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerab","HIGH",7.1,"2026-09-30",0],["CVE-2026-102395","supsystic","Easy Google Maps","WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-102385","Kevin Stover","Ninja Forms","WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-102386","Jacob N. Breetvelt","WP Photo Album Plus","WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerabil","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102384","Supreme Modules","Supreme Modules Lite","WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-100513","Aman","CF7 Views &#8211; Complete Entry Management for Contact Form 7","WordPress CF7 Views &#8211; Complete Entry Management for Contact Form 7 plugin <= 3.2.5 -","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-100507","If-So Dynamic Content","If-So Dynamic Content Personalization","WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (X","HIGH",7.1,"2026-09-30",0],["CVE-2026-100508","WordPress.org","Two Factor","WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97302","Themeisle","MPG","WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97301","Cool Plugins","Cool Formkit Lite","WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97298","KingAddons","King Addons for Elementor","WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97299","KnitPay","Razorpay Payment Links for WooCommerce","WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forg","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-97293","David Lingren","Media LIbrary Assistant","WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability","HIGH",8.5,"2026-09-30",0],["CVE-2026-97292","YITHEMES","YITH WooCommerce Tab Manager","WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulne","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97288","Jayson T Cote","OAuth Server","WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97289","ExpressTech","Quiz And Survey Master","WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerabili","HIGH",7.1,"2026-09-30",0],["CVE-2026-97287","Liquid Web / StellarWP","Event Tickets","WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability","HIGH",8.5,"2026-09-30",0],["CVE-2026-97286","WP Chill","Strong Testimonials","WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97282","RadiusTheme","Review Schema","WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnera","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97285","Nexcess","The Events Calendar","WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-97279","Chouby","Polylang","WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97274","miniOrange","OAuth Single Sign On – SSO (OAuth Client)","WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-97271","WPFunnels","WPFunnels","WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97272","Premmerce","Premmerce Permalink Manager for WooCommerce","WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Script","HIGH",7.1,"2026-09-30",0],["CVE-2026-97270","Justin Sternberg","CMB2","WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97267","miniOrange","Prevent files / folders access","WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerabi","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-97262","Visual Composer","Visual Composer Website Builder","WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) v","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97266","Nexcess","Virtue/Ascend/Pinnacle Toolkit","WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) v","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97261","VillaTheme","Notivo","WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97253","Kreatura","LayerSlider","WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97250","Dylan Kuhn","Geo Mashup","WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97248","Booking Activities Team","Booking Activities","WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-97249","Cozmoslabs","Paid Member Subscriptions","WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97247","Creative Themes","Blocksy Companion","WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97246","ShortPixel","ShortPixel Image Optimizer","WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability","MEDIUM",4.9,"2026-09-30",0],["CVE-2026-97244","WPFunnels","Creator LMS","WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-97245","SureCart","SureCart","WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-97243","flexyma","AllAble Connector","WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-97242","phuongwebo","WEBO MCP","WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-97240","Esteban","StifLi Backup Tools","WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-97241","PrecisionWP","BackupEase","WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-97239","Jose Conti","MCP Content Manager Lite","WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97238","Crocoblock. Jetimpex Inc.","JetEngine","WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-97237","Crocoblock","JetEngine","WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97236","ThemeRex","ThemeREX Addons","WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97235","ThemeRex","ThemeREX Addons","WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97079","Webba Appointment Booking","Webba Booking","WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnera","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-97197","WebToffee","WordPress Backup & Migration","WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerabili","HIGH",7.5,"2026-09-30",0],["CVE-2026-97078","BoldGrid","Client Invoicing by Sprout Invoices","WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object R","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97077","Spacetime","Ad Inserter","WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97074","Omnisend","Newsletters, Email Marketing, SMS and Popups by Omnisend","WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insec","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-97067","Shane Bishop","EWWW Image Optimizer","WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-97065","Happyforms","Happyforms","WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-97066","Nexcess","GiveWP","WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-96838","YoOhw Studio","Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification","WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verif","HIGH",8.8,"2026-09-30",0],["CVE-2026-96836","Morteza Geransayeh","Parsi Date","WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-96837","Brainstorm Force","CartFlows","WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-96835","KingAddons.com","King Addons for Elementor","WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-96834","Nexcess","GiveWP","WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-96833","Themefic","Ultimate Addons for Contact Form 7","WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulne","HIGH",7.2,"2026-09-30",0],["CVE-2026-96832","keywordrush","Content Egg","WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-96831","themifyme","Themify Builder","WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-96830","Nexcess","GiveWP","WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-96829","POSIMYTH","The Plus Addons for Elementor Page Builder Lite","WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scr","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-96828","Vidish","Category Discount Woocommerce","WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-96825","David Anderson / Team Updraft","All In One WP Security & Firewall","WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnera","MEDIUM",4.2,"2026-09-30",0],["CVE-2026-96827","Melapress","Admin Notices Manager","WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-96824","envato","Template Kit – Import","WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-96823","CusRev","Customer Reviews for WooCommerce","WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion ","HIGH",7.5,"2026-09-30",0],["CVE-2026-96822","Hossni Mubarak","Books Gallery","WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-96821","Mahmudul Hasan Arif","FluentBoards","WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability","MEDIUM",6.3,"2026-09-30",0],["CVE-2026-96819","bobbingwide","oik","WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-96820","awesomesupport","Awesome Support","WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-96818","mra13 / Team Tips and Tricks HQ","WP Express Checkout (Accept PayPal Payments)","WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Con","HIGH",7.5,"2026-09-30",0],["CVE-2026-96817","MakeCommerce.net","MakeCommerce for WooCommerce","WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerabili","HIGH",8.2,"2026-09-30",0],["CVE-2026-96816","vendidero","Trusted Shops Easy Integration for WooCommerce","WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scri","HIGH",7.1,"2026-09-30",0],["CVE-2026-96815","appsbd","Vitepos","WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-96450","pixfort","pixfort Core","WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-96814","WP Titan Labs","WooCommerce Product Table Lite","WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vuln","HIGH",7.1,"2026-09-30",0],["CVE-2026-96352","YITHEMES","YITH WooCommerce Ajax Search","WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulne","HIGH",7.1,"2026-09-30",0],["CVE-2026-96351","RadiusTheme","Classified Listing","WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-96350","Estatik","Estatik","WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-96348","Bookly","Bookly","WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-96349","SiteSkite","SiteSkite","WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability","CRITICAL",10,"2026-09-30",0],["CVE-2026-96347","Bookly","Bookly","WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-96346","weDevs","WP ERP","WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-96345","Estatik","Estatik","WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-96344","impleCode","eCommerce Product Catalog","WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-96343","weDevs","WP ERP","WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-95587","Hostinger","Hostinger Migrator","WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-96338","Cozmoslabs","Profile Builder","WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-95531","QuantumCloud","Conversational Forms for ChatBot","WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerab","HIGH",8.8,"2026-09-30",0],["CVE-2026-94683","Justin Nealey","DesignSetGo","WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-94681","Tijmen Smit","WP Store Locator","WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability","MEDIUM",5.9,"2026-09-30",0],["CVE-2026-94677","Nexcess","Kadence WooCommerce Email Designer","WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vul","HIGH",7.2,"2026-09-30",0],["CVE-2026-94678","Mat Lipe","Go Live Update Urls","WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-94674","SweetCode","Pixel Manager for WooCommerce","WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vuln","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-94673","NSquared","Simply Schedule Appointments","WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object Refere","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-94672","10up","Safe SVG","WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerabilit","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-94499","wpWax","FormGent","WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-94178","Javier Carazo","Import and export users and customers","WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vul","HIGH",7.5,"2026-09-30",0],["CVE-2026-94389","AcyMailing Newsletter Team","AcyMailing SMTP Newsletter","WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulner","CRITICAL",9,"2026-09-30",0],["CVE-2026-94177","Ruben Garcia","GamiPress","WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability","HIGH",8.5,"2026-09-30",0],["CVE-2026-94173","Strategy11 Team","Business Directory","WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) v","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-94123","Syed Balkhi","NextGEN Gallery","WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability","HIGH",7.5,"2026-09-30",0],["CVE-2026-94122","A WP Life","Responsive Slider Gallery","WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability","HIGH",7.2,"2026-09-30",0],["CVE-2026-94121","10Web","10Web Booster – Website speed optimization, Cache & Page Speed optimizer","WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin ","HIGH",8.8,"2026-09-30",0],["CVE-2026-94115","Fatcatapps","Easy Pricing Tables","WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability","HIGH",8.5,"2026-09-30",0],["CVE-2026-94120","GravityKit","GravityExport Lite for Gravity Forms","WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vul","HIGH",7.5,"2026-09-30",0],["CVE-2026-94082","Fatcatapps","Quiz Cat","WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-94081","lukeseager","WordPress Persistent Login","WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerab","HIGH",7.1,"2026-09-30",0],["CVE-2026-94078","Gemini Labs","Site Reviews","WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-94077","10up","Safe SVG","WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-94074","NSquared","Simply Schedule Appointments","WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnera","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-94076","SEO Squirrly","SEO Plugin by Squirrly SEO","WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability","HIGH",8.8,"2026-09-30",0],["CVE-2026-93771","WPFactory","Cost of Goods for WooCommerce","WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerabili","HIGH",7.2,"2026-09-30",0],["CVE-2026-93770","VeronaLabs","WP Statistics","WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-93651","Dotstore","Minimum and Maximum Quantity for WooCommerce","WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Inject","HIGH",7.2,"2026-09-30",0],["CVE-2026-93624","codepeople","Music Player for WooCommerce","WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilit","HIGH",7.2,"2026-09-30",0],["CVE-2026-93514","rainafarai","Notification for Telegram","WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerabi","HIGH",7.1,"2026-09-30",0],["CVE-2026-93621","Passionate Programmer Peter","WP Data Access","WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability","HIGH",8.2,"2026-09-30",0],["CVE-2026-93512","ilGhera","JW Player for WordPress","WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerabil","HIGH",7.1,"2026-09-30",0],["CVE-2026-62085","Melapress","WP Activity Log","WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability","HIGH",7.6,"2026-09-30",0],["CVE-2026-62081","wpdesk","Flexible PDF Coupons","WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-62083","WPFunnels","Creator LMS","WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-62080","Leevio","Happy Addons for Elementor","WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnera","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-62079","Qode","Qi Addons For Elementor","WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerabilit","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-27371","WPFunnels","WPFunnels","WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability","HIGH",7.1,"2026-09-30",0],["CVE-2026-62078","Leap13","Premium Addons for Elementor","WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vul","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-27085","Brainstorm Force","Astra WordPress Theme","WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability","LOW",2.7,"2026-09-30",0],["CVE-2026-95616","Apache Software Foundation","Apache WSS4J","Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.5","HIGH",7.5,"2026-09-30",0],["CVE-2026-103321","MISP","MISP","MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image","HIGH",8.3,"2026-09-30",0],["CVE-2026-103115","OS4ED","openSIS-Classic","OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-92899","Apache Software Foundation","Apache WSS4J","Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce","MEDIUM",4.8,"2026-09-30",0],["CVE-2026-74865","YunoHost-Apps","sogo_yhn","Authentication Bypass in sogo_yhn","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-74864","YunoHost-Apps","sogo_yhn","Authentication Bypass in sogo_yhn","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-92121","Apache Software Foundation","Apache WSS4J","Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an ST","HIGH",7.5,"2026-09-30",0],["CVE-2026-89238","Apache Software Foundation","Apache WSS4J","Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selecti","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-88920","Apache Software Foundation","Apache WSS4J","Apache WSS4J: SAML Sender-Vouches Authentication Bypass","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-87830","Apache Software Foundation","Apache WSS4J","Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-85532","Apache Software Foundation","Apache WSS4J","Apache WSS4J: Insufficient Validation of Derived-Key Parameters","HIGH",7.5,"2026-09-30",0],["CVE-2026-103242","Red Hat","Red Hat Enterprise Linux 10","Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures h","HIGH",7.1,"2026-09-30",0],["CVE-2026-62146","Red Hat","Red Hat OpenShift Container Platform 4","Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket","HIGH",7.8,"2026-09-30",0],["CVE-2026-10726","Cato Networks","SDP Client","Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validati","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-10739","Cato Networks","SDP Client","Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation","HIGH",8.5,"2026-09-30",0],["CVE-2026-103012","Anthropic","@anthropic-ai/claude-code","Claude Code selected an API key stored by Claude Code, for example from an earlier `/login","LOW",2,"2026-09-30",0],["CVE-2026-103114","OS4ED","openSIS-Classic","OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sq","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-76992","CODESYS","Development System 3","Uncontrolled Memory Allocation in CODESYS Gateway Client","HIGH",8.7,"2026-09-30",0],["CVE-2026-13719","Grafana","Grafana Enterprise","Alert rules in restricted folders disclosed via the alert rules list API","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-13720","Grafana","Grafana OSS","Editor can forge file-provisioning provenance on dashboards via the dashboard API","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-96342","Amauri.IO","WPMobile.App","WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103113","OS4ED","openSIS-Classic","OS4ED openSIS-Classic General Information Tab Student.php save action sql injection","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-103239","MISP","MISP","MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection","HIGH",8.6,"2026-09-30",0],["CVE-2026-103237","MISP","MISP","MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows","HIGH",8.3,"2026-09-30",0],["CVE-2026-77185","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Asynchronous authentication can bypass signature verification","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-93994","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Repeated-publickey policy bypass on server","HIGH",8.1,"2026-09-30",0],["CVE-2026-94053","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: LDAP injection in sshd-ldap","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-10764","IQSIGHT","BVMS","Information disclosure in BVMS 4.5 up to 12.3","HIGH",8.7,"2026-09-30",0],["CVE-2026-93995","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Remote execution of JGit \"archive -o=file.zip\" can write file on the ser","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-93996","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-94002","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies","HIGH",7.5,"2026-09-30",0],["CVE-2026-94029","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-94052","Apache Software Foundation","Apache MINA SSHD","Apache MINA SSHD: LDAP password authentication ineffective","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-79625","CODESYS","Control RTE (SL)","Improper Synchronization in Monitoring in CODESYS Control Runtime","HIGH",7.2,"2026-09-30",0],["CVE-2026-103235","MISP","MISP","MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events","HIGH",8.7,"2026-09-30",0],["CVE-2026-102588","","moodle","Moodle: csrf in xml grade import","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102587","","moodle","Moodle: user list filters bypass profile field visibility","LOW",2.7,"2026-09-30",0],["CVE-2026-102586","","moodle","Moodle: xss via password reset link due to insufficient username escaping","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102585","","moodle","Moodle: group validation missing when enrolling user to course","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102584","","moodle","Moodle: missing capability check allows unauthorised grade penalty recalculation","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102583","","moodle","Moodle: incorrect capability check in ai generate image web service","LOW",2.7,"2026-09-30",0],["CVE-2026-102582","","moodle","Moodle: manual enrolment page accessible when plugin disabled","LOW",2.2,"2026-09-30",0],["CVE-2026-102581","","moodle","Moodle: xss in forum post templates due to insufficient escaping","MEDIUM",4.6,"2026-09-30",0],["CVE-2026-102580","","moodle","Moodle: arbitrary class instantiation via report builder audience classname","LOW",2.2,"2026-09-30",0],["CVE-2026-102579","","moodle","Moodle: user profile information disclosure via grade web service","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102578","","moodle","Moodle: sql injection in question bank web service","MEDIUM",5.5,"2026-09-30",0],["CVE-2026-102577","","moodle","Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-102459","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-102458","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - Missing Authentication","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-102457","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - Arbitrary File Read","HIGH",7.1,"2026-09-30",0],["CVE-2026-102456","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - SQL Injection","HIGH",7.1,"2026-09-30",0],["CVE-2026-102455","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - Insecure Deserialization","CRITICAL",9.3,"2026-09-30",0],["CVE-2025-14564","ahsangadit","Viable URL Media Uploader","Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting v","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-75098","productdesignerapp","Product Designer App","Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in","HIGH",7.5,"2026-09-30",0],["CVE-2026-92712","rockiger","ReactPress – Create React App for WordPress","ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permali","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-93908","rameez_iqbal","Real Estate Manager – Property Listing and Agent Management","Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via '","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-97347","kazukiyanamoto","Post Views Stats Counter","Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-A","HIGH",7.2,"2026-09-30",0],["CVE-2026-102454","DigiWin","EasyFlow .NET","DigiWin｜EasyFlow .NET - Arbitrary File Upload","HIGH",8.6,"2026-09-30",0],["CVE-2026-102511","Apache Software Foundation","Apache PLC4X","Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed resp","HIGH",8.5,"2026-09-30",0],["CVE-2026-102510","Apache Software Foundation","Apache PLC4X","Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled len","HIGH",8.7,"2026-09-30",0],["CVE-2026-102509","Apache Software Foundation","Apache PLC4X","Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver an","HIGH",8.7,"2026-09-30",0],["CVE-2026-92873","Pgpool Global Development Group","Pgpool-II","Pgpool-II contains an incorrect implementation of an authentication algorithm, which may a","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-92872","Pgpool Global Development Group","Pgpool-II","Pgpool-II inserts sensitive information into log file, which may allow an authenticated at","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-92871","Pgpool Global Development Group","Pgpool-II","A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthent","HIGH",8.7,"2026-09-30",0],["CVE-2026-102508","Apache Software Foundation","Apache PLC4X","Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, an","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-93462","baserCMS User Community","baserCMS","A missing authentication for critical function vulnerability exists in baserCMS. If this v","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-16596","wpdirectorykit","WP Directory Kit","WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' P","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-6173","boldthemes","Bold Page Builder","Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-6170","boldthemes","Bold Page Builder","Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-6171","boldthemes","Bold Page Builder","Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-6806","stylemix","Motors – Car Dealership & Classified Listings Plugin","Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters","HIGH",7.5,"2026-09-30",0],["CVE-2026-11895","devitemsllc","HT Mega Addons for Elementor – Elementor Widgets & Template Builder","HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scr","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-14876","nextendweb","Smart Slider 3","Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-6172","boldthemes","Bold Page Builder","Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-88037","boldthemes","Bold Page Builder","Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ","MEDIUM",6.4,"2026-09-30",0],["CVE-2026-93464","baserCMS User Community","baserCMS","A stored cross-site scripting vulnerability via custom content descriptions exists in base","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-93460","baserCMS User Community","baserCMS","A stored cross-site scripting vulnerability via appended strings in email form fields exis","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-93463","baserCMS User Community","baserCMS","A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If t","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-92870","Pgpool Global Development Group","Pgpool-II","A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauth","HIGH",8.7,"2026-09-30",0],["CVE-2026-92869","Pgpool Global Development Group","Pgpool-II","An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated","HIGH",7.1,"2026-09-30",0],["CVE-2026-92868","Pgpool Global Development Group","Pgpool-II","An improper certificate validation vulnerability exists in Pgpool-II, which may allow an u","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-92867","Pgpool Global Development Group","Pgpool-II","An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticate","HIGH",8.7,"2026-09-30",0],["CVE-2026-97150","baserCMS Users Community","BcAddonMigrator","When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes \"","HIGH",8.6,"2026-09-30",0],["CVE-2026-97196","Liquid Web / StellarWP","GiveWP","WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-89294","croixhaug","Simply Schedule Appointments","Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusi","HIGH",7.5,"2026-09-30",0],["CVE-2026-96886","","Course Booking System","Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-97316","","Broken Link Notifier","Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass","MEDIUM",5.8,"2026-09-30",0],["CVE-2026-92424","","Content Egg","Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-92994","","Verge3D Publishing and E-Commerce","Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API","HIGH",8.8,"2026-09-30",0],["CVE-2026-93580","","InPost PL","InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment W","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-94274","","YayReviews","YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-94297","","Media Library Organizer","Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation","LOW",2.7,"2026-09-30",0],["CVE-2026-91051","","EWWW Image Optimizer","EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' ","MEDIUM",6.6,"2026-09-30",0],["CVE-2026-91072","","EWWW Image Optimizer","EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path ","MEDIUM",4.4,"2026-09-30",0],["CVE-2026-91832","","WP Mobile Menu","WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF","HIGH",7.1,"2026-09-30",0],["CVE-2026-88797","","Vayu X","Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation","HIGH",7.1,"2026-09-30",0],["CVE-2026-89190","","Robin Image Optimizer","Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-89193","","Robin Image Optimizer","Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTM","HIGH",7.5,"2026-09-30",0],["CVE-2026-90953","","Image Optimizer","Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-85573","","All in One Files Upload","All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SV","HIGH",8.8,"2026-09-30",0],["CVE-2026-85576","","All in One Files Upload","All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings U","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-86789","","Connections Business Directory","Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Dis","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-87777","","Hostinger Reach","Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attrib","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-88791","","Safe Redirect Manager","Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules","LOW",3.4,"2026-09-30",0],["CVE-2026-80333","","Solace Extra","Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview R","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-82127","","Schema & Structured Data for WP & AMP","Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields","LOW",3.5,"2026-09-30",0],["CVE-2026-83560","","New User Approve","New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-85001","","EmbedPress","EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribut","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-85415","","Audio Player Block","Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL","MEDIUM",6.8,"2026-09-30",0],["CVE-2026-75823","","User Frontend","WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration R","HIGH",7.4,"2026-09-30",0],["CVE-2026-75824","","User Frontend","WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disab","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-75873","","Zella Theme","Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-100143","","FluentCart A New Era of eCommerce","FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email","MEDIUM",6.5,"2026-09-30",0],["CVE-2026-102913","SourceCodester","Car Driving School Management System","SourceCodester Car Driving School Management System Master.php save_enrollment sql injecti","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103111","PCRE","PCRE2","PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JI","HIGH",7.6,"2026-09-30",0],["CVE-2026-102912","SourceCodester","Online Leave Management System","SourceCodester Online Leave Management System page reports sql injection","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-102911","zosmaai","pi-llm-wiki","zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-86134","WatchGuard","Fireware OS","Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service","HIGH",8.7,"2026-09-30",0],["CVE-2026-102910","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System exam-delete.php sql injection","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103110","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input valida","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-102909","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System btn_functions.php sql injection","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103109","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input valida","HIGH",7.7,"2026-09-30",0],["CVE-2026-103108","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input valid","HIGH",7.5,"2026-09-30",0],["CVE-2026-103106","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input valid","HIGH",7.8,"2026-09-30",0],["CVE-2026-102908","SourceCodester","Online Reviewer Management System","SourceCodester Online Reviewer Management System questions-view.php sql injection","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103105","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access contr","HIGH",8.8,"2026-09-30",0],["CVE-2026-103104","Pexip","Infinity","Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input valida","HIGH",7.5,"2026-09-30",0],["CVE-2026-102906","0xshariq","github-mcp-server","0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command inj","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103102","Pexip","Infinity","Pexip Infinity before 41.0 is affected by improper input validation in the signaling imple","HIGH",8.6,"2026-09-30",0],["CVE-2026-96649","wpshuffle","Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms","Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Si","HIGH",7.2,"2026-09-30",0],["CVE-2026-103101","Pexip","Infinity","Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in t","HIGH",8.6,"2026-09-30",0],["CVE-2026-103100","Pexip","Infinity","Pexip Infinity before 40.1 is affected by improper input validation in the signaling imple","HIGH",7.5,"2026-09-30",0],["CVE-2026-102874","HKUDS","AnyTool","HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-103099","Pexip","Infinity","Pexip Infinity before 41.1 is affected by improper input validation in the media implement","HIGH",7.5,"2026-09-30",0],["CVE-2026-86556","ZTE","U30 Air","An information disclosure vulnerability in ZTE U30 Air product","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102847","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-81310","PFU Limited","Image Scanner Driver for Linux (fi Series)","Image Scanner Driver for Linux contains a link following vulnerability. An attacker who ca","MEDIUM",5.2,"2026-09-30",0],["CVE-2026-78229","PFU Limited","Image Scanner Driver for Linux (fi Series)","Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker","MEDIUM",5.4,"2026-09-30",0],["CVE-2026-102846","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-102845","gedelumbung","HospitalManagement","gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclos","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-102844","gedelumbung","HospitalManagement","gedelumbung HospitalManagement laporan_data_pasien.php detail authorization","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-102843","gedelumbung","HospitalManagement","gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-103088","jknack","handlebars.java","Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and","HIGH",7.5,"2026-09-30",0],["CVE-2026-103087","gosub-io","gosub-engine","Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main b","HIGH",7.1,"2026-09-30",0],["CVE-2026-102842","gedelumbung","HospitalManagement","gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-51936","Zetetic","SQLCipher","Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience fun","LOW",2.1,"2026-09-30",0],["CVE-2026-103057","beenuar","AiSOC","AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-103055","beenuar","AiSOC","AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret","HIGH",8.7,"2026-09-30",0],["CVE-2026-103056","beenuar","AiSOC","AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-103054","beenuar","AiSOC","AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP","HIGH",7.1,"2026-09-30",0],["CVE-2026-103053","beenuar","AiSOC","AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-102805","Nothings","stb","Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-102804","Nothings","stb","Nothings stb stb_hexwave.h hexwave_init integer overflow","MEDIUM",6.9,"2026-09-30",0],["CVE-2026-51568","","","modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.","HIGH",8.1,"2026-09-30",0],["CVE-2026-51570","","","modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.","HIGH",8.1,"2026-09-30",0],["CVE-2026-51852","","","agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/","HIGH",7.5,"2026-09-30",0],["CVE-2026-51853","","","agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/","HIGH",7.5,"2026-09-30",0],["CVE-2026-51856","","","In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_py","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51857","","","In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-pr","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51858","","","In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows pro","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51859","","","bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_downloa","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-51860","","","bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/","HIGH",7.5,"2026-09-30",0],["CVE-2026-51861","","","bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bishe","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51862","","","DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_ap","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-51864","","","DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgp","CRITICAL",9.1,"2026-09-30",0],["CVE-2026-51866","","","In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route c","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51867","","","agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51869","","","DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51870","","","DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:Exec","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51871","","","Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/r","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-51872","","","Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-102794","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 ping command injection","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-102793","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 set_time_zone command injection","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-103051","The Wikimedia Foundation","Mediawiki - CentralNotice extension","Stored i18n XSSs in CentralNotice","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-103050","The Wikimedia Foundation","Mediawiki - MassMessage extension","Stored i18n XSS in MassMessage","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-103049","The Wikimedia Foundation","Mediawiki - Cargo extension","XSS in Cargo's Special:CargoQuery page due to unsanitized table headers","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-86104","WatchGuard","Fireware OS","Fireware OS Resource Exhaustion in Login Process Allows Denial of Service","HIGH",8.7,"2026-09-30",0],["CVE-2026-13046","WatchGuard","Fireware OS","Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution","HIGH",7.5,"2026-09-30",0],["CVE-2026-13224","WatchGuard","Fireware OS","Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read","HIGH",8.2,"2026-09-30",0],["CVE-2026-18105","WatchGuard","Fireware OS","Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service","HIGH",7.1,"2026-09-30",0],["CVE-2026-18145","WatchGuard","Fireware OS","Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution","HIGH",8.6,"2026-09-30",0],["CVE-2026-81433","WatchGuard","Fireware OS","Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Executi","HIGH",8.7,"2026-09-30",0],["CVE-2026-86101","WatchGuard","Fireware OS","Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access","HIGH",7.2,"2026-09-30",0],["CVE-2026-86105","WatchGuard","Fireware OS","Fireware OS Improper Authorization in Access Portal Reverse Proxy","MEDIUM",5.3,"2026-09-30",0],["CVE-2026-86128","WatchGuard","Fireware OS","Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Deni","HIGH",8.2,"2026-09-30",0],["CVE-2026-86131","WatchGuard","Fireware OS","Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution","CRITICAL",9.2,"2026-09-30",0],["CVE-2026-86132","WatchGuard","Fireware OS","Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service","HIGH",8.2,"2026-09-30",0],["CVE-2026-86133","WatchGuard","Fireware OS","Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service","HIGH",8.2,"2026-09-30",0],["CVE-2026-86136","WatchGuard","Fireware OS","Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Var","HIGH",7.1,"2026-09-30",0],["CVE-2026-90441","WatchGuard","Fireware OS","Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Var","HIGH",7.1,"2026-09-30",0],["CVE-2026-103048","The Wikimedia Foundation","Mediawiki - Collection extension","Open Redirect in Special:Book","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-103047","The Wikimedia Foundation","Mediawiki - CentralAuth extension","XSS through i18n message in CentralAuth","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-103045","The Wikimedia Foundation","Mediawiki - Refreshed skin","XSS in Refreshed skin","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-103043","alexcorvi","anchorme","anchorme through 3.0.8 Regular Expression Denial of Service","HIGH",8.7,"2026-09-30",0],["CVE-2026-103042","ModelTC","LightLLM","LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_valu","HIGH",8.7,"2026-09-30",0],["CVE-2026-103040","ModelTC","LightLLM","LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Serv","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-103041","ModelTC","LightLLM","LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service","CRITICAL",9.3,"2026-09-30",0],["CVE-2026-103044","The Wikimedia Foundation","Mediawiki - EasyTimeline extension","EasyTimeline should not serve image maps as application/xml","CRITICAL",9.8,"2026-09-30",0],["CVE-2026-102792","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 set_syslog command injection","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-103046","The Wikimedia Foundation","Mediawiki - WikiLambda Extension","WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML","MEDIUM",6.1,"2026-09-30",0],["CVE-2026-102771","Naichen","ThinkCMF","Naichen ThinkCMF Email Template MailController.php templatePut special elements in templat","MEDIUM",5.1,"2026-09-30",0],["CVE-2026-71189","Toptech Systems","TMS7","Toptech TMS7 and TopHAT Cross-site Scripting","MEDIUM",4.8,"2026-09-30",0],["CVE-2026-69662","Toptech Systems","TMS7","Toptech TMS7 and TopHAT Eval Injection","LOW",2.1,"2026-09-30",0],["CVE-2026-71302","Toptech Systems","TMS7","Toptech TMS7 and TopHAT Session Fixation","HIGH",7.5,"2026-09-30",0],["CVE-2026-72507","Toptech Systems","TMS7","Toptech TMS7 and TopHAT SQL Injection","HIGH",8.5,"2026-09-30",0],["CVE-2026-68068","Toptech Systems","TMS7","Toptech TMS7 and TopHAT SQL Injection","HIGH",8.5,"2026-09-30",0],["CVE-2026-68954","Toptech Systems","TMS7","Toptech TMS7 and TopHAT SQL Injection","HIGH",8.5,"2026-09-30",0],["CVE-2026-63713","Toptech Systems","TMS7","Toptech TMS7 and TopHAT SQL Injection","HIGH",8.5,"2026-09-30",0],["CVE-2026-102621","Freedesktop","Poppler","Freedesktop Poppler SplashClip.cc clipToPath integer overflow","MEDIUM",4.8,"2026-09-30",0],["CVE-2026-74225","u-boot","u-boot","U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6","HIGH",7.1,"2026-09-30",0],["CVE-2026-74221","u-boot","u-boot","U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK","HIGH",8.8,"2026-09-30",0],["CVE-2026-74222","u-boot","u-boot","U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback","HIGH",8.8,"2026-09-30",0],["CVE-2026-74220","u-boot","u-boot","U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply","HIGH",8.8,"2026-09-30",0],["CVE-2026-71973","u-boot","u-boot","U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation","MEDIUM",5.2,"2026-09-30",0],["CVE-2026-71974","u-boot","u-boot","U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read","MEDIUM",4.3,"2026-09-30",0],["CVE-2026-71971","u-boot","u-boot","U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly","HIGH",8.8,"2026-09-30",0],["CVE-2026-71972","u-boot","u-boot","U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder","MEDIUM",6,"2026-09-30",0],["CVE-2026-72510","Toptech Systems","TMS7","Toptech TMS7 and TopHAT SQL Injection","HIGH",8.5,"2026-09-30",0],["CVE-2026-70356","Toptech Systems","TMS7","Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type","CRITICAL",9.4,"2026-09-30",0],["CVE-2026-71379","Toptech Systems","TMS7","Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties","CRITICAL",10,"2026-09-30",0],["CVE-2026-91191","Lantronix","G520 Series","Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature","HIGH",7.7,"2026-09-30",0],["CVE-2026-84409","Lantronix","G520 Series","Lantronix G520 Series Cellular Gateway Cross-site Scripting","HIGH",7.7,"2026-09-30",0],["CVE-2026-102938","pypa","virtualenv","virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowi","MEDIUM",5.8,"2026-09-29",0],["CVE-2026-102937","pypa","virtualenv","virtualenv: Command injection via --prompt in activate.bat (batch activator)","HIGH",7.3,"2026-09-29",0],["CVE-2026-93853","EnterpriseDB","Barman","Barman snapshot backup deletion trusts unverified backup catalog metadata","HIGH",7.2,"2026-09-29",0],["CVE-2026-102930","pypa","virtualenv","virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use","HIGH",7.7,"2026-09-29",0],["CVE-2026-102925","pypa","virtualenv","virtualenv bash and fish activation scripts execute commands embedded in paths","HIGH",7.8,"2026-09-29",0],["CVE-2026-81842","Grafana","Grafana Enterprise","Library panel can be moved into a folder without library panel create permission","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102904","jupyterlab","jupyterlab","JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable f","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-96587","Viidure","Dashcam Android Application","Use of Hard-coded Credentials in Viidure Dashcam Android Application","CRITICAL",10,"2026-09-29",0],["CVE-2026-94204","Viidure","Dashcam Android Application","Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Applicati","HIGH",8.7,"2026-09-29",0],["CVE-2026-81841","Grafana","Grafana Enterprise","Paused shared dashboard access tokens still expose data source configuration","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102620","Freedesktop","Poppler","Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-102253","esnet","iperf3","iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS","HIGH",8.7,"2026-09-29",0],["CVE-2026-102879","claraverse-space","ClaraVerse","ClaraVerse through 0.3.1 SSRF Protection Bypass","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102878","hangwin","mcp-chrome-bridge","mcp-chrome-bridge through 1.0.31 CORS Origin Bypass","HIGH",8.6,"2026-09-29",0],["CVE-2026-102876","surrealdb","surrealdb","SurrealDB before 3.3.0 Cross-Tenant Access via Headers","HIGH",8.6,"2026-09-29",0],["CVE-2026-102877","getfider","fider","Fider before 0.38.0 SSRF via DNS rebinding in webhook validation","LOW",2.1,"2026-09-29",0],["CVE-2026-102875","videolan","vlc","VLC media player before 3.0.24 Path Traversal via skins2","HIGH",8.5,"2026-09-29",0],["CVE-2026-53988","Finsys","dockhand","Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints","CRITICAL",9.2,"2026-09-29",0],["CVE-2026-100299","Anjvision","YSSD-RTMP-H5","Use of Weak Credentials in Anjvision YSSD-RTMP-H5","HIGH",7,"2026-09-29",0],["CVE-2026-100298","Anjvision","YSSD-RTMP-H5","Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5","HIGH",8.7,"2026-09-29",0],["CVE-2026-100297","Anjvision","YSSD-RTMP-H5","Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-100296","Anjvision","YSSD-RTMP-H5","Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5","HIGH",7.2,"2026-09-29",0],["CVE-2026-102305","Google","Chrome","UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-102314","Google","Chrome","UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote ","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-102327","Google","Chrome","Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 a","HIGH",7.5,"2026-09-29",0],["CVE-2026-102330","Google","Chrome","Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-102302","Google","Chrome","Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to","HIGH",8.8,"2026-09-29",0],["CVE-2026-102310","Google","Chrome","Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-102315","Google","Chrome","Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allo","LOW",3.4,"2026-09-29",0],["CVE-2026-102320","Google","Chrome","Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote att","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-102321","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-102301","Google","Chrome","Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attack","HIGH",8.3,"2026-09-29",0],["CVE-2026-102308","Google","Chrome","Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102318","Google","Chrome","Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attac","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-102319","Google","Chrome","Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote att","LOW",3.4,"2026-09-29",0],["CVE-2026-102324","Google","Chrome","Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remot","HIGH",8.3,"2026-09-29",0],["CVE-2026-102329","Google","Chrome","Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote att","MEDIUM",6.1,"2026-09-29",0],["CVE-2026-102304","Google","Chrome","Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attac","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102309","Google","Chrome","Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote atta","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102316","Google","Chrome","Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102325","Google","Chrome","Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote at","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102328","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-102300","Google","Chrome","Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote ","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102303","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowe","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102307","Google","Chrome","Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allow","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-102311","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowe","LOW",3.4,"2026-09-29",0],["CVE-2026-102323","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-102326","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-102299","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-102306","Google","Chrome","Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attac","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102312","Google","Chrome","UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allo","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102313","Google","Chrome","Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allo","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-102317","Google","Chrome","Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.9","HIGH",8.6,"2026-09-29",0],["CVE-2026-102331","Google","Chrome","Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a r","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100295","Anjvision","YSSD-RTMP-H5","Active debug code in Anjvision YSSD-RTMP-H5","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-53989","Finsys","dockhand","Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102252","Google","OSV-SCALIBR","Path Traversal in VMDK Extractor in OSV-SCALIBR","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-100294","Anjvision","YSSD-RTMP-H5","Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5","HIGH",8.7,"2026-09-29",0],["CVE-2026-100293","Anjvision","YSSD-RTMP-H5","Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5","HIGH",8.7,"2026-09-29",0],["CVE-2026-100292","Anjvision","YSSD-RTMP-H5","Improper neutralization of special elements used in an OS command ('OS command injection')","HIGH",8.7,"2026-09-29",0],["CVE-2026-100291","Anjvision","YSSD-RTMP-H5","Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-96274","Baicells","Nova 430H eNodeB  (model pBS3101SH)","Uncaught exception in Baicells Nova 430H","HIGH",8.3,"2026-09-29",0],["CVE-2026-76738","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant ","LOW",2.7,"2026-09-29",0],["CVE-2026-76737","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Network","LOW",3,"2026-09-29",0],["CVE-2026-76736","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networ","LOW",3.3,"2026-09-29",0],["CVE-2026-76735","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On","MEDIUM",4.1,"2026-09-29",0],["CVE-2026-76734","Hewlett Packard Enterprise (HPE)","Instant ON","Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networki","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-76733","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Denial-of-Service Vulnerability in HPE Networking Instant On API Endpoint","MEDIUM",4.9,"2026-09-29",0],["CVE-2026-76732","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Insta","MEDIUM",6.4,"2026-09-29",0],["CVE-2026-76731","Hewlett Packard Enterprise (HPE)","Instant ON","Authentication Bypass in the Captive Portal of HPE Networking Instant On","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-76730","Hewlett Packard Enterprise (HPE)","Instant ON","Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON AP","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-76729","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Insta","MEDIUM",6.6,"2026-09-29",0],["CVE-2026-76728","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networki","HIGH",7.2,"2026-09-29",0],["CVE-2026-76727","Hewlett Packard Enterprise (HPE)","Instant ON","Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON","HIGH",7.2,"2026-09-29",0],["CVE-2026-76726","Hewlett Packard Enterprise (HPE)","Instant ON","Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON ","HIGH",8.1,"2026-09-29",0],["CVE-2026-76725","Hewlett Packard Enterprise (HPE)","Instant ON","Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-76724","Hewlett Packard Enterprise (HPE)","Instant ON","Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-76723","Hewlett Packard Enterprise (HPE)","Instant ON","Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-76722","Hewlett Packard Enterprise (HPE)","Instant ON","Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Serv","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-76721","Hewlett Packard Enterprise (HPE)","Instant ON","Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networ","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-61519","Liberu Software","Liberu CRM","Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()","HIGH",8.7,"2026-09-29",0],["CVE-2026-102831","jupyterlab","jupyterlab","JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the sy","HIGH",8.1,"2026-09-29",0],["CVE-2026-102830","jupyterlab","jupyterlab","JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyter","MEDIUM",6.8,"2026-09-29",0],["CVE-2026-102829","steveukx","git-js","simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection","CRITICAL",9.2,"2026-09-29",0],["CVE-2026-102616","risesoft-y9","WorkFlow-Engine","risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java g","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102828","steveukx","git-js","simple-git unsafe-operation guard does not block trailer command configuration","CRITICAL",9.2,"2026-09-29",0],["CVE-2026-102827","steveukx","git-js","simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/","HIGH",8.1,"2026-09-29",0],["CVE-2026-102826","steveukx","git-js","simple-git allows command execution through unblocked Git configuration includes","HIGH",8.1,"2026-09-29",0],["CVE-2026-102825","Eugeny","russh","Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime ","LOW",3.7,"2026-09-29",0],["CVE-2026-102824","Eugeny","russh","Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102823","Eugeny","russh","russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never ","HIGH",7.5,"2026-09-29",0],["CVE-2026-102822","Eugeny","russh","russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-ind","LOW",3.7,"2026-09-29",0],["CVE-2026-102821","Eugeny","russh","Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-102820","Eugeny","russh","pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a mali","MEDIUM",6.2,"2026-09-29",0],["CVE-2026-84414","IBM","i","IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentic","HIGH",7.8,"2026-09-29",0],["CVE-2026-102730","Eclipse Foundation","eclipse-threadx/levelx(NAND driver)","Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbo","HIGH",8.6,"2026-09-29",0],["CVE-2026-102729","Eclipse Foundation","GUIX","`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and alloca","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-102727","Eclipse Foundation","NetX Duo","FTP Passive Data Connection Not Bound to the Authenticated Control Peer","MEDIUM",6,"2026-09-29",0],["CVE-2026-102639","MobilityDB","MobilityDB","MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization","HIGH",7.1,"2026-09-29",0],["CVE-2026-84421","IBM","DataStage on Cloud Pak for Data","DataStage on Cloud Pak for Data has several vulnerabilities","HIGH",8.8,"2026-09-29",0],["CVE-2026-84422","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.2,"2026-09-29",0],["CVE-2026-102728","Eclipse Foundation","NetX Duo","Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-suppli","HIGH",7.5,"2026-09-29",0],["CVE-2026-84436","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-102726","Eclipse Foundation","NetX Duo","Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read","MEDIUM",6,"2026-09-29",0],["CVE-2026-102725","Eclipse Foundation","NetX Duo","Out-of-bounds Read from Unvalidated MSRP Attribute List Length","MEDIUM",6,"2026-09-29",0],["CVE-2026-84440","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.5,"2026-09-29",0],["CVE-2026-102724","Eclipse Foundation","NetX Duo","NULL Pointer Dereference When Evicting the Sole MSRP Attribute","MEDIUM",6,"2026-09-29",0],["CVE-2026-102723","Eclipse Foundation","NetX Duo","NULL Pointer Dereference on MSRP Attribute Table Exhaustion","MEDIUM",6,"2026-09-29",0],["CVE-2026-84842","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.1,"2026-09-29",0],["CVE-2026-102722","Eclipse Foundation","NetX Duo","In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `2","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102242","Google","MCP Toolbox for Databases","Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases","HIGH",8.6,"2026-09-29",0],["CVE-2026-102721","Eclipse Foundation","NetX Duo","A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes ","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102720","Eclipse Foundation","eclipse-threadx/netxduo","A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-12345","Python Software Foundation","CPython","Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the te","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-102719","Eclipse Foundation","netxduo","Predictable DTLS HelloVerifyRequest Cookie in NetX Secure","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-102718","Eclipse Foundation","NetX Duo","hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the cla","HIGH",8.7,"2026-09-29",0],["CVE-2026-102716","Eclipse Foundation","eclipse-threadx/netxduo","An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen r","HIGH",8.7,"2026-09-29",0],["CVE-2026-102677","electron","electron","Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","HIGH",7.8,"2026-09-29",0],["CVE-2026-102715","Eclipse Foundation","eclipse-threadx/netxduo","mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and th","HIGH",7.1,"2026-09-29",0],["CVE-2026-102714","Eclipse Foundation","NetX Duo","`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/s","HIGH",7.1,"2026-09-29",0],["CVE-2026-102713","Eclipse Foundation","NetX Duo","The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shor","HIGH",8.8,"2026-09-29",0],["CVE-2026-102712","Eclipse Foundation","NetX Duo","On the first DTLS ClientHello, the parser copies a device-claimed session_id length and va","HIGH",8.8,"2026-09-29",0],["CVE-2026-102711","Eclipse Foundation","`eclipse-threadx/threadx` (module manager / loadable-module loader)","Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-","MEDIUM",5.6,"2026-09-29",0],["CVE-2026-102710","Eclipse Foundation","eclipse-threadx/threadx","Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECT","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-102709","Eclipse Foundation","ThreadX","Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callabl","HIGH",8.4,"2026-09-29",0],["CVE-2026-102762","Eclipse Foundation","NetX Duo","The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malfo","HIGH",8.2,"2026-09-29",0],["CVE-2026-95305","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remot","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-95340","Google","Chrome","Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowe","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95364","Google","Chrome","Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a r","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95296","Google","Chrome","Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a ","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95316","Google","Chrome","Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a lo","LOW",2.9,"2026-09-29",0],["CVE-2026-95328","Google","Chrome","Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a ","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95342","Google","Chrome","Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attac","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95288","Google","Chrome","UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95309","Google","Chrome","UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95361","Google","Chrome","Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attac","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95380","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker lev","HIGH",8.8,"2026-09-29",0],["CVE-2026-95319","Google","Chrome","Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.3,"2026-09-29",0],["CVE-2026-95326","Google","Chrome","Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote a","HIGH",8.4,"2026-09-29",0],["CVE-2026-95368","Google","Chrome","Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remo","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95385","Google","Chrome","Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior t","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95279","Google","Chrome","UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allo","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95292","Google","Chrome","Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a ","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-95308","Google","Chrome","Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attac","LOW",3.4,"2026-09-29",0],["CVE-2026-95352","Google","Chrome","Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remo","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95367","Google","Chrome","Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote ","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-95278","Google","Chrome","Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote","HIGH",8.4,"2026-09-29",0],["CVE-2026-95327","Google","Chrome","Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote at","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95334","Google","Chrome","Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allow","HIGH",8.3,"2026-09-29",0],["CVE-2026-95285","Google","Chrome","Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 all","HIGH",8.4,"2026-09-29",0],["CVE-2026-95307","Google","Chrome","UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a r","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95333","Google","Chrome","Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacke","HIGH",8.1,"2026-09-29",0],["CVE-2026-95358","Google","Chrome","Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 al","MEDIUM",4.4,"2026-09-29",0],["CVE-2026-95289","Google","Chrome","Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-95311","Google","Chrome","Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95344","Google","Chrome","Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8,"2026-09-29",0],["CVE-2026-95347","Google","Chrome","Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remo","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95312","Google","Chrome","Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote att","LOW",3.1,"2026-09-29",0],["CVE-2026-95321","Google","Chrome","UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 all","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95323","Google","Chrome","UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95332","Google","Chrome","Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.5","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-95275","Google","Chrome","Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allo","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95300","Google","Chrome","Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-95325","Google","Chrome","Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95374","Google","Chrome","Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remot","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95290","Google","Chrome","Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote atta","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95336","Google","Chrome","Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed ","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95354","Google","Chrome","Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.3,"2026-09-29",0],["CVE-2026-95384","Google","Chrome","Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a ","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-95341","Google","Chrome","Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a rem","HIGH",8.3,"2026-09-29",0],["CVE-2026-95353","Google","Chrome","Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.8,"2026-09-29",0],["CVE-2026-95363","Google","Chrome","UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remot","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95371","Google","Chrome","Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95276","Google","Chrome","Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remo","HIGH",8.3,"2026-09-29",0],["CVE-2026-95295","Google","Chrome","Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a loc","MEDIUM",4.6,"2026-09-29",0],["CVE-2026-95314","Google","Chrome","Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote at","HIGH",8.1,"2026-09-29",0],["CVE-2026-95360","Google","Chrome","Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacke","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-95303","Google","Chrome","Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote a","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95317","Google","Chrome","Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a ","LOW",3.1,"2026-09-29",0],["CVE-2026-95330","Google","Chrome","Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a r","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95345","Google","Chrome","Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker ","HIGH",8.8,"2026-09-29",0],["CVE-2026-95370","Google","Chrome","Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remo","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95294","Google","Chrome","UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95320","Google","Chrome","Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remo","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95337","Google","Chrome","UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 all","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95346","Google","Chrome","UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remot","MEDIUM",4.8,"2026-09-29",0],["CVE-2026-95359","Google","Chrome","Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowe","LOW",3.4,"2026-09-29",0],["CVE-2026-95362","Google","Chrome","Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a r","HIGH",8.8,"2026-09-29",0],["CVE-2026-95369","Google","Chrome","Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remo","HIGH",8.8,"2026-09-29",0],["CVE-2026-95376","Google","Chrome","Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowe","HIGH",8,"2026-09-29",0],["CVE-2026-95297","Google","Chrome","Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed ","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95302","Google","Chrome","Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 a","LOW",2.9,"2026-09-29",0],["CVE-2026-95331","Google","Chrome","Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote atta","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95375","Google","Chrome","Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a re","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-95287","Google","Chrome","Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remo","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95366","Google","Chrome","Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote ","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95381","Google","Chrome","Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a re","HIGH",8.3,"2026-09-29",0],["CVE-2026-95382","Google","Chrome","Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95299","Google","Chrome","Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95304","Google","Chrome","Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacke","HIGH",8.8,"2026-09-29",0],["CVE-2026-95306","Google","Chrome","Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to ","HIGH",8.8,"2026-09-29",0],["CVE-2026-95351","Google","Chrome","Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker ","HIGH",8.3,"2026-09-29",0],["CVE-2026-95280","Google","Chrome","Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to ","HIGH",7.5,"2026-09-29",0],["CVE-2026-95286","Google","Chrome","Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.8,"2026-09-29",0],["CVE-2026-95343","Google","Chrome","Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.8,"2026-09-29",0],["CVE-2026-95365","Google","Chrome","Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attac","HIGH",8.8,"2026-09-29",0],["CVE-2026-95318","Google","Chrome","Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95335","Google","Chrome","Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker wh","HIGH",8.3,"2026-09-29",0],["CVE-2026-95338","Google","Chrome","Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker","HIGH",8.8,"2026-09-29",0],["CVE-2026-95348","Google","Chrome","Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attac","HIGH",8.3,"2026-09-29",0],["CVE-2026-95274","Google","Chrome","Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a rem","HIGH",8.3,"2026-09-29",0],["CVE-2026-95277","Google","Chrome","Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker ","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95282","Google","Chrome","Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.8,"2026-09-29",0],["CVE-2026-95293","Google","Chrome","Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote att","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-95373","Google","Chrome","Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attack","HIGH",8.8,"2026-09-29",0],["CVE-2026-95283","Google","Chrome","Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a re","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95324","Google","Chrome","Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote att","LOW",3.4,"2026-09-29",0],["CVE-2026-95372","Google","Chrome","Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote atta","HIGH",8.3,"2026-09-29",0],["CVE-2026-95291","Google","Chrome","UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-95298","Google","Chrome","Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker","HIGH",7.8,"2026-09-29",0],["CVE-2026-95315","Google","Chrome","Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to","HIGH",7.8,"2026-09-29",0],["CVE-2026-95355","Google","Chrome","Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 al","HIGH",8.3,"2026-09-29",0],["CVE-2026-95301","Google","Chrome","Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remo","HIGH",8.1,"2026-09-29",0],["CVE-2026-95310","Google","Chrome","Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attack","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95329","Google","Chrome","Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95356","Google","Chrome","Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote at","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95284","Google","Chrome","Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a r","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95313","Google","Chrome","Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote atta","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95322","Google","Chrome","Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a","HIGH",8.3,"2026-09-29",0],["CVE-2026-95349","Google","Chrome","Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a r","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95281","Google","Chrome","Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a r","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95339","Google","Chrome","Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote a","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95357","Google","Chrome","Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-95350","Google","Chrome","Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a r","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102761","Eclipse Foundation","NetX Duo","NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-102760","Eclipse Foundation","NetX Duo","When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active s","HIGH",8.3,"2026-09-29",0],["CVE-2026-102759","Eclipse Foundation","NetX Duo","NetX Secure TLS accepts an empty application-data record without verifying its message aut","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-102758","Eclipse Foundation","NetX Duo","The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) ","HIGH",7.5,"2026-09-29",0],["CVE-2026-102757","Eclipse Foundation","ThreadX","An unprivileged, memory-protected ThreadX module can have the kernel read and write memory","HIGH",8.5,"2026-09-29",0],["CVE-2026-102811","rochacbruno","marmite","Marmite through 0.4.2 Unauthenticated API Access via Development Server","HIGH",8.7,"2026-09-29",0],["CVE-2026-102810","rochacbruno","marmite","Marmite through 0.4.2 Path Traversal via Development Server","HIGH",8.7,"2026-09-29",0],["CVE-2026-102808","PX4","PX4-Autopilot","PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress","HIGH",7.1,"2026-09-29",0],["CVE-2026-102809","PX4","PX4-Autopilot","PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command","HIGH",7.1,"2026-09-29",0],["CVE-2026-102807","OpenClaw","OpenClaw","OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket","MEDIUM",6,"2026-09-29",0],["CVE-2026-102806","OpenClaw","OpenClaw","OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines","MEDIUM",6,"2026-09-29",0],["CVE-2026-102560","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth","HIGH",8.6,"2026-09-29",0],["CVE-2026-102559","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow during websocket client-frame masking","HIGH",8.6,"2026-09-29",0],["CVE-2026-102558","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth","HIGH",8.6,"2026-09-29",0],["CVE-2026-102555","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decodin","HIGH",8.2,"2026-09-29",0],["CVE-2026-102424","balbooa.com","Balbooa Forms extension for Joomla","Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files th","HIGH",8.9,"2026-09-29",0],["CVE-2026-102623","Red Hat","Red Hat OpenShift Virtualization 4","Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-102425","balbooa.com","Balbooa Forms extension for Joomla","Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balb","CRITICAL",9.5,"2026-09-29",0],["CVE-2026-101126","balbooa.com","Balbooa Forms extension for Joomla","Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-101112","balbooa.com","Balbooa Forms extension for Joomla","Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-101127","balbooa.com","Balbooa Forms extension for Joomla","Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa For","HIGH",8.6,"2026-09-29",0],["CVE-2026-102676","electron","electron","Electron: <webview> can enable Node.js integration in Web Workers despite embedder restric","HIGH",8.3,"2026-09-29",0],["CVE-2026-102796","Wikimedia Foundation","Mediawiki - UserPageViewTracker Extension","Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers param","HIGH",7.5,"2026-09-29",0],["CVE-2026-102675","electron","electron","Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled","HIGH",7.4,"2026-09-29",0],["CVE-2026-100245","Wikimedia Foundation","Mediawiki - Wikibase Extension","Stored XSS on Wikibase Special:SetSiteLink via unescaped system message","MEDIUM",6.1,"2026-09-29",0],["CVE-2026-102674","electron","electron","Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox re","HIGH",8.2,"2026-09-29",0],["CVE-2026-100244","Wikimedia Foundation","Mediawiki - CentralAuth Extension","CentralAuth exposes locally suppressed block information via globaluserinfo API and Specia","HIGH",7.5,"2026-09-29",0],["CVE-2026-102697","ollama","ollama","Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Autho","HIGH",8.5,"2026-09-29",0],["CVE-2026-90915","Joomla! Project","Joomla! CMS","Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in ","HIGH",7,"2026-09-29",0],["CVE-2026-92226","Joomla! Project","Joomla! CMS","Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in","HIGH",7,"2026-09-29",0],["CVE-2026-92224","Joomla! Project","Joomla! CMS","Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-90907","Joomla! Project","Joomla! CMS","Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save con","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-100243","Wikimedia Foundation","Mediawiki - WikiSEO Extension","Stored XSS in WikiSEO author and image properties on action=info","MEDIUM",6.1,"2026-09-29",0],["CVE-2026-90914","Joomla! Project","Joomla! CMS","Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-92231","Joomla! Project","Joomla! CMS","Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decod","HIGH",7.1,"2026-09-29",0],["CVE-2026-100242","Wikimedia Foundation","Mediawiki - DataTransfer Extension","DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memor","HIGH",7.5,"2026-09-29",0],["CVE-2026-90918","Joomla! Project","Joomla! CMS","Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-92222","Joomla! Project","Joomla! CMS","Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0","HIGH",8.9,"2026-09-29",0],["CVE-2026-102673","electron","electron","Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTa","HIGH",8.2,"2026-09-29",0],["CVE-2026-92223","Joomla! Project","Joomla! CMS","Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Jooml","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-90917","Joomla! Project","Joomla! CMS","Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joom","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-92225","Joomla! Project","Joomla! CMS","Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-92227","Joomla! Project","Joomla! CMS","Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in","HIGH",8.2,"2026-09-29",0],["CVE-2026-92232","Joomla! Project","Joomla! CMS","Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace charact","HIGH",7.1,"2026-09-29",0],["CVE-2026-90916","Joomla! Project","Joomla! CMS","Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view ","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-100241","Wikimedia Foundation","Mediawiki - EventBus Extension","Private change tags exposed to anonymous users via revision-tags-change events","HIGH",7.5,"2026-09-29",0],["CVE-2026-90913","Joomla! Project","Joomla! CMS","Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoin","HIGH",7,"2026-09-29",0],["CVE-2026-90906","Joomla! Project","Joomla! CMS","Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-100240","Wikimedia Foundation","Mediawiki - TemplateSandbox Extension","TemplateSandbox does not check read permissions for the page being previewed","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-100238","Wikimedia Foundation","Mediawiki - Flow Extension","Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored X","MEDIUM",6.1,"2026-09-29",0],["CVE-2026-102557","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow during websocket message reassembly","HIGH",8.6,"2026-09-29",0],["CVE-2026-102556","Red Hat","Red Hat Enterprise Linux 10","Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion","HIGH",8.6,"2026-09-29",0],["CVE-2026-102635","ImageMagick","ImageMagick","ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Deco","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-102634","sgl-project","sglang","SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room","HIGH",8.7,"2026-09-29",0],["CVE-2022-51019","akaunting","akaunting","Akaunting before 2.1.31 OS Command Injection via app alias","HIGH",8.7,"2026-09-29",0],["CVE-2026-102633","libexpat","libexpat","libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc","HIGH",8.2,"2026-09-29",0],["CVE-2026-97711","yahoo","serialize-javascript","Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized fun","LOW",2.3,"2026-09-29",0],["CVE-2026-100289","Devolutions","Server","Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5","MEDIUM",5,"2026-09-29",0],["CVE-2026-100288","Devolutions","Server","Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.","HIGH",7.2,"2026-09-29",0],["CVE-2026-92370","TeamViewer","Full Client","Remote Session Access Control Bypass Leading to Remote Code Execution","HIGH",8.8,"2026-09-29",0],["CVE-2026-102630","unopim","unopim","UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host","LOW",2.3,"2026-09-29",0],["CVE-2026-92371","TeamViewer","Full Client","Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording","HIGH",7,"2026-09-29",0],["CVE-2026-92368","TeamViewer","Full Client","Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code E","HIGH",7.8,"2026-09-29",0],["CVE-2026-92369","TeamViewer","Full Client","Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback","HIGH",7.3,"2026-09-29",0],["CVE-2026-19743","TeamViewer","Full Client","Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer","HIGH",7.8,"2026-09-29",0],["CVE-2026-100287","Devolutions","Server","Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and e","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-97689","urllib3","urllib3","urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into me","HIGH",8.9,"2026-09-29",0],["CVE-2026-100286","Devolutions","Server","Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-84784","OpenSSL","OpenSSL","QUIC: Unbounded RETIRE_CONNECTION_ID Backlog","HIGH",7.5,"2026-09-29",0],["CVE-2026-84783","OpenSSL","OpenSSL","Use-After-Free in X.509 Extension Cache Under Concurrent Use","HIGH",7.5,"2026-09-29",0],["CVE-2026-84782","OpenSSL","OpenSSL","DTLS Retransmits Handshake Messages From a Stale Buffer Offset","HIGH",8.2,"2026-09-29",0],["CVE-2026-77696","OpenSSL","OpenSSL","Timing Side-Channel in SM2 Signature Generation","LOW",3.7,"2026-09-29",0],["CVE-2026-75806","OpenSSL","OpenSSL","Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-75805","OpenSSL","OpenSSL","NULL Pointer Dereference in CMP Client Revocation Response Handling","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-75804","OpenSSL","OpenSSL","QUIC Connection-Level Flow Control is Not Enforced for Streams","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-72897","OpenSSL","OpenSSL","Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake","HIGH",7.5,"2026-09-29",0],["CVE-2026-54875","OpenSSL","OpenSSL","Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V","LOW",3.7,"2026-09-29",0],["CVE-2026-97688","urllib3","urllib3","urllib3: Chunked Deflate streaming can enter an infinite loop","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-54873","OpenSSL","OpenSSL","QUIC STREAM Fragment Metadata DoS","HIGH",7.5,"2026-09-29",0],["CVE-2026-54872","OpenSSL","OpenSSL","Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves","LOW",3.7,"2026-09-29",0],["CVE-2026-42772","OpenSSL","OpenSSL","Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-35191","OpenSSL","OpenSSL","QUIC Unvalidated Amplification Credit may be Over Accounted","LOW",3.7,"2026-09-29",0],["CVE-2026-35189","OpenSSL","OpenSSL","Excessive Memory Allocation in Relative CRLDP Processing","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-97687","urllib3","urllib3","urllib3: HTTPS proxy TLS configuration may be ignored or overridden","HIGH",7.6,"2026-09-29",0],["CVE-2026-93332","Devolutions","Server","Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-102601","thephpleague","flysystem","Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is b","LOW",3.5,"2026-09-29",0],["CVE-2026-93330","Devolutions","Server","Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102600","socketio","socket.io","Socket.IO: Prototype Pollution via Unsafe Client Session Lookup","HIGH",7.5,"2026-09-29",0],["CVE-2026-102598","pallets","werkzeug","Werkzeug safe_join() allows Windows special device names","MEDIUM",6.3,"2026-09-29",0],["CVE-2023-54400","Fumasoft","Fumeng Cloud","Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-100308","AWS","gluonts","GluonTS arbitrary command execution during model deserialization","HIGH",8.4,"2026-09-29",0],["CVE-2026-68911","nicotine-plus","nicotine-plus","Nicotine+: Decompression of peer messages can exhaust available memory","HIGH",8.7,"2026-09-29",0],["CVE-2026-63209","klauspost","compress","Integer Overflow or Wraparound and Out-of-bounds Write in compress","HIGH",7.5,"2026-09-29",0],["CVE-2015-20122","Yonyou","A6 OA","Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp","HIGH",8.7,"2026-09-29",0],["CVE-2026-86035","WeblateOrg","weblate","Weblate: Mercurial argument injection via repository filenames allows authenticated comman","HIGH",8.5,"2026-09-29",0],["CVE-2026-49243","webmin","webmin","Webmin: Reflected XSS in the Configuration module","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-102491","mahonelau","kykms","mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-22094","EVbee","DC 80","Weak root password in EVbee DC 80","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-22101","EVbee","DC-80","Sensitive information leak through hidden menu","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-102569","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter","HIGH",7,"2026-09-29",0],["CVE-2026-102570","MacWarrior","clipbucket-v5","ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter","HIGH",7,"2026-09-29",0],["CVE-2026-102568","pardus","pardus-parental-control","Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py","MEDIUM",6.8,"2026-09-29",0],["CVE-2026-102566","OpenNMT","CTranslate2","CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin","HIGH",8.5,"2026-09-29",0],["CVE-2026-102567","OpenNMT","CTranslate2","CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization","MEDIUM",6.9,"2026-09-29",0],["CVE-2025-33207","NVIDIA","BlueField GA","NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user ","MEDIUM",6.8,"2026-09-29",0],["CVE-2026-102371","Canonical","Ubuntu Pro for WSL","wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments","MEDIUM",5.7,"2026-09-29",0],["CVE-2026-65102","NVIDIA","DeepStream","NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overfl","HIGH",7.8,"2026-09-29",0],["CVE-2026-97395","Apache Software Foundation","Apache Polaris","Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO req","HIGH",8.1,"2026-09-29",0],["CVE-2026-86450","Parla Auto Automotive Trading Limited Company","DetaWix Mobile Web Portal","Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal","HIGH",7.5,"2026-09-29",0],["CVE-2026-102521","dmonad","lib0","lib0 `readFromDataView` out-of-bounds read","HIGH",8.6,"2026-09-29",0],["CVE-2026-71897","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-102360","dmonad","lib0","lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, discl","HIGH",8.6,"2026-09-29",0],["CVE-2026-71898","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute ","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-71899","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-78214","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-81569","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized ","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-4034","Tibco","Administrator","TIBCO Administrator Injection Vulnerability","HIGH",8.7,"2026-09-29",0],["CVE-2026-82804","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Command Injection in the Alert Script Plugin","HIGH",8.8,"2026-09-29",0],["CVE-2026-76875","PyPy","PyPy","PyPy pyexpat ExternalEntityParserCreate Use-After-Free","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-100831","Mozilla","Firefox","Use-after-free in the DOM: UI Events & Focus Handling component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100832","Mozilla","Firefox","Use-after-free in the Graphics: Canvas2D component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100829","Mozilla","Firefox","Mitigation bypass in the DOM: Security component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100830","Mozilla","Firefox","Mitigation bypass in the DOM: Navigation component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100826","Mozilla","Firefox","Denial-of-service in the Storage: StorageManager component","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-100828","Mozilla","Firefox","Mitigation bypass in the Bookmarks & History component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100824","Mozilla","Firefox","Privilege escalation in the Places component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100825","Mozilla","Firefox","Use-after-free in the JavaScript Engine: JIT component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100823","Mozilla","Firefox","Spoofing issue in the Downloads component in Firefox for Android","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-100821","Mozilla","Firefox","Site isolation issue in the Panning and Zooming component","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-100822","Mozilla","Firefox","Spoofing issue in the Networking: HTTP component","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-100819","Mozilla","Firefox","Sandbox escape due to incorrect boundary conditions in the XPCOM component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100820","Mozilla","Thunderbird","Privilege escalation in the Address Bar component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100817","Mozilla","Thunderbird","Other issue in the JavaScript: WebAssembly component","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-100818","Mozilla","Thunderbird","Sandbox escape due to use-after-free in the Widget: Gtk component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100816","Mozilla","Firefox","Site isolation issue in the DOM: Networking component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100814","Mozilla","Firefox","Incorrect boundary conditions in the JavaScript Engine: JIT component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100815","Mozilla","Firefox","Use-after-free in the CSS Parsing and Computation component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100812","Mozilla","Firefox","Denial-of-service in the Graphics component","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-100813","Mozilla","Thunderbird","Invalid pointer in the JavaScript Engine: JIT component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100810","Mozilla","Thunderbird","Other issue in the DevTools component","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-100811","Mozilla","Thunderbird","Sandbox escape due to use-after-free in the DOM: Core & HTML component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100809","Mozilla","Firefox","Same-origin policy bypass in the DevTools component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100807","Mozilla","Thunderbird","Privilege escalation in the DOM: Service Workers component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100808","Mozilla","Firefox","Mitigation bypass in the DOM: Service Workers component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100805","Mozilla","Thunderbird","Race condition, use-after-free in the Audio/Video component","HIGH",7.5,"2026-09-29",0],["CVE-2026-100806","Mozilla","Firefox","Uninitialized memory in the Graphics: WebGPU component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100803","Mozilla","Firefox","Same-origin policy bypass in the WebExtensions component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100804","Mozilla","Thunderbird","Sandbox escape due to use-after-free in the Preferences: Backend component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100801","Mozilla","Thunderbird","Privilege escalation in the DLL Services component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100802","Mozilla","Thunderbird","Uninitialized memory in the Graphics: WebGPU component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100800","Mozilla","Firefox","Sandbox escape due to use-after-free in the Disability Access APIs component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100798","Mozilla","Firefox","Cryptography misuse in Storage: Quota Manager component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100799","Mozilla","Thunderbird","Uninitialized memory in the Graphics: WebGPU component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100796","Mozilla","Thunderbird","Use-after-free in the JavaScript: WebAssembly component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100797","Mozilla","Firefox","Privilege escalation due to use-after-free in the Graphics: WebRender component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100795","Mozilla","Thunderbird","Denial-of-service in the Networking component","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-96869","Mozilla","Thunderbird","Information disclosure in the Networking component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100793","Mozilla","Thunderbird","JIT miscompilation in the JavaScript Engine component","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-100794","Mozilla","Thunderbird","Sandbox escape due to incorrect boundary conditions in the Internationalization component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100792","Mozilla","Thunderbird","JIT miscompilation in the JavaScript: WebAssembly component","HIGH",7.1,"2026-09-29",0],["CVE-2026-100790","Mozilla","Firefox","Use-after-free in the XSLT component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100791","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100788","Mozilla","Thunderbird","Invalid pointer in the JavaScript: WebAssembly component","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-100789","Mozilla","Firefox","Use-after-free in the Graphics: Canvas2D component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100786","Mozilla","Firefox","Sandbox escape due to use-after-free in the Graphics component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100787","Mozilla","Firefox","Sandbox escape in the XUL component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100784","Mozilla","Firefox","Use-after-free in the Layout: Text and Fonts component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100785","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100783","Mozilla","Firefox","Uninitialized memory in the Audio/Video component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100781","Mozilla","Firefox","Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100782","Mozilla","Firefox","Privilege escalation due to incorrect boundary conditions in the Graphics component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100779","Mozilla","Firefox","Use-after-free in the XSLT component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100780","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100777","Mozilla","Firefox","Use-after-free in the Graphics: Canvas2D component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100778","Mozilla","Firefox","Sandbox escape due to use-after-free in the DOM: Core & HTML component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100776","Mozilla","Thunderbird","Use-after-free in the JavaScript: WebAssembly component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100774","Mozilla","Firefox","Use-after-free in the DOM: Core & HTML component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100775","Mozilla","Firefox","Sandbox escape in the Graphics component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100772","Mozilla","Thunderbird","Use-after-free in the DOM: Core & HTML component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100773","Mozilla","Firefox","Use-after-free in the Storage: IndexedDB component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100770","Mozilla","Firefox","Sandbox escape due to use-after-free in the DOM: Content Processes component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100771","Mozilla","Firefox","Undefined behavior in the DOM: Streams component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100769","Mozilla","Thunderbird","Use-after-free in the JavaScript: WebAssembly component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100767","Mozilla","Firefox","Use-after-free in the Networking: Cache component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100768","Mozilla","Thunderbird","Use-after-free in the Graphics: WebGPU component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100765","Mozilla","Firefox","Use-after-free in the JavaScript: WebAssembly component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100766","Mozilla","Firefox","Information disclosure in the Networking: JAR component","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-100764","Mozilla","Thunderbird","Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU componen","HIGH",8.8,"2026-09-29",0],["CVE-2026-100762","Mozilla","Firefox","Sandbox escape due to use-after-free in the DOM: Content Processes component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100763","Mozilla","Thunderbird","Incorrect boundary conditions in the Graphics: WebGPU component","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-100760","Mozilla","Firefox","Sandbox escape in the Security: Process Sandboxing component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100761","Mozilla","Thunderbird","Privilege escalation due to use-after-free in the Graphics: WebGPU component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100759","Mozilla","Firefox","Uninitialized memory in the Storage: Quota Manager component","HIGH",8.1,"2026-09-29",0],["CVE-2026-100757","Mozilla","Firefox","Use-after-free in the Widget component","HIGH",8.8,"2026-09-29",0],["CVE-2026-100758","Mozilla","Firefox","Sandbox escape in the DOM: Navigation component","CRITICAL",9.6,"2026-09-29",0],["CVE-2026-100756","Mozilla","Firefox","Incorrect boundary conditions in the Audio/Video: Playback component","HIGH",8.1,"2026-09-29",0],["CVE-2026-76114","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-82973","psyb0t","docker-mailbox","Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-7192","Shenzhen Dbit Network Equipment","T-CPE301K 4G Mini WiFi Router","Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network E","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-7193","Shenzhen Dbit Network Equipment","T-CPE301K 4G Mini WiFi Router","Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network E","HIGH",8.6,"2026-09-29",0],["CVE-2026-102437","esengine","DeepSeek-Reasonix","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH",7.8,"2026-09-29",0],["CVE-2026-73599","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-101271","pretix","pretix","OAuth credentials not disabled when application is disabled","LOW",2.1,"2026-09-29",0],["CVE-2026-98164","Linux","Linux","KVM: x86/mmu: Check write tracking in all address spaces","HIGH",7.1,"2026-09-29",0],["CVE-2026-101270","pretix","pretix","HTML injection","LOW",2.1,"2026-09-29",0],["CVE-2026-101269","pretix","pretix","Incorrect session validation for API-uploaded files","LOW",2.3,"2026-09-29",0],["CVE-2026-101268","pretix","pretix","Customer session fixation","LOW",1.7,"2026-09-29",0],["CVE-2026-73598","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","HIGH",7.8,"2026-09-29",0],["CVE-2026-101267","pretix","pretix","Revenue information leak","LOW",2.7,"2026-09-29",0],["CVE-2026-73597","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-101266","pretix","pretix","Checkout validation bypass","LOW",1.3,"2026-09-29",0],["CVE-2026-73596","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3.8,"2026-09-29",0],["CVE-2026-87748","Interprobe Information Technologies Inc.","Qorela DC","Privilege Escalation via Account Takeover in Interprobe's Qorela DC","HIGH",8.8,"2026-09-29",0],["CVE-2026-102507","BishopFox","sliver","Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC","MEDIUM",6.8,"2026-09-29",0],["CVE-2026-66083","Apache Software Foundation","Apache DolphinScheduler","Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-41875","OpenSolution","Quick.Cart","Cross-Site Request Forgery in admin panel of Quick.Cart","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-73595","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions p","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-102497","Apache Software Foundation","Apache XMLSchema","Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker","HIGH",7.5,"2026-09-29",0],["CVE-2026-102496","Apache Software Foundation","Apache XMLSchema","Apache XMLSchema: Denial of service through deeply nested schema structures","HIGH",7.5,"2026-09-29",0],["CVE-2026-102495","Apache Software Foundation","Apache XMLSchema","Apache XMLSchema: Denial of service through unbounded recursion when resolving schema impo","HIGH",7.5,"2026-09-29",0],["CVE-2026-73594","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions p","MEDIUM",6.4,"2026-09-29",0],["CVE-2026-85520","MyPresta","Google Merchant Center Feed","Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-73593","Dell","Secure Connect Gateway (SCG) Policy Manager","Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a","LOW",3,"2026-09-29",0],["CVE-2026-95520","Red Hat","Red Hat Enterprise Linux 10","Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow wh","HIGH",7.1,"2026-09-29",0],["CVE-2026-95509","qt","Qt for MCUs","Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs","HIGH",8.8,"2026-09-29",0],["CVE-2026-19547","Artifex Software Inc.","Ghostscript","Local Privilege Escalation in Ghostscript for Windows","HIGH",7,"2026-09-29",0],["CVE-2026-76720","Hewlett Packard Enterprise","HPE OneView","HPE OneView - URL Redirect vulnerability","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-15390","DENX Software Engineering","Das U-Boot","Out-of-bounds write in Das U-Boot","CRITICAL",9,"2026-09-29",0],["CVE-2026-76719","Hewlett Packard Enterprise","HPE OneView","HPE OneView - Cross-site scripting vulnerability","HIGH",8.2,"2026-09-29",0],["CVE-2026-86843","Apache Software Foundation","Apache Airflow Teradata provider","Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-81930","Apache Software Foundation","Apache Airflow Snowflake provider","Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer toke","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-81862","Apache Software Foundation","Apache Airflow Teradata provider","Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credenti","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-81914","Apache Software Foundation","Apache Airflow Google provider","Apache Airflow Google provider: Google Drive query injection via unescaped file and folder","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-76718","Hewlett Packard Enterprise","HPE OneView","HPE OneView - Cross-site scripting vulnerability","HIGH",8.2,"2026-09-29",0],["CVE-2026-11796","Hitachi Energy","Asset Suite","Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServ","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-7395","Hitachi Energy","Asset Suite","Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can ","HIGH",8.5,"2026-09-29",0],["CVE-2026-4523","GitLab","GitLab","Missing Authorization in GitLab","LOW",3.7,"2026-09-29",0],["CVE-2026-8937","GitLab","GitLab","Missing Authorization in GitLab","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-10518","GitLab","GitLab","Incorrect Authorization in GitLab","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-84739","GitLab","GitLab","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi","HIGH",8.7,"2026-09-29",0],["CVE-2026-8067","Hitachi Energy","RTU500 series CMU firmware","An improper authorization vulnerability in the end-of-life versions of RTU500’s web applic","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-95391","Wireshark Foundation","Wireshark","Use After Free in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-95389","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","HIGH",8.1,"2026-09-29",0],["CVE-2026-95386","Wireshark Foundation","Wireshark","Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-95390","Wireshark Foundation","Wireshark","NULL Pointer Dereference in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-95395","Wireshark Foundation","Wireshark","Missing Release of Memory after Effective Lifetime in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-95387","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","HIGH",8.1,"2026-09-29",0],["CVE-2026-95394","Wireshark Foundation","Wireshark","Unchecked Input for Loop Condition in Wireshark","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-95393","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-95392","Wireshark Foundation","Wireshark","Buffer Over-read in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-95388","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96422","Wireshark Foundation","Wireshark","Reachable Assertion in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96421","Wireshark Foundation","Wireshark","Improperly Controlled Sequential Memory Allocation in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96417","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96418","Wireshark Foundation","Wireshark","Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96419","Wireshark Foundation","Wireshark","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshar","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96420","Wireshark Foundation","Wireshark","Buffer Over-read in Wireshark","MEDIUM",4.7,"2026-09-29",0],["CVE-2026-96423","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96416","Wireshark Foundation","Wireshark","Heap-based Buffer Overflow in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-96415","Wireshark Foundation","Wireshark","Stack-based Buffer Overflow in Wireshark","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-8066","Hitachi Energy","RTU500 series CMU firmware","A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-102474","Red Hat","Red Hat Enterprise Linux 6","Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservat","MEDIUM",4,"2026-09-29",0],["CVE-2026-102473","Red Hat","Red Hat Enterprise Linux 6","Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled","MEDIUM",5.5,"2026-09-29",0],["CVE-2026-8065","Hitachi Energy","RTU500 series CMU firmware","An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy R","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-96440","Flowring Technology Corp","Agentflow 4.0","Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path ","HIGH",7.1,"2026-09-29",0],["CVE-2026-92142","Apache Software Foundation","Apache Karaf","Apache Karaf: Authorization bypass in JMX MBean lifecycle operations","HIGH",8.8,"2026-09-29",0],["CVE-2026-91085","Apache Software Foundation","Apache Karaf","Apache Karaf: config:install missing ACL entry allows privilege escalation to admin","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-96431","Flowring Technology Corp","Agentflow 4.0","Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-91048","Apache Software Foundation","Apache Karaf","Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-91012","Apache Software Foundation","Apache Karaf","Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-96430","Flowring Technology Corp","Agentflow 4.0","Flowring Agentflow 4.0 - Exposed Dangerous Method or Function","HIGH",8.7,"2026-09-29",0],["CVE-2026-96429","Flowring Technology Corp","Agentflow 4.0","Flowring Agentflow 4.0 - SQL Injection","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-96428","Flowring Technology Corp","Agentflow 4.0","Flowring Agentflow 4.0 - SQL Injection","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-101169","Octopus Deploy","Octopus Server","In affected versions of Octopus Server, an authenticated user with permissions to edit an ","HIGH",8.7,"2026-09-29",0],["CVE-2026-84154","Dassault Systèmes","GEOVIA Geospatial Data Manager","Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPER","CRITICAL",9.9,"2026-09-29",0],["CVE-2026-86158","Progress Software","Progress® Telerik® Fiddler® Everywhere","Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere","HIGH",7.7,"2026-09-29",0],["CVE-2026-86157","Progress Software","Progress® Telerik® Fiddler® Everywhere","Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere","MEDIUM",5.6,"2026-09-29",0],["CVE-2026-102293","realjerrytang","tacomall","realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add imp","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102292","coolbeans1212","MateisHomePage-Website","coolbeans1212 MateisHomePage-Website users.php cross site scripting","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102290","CodeCanyon","Rocket LMS","CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-102264","mwasikz","robo-cafe-rms","mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-102263","mwasikz","robo-cafe-rms","mwasikz robo-cafe-rms manage-food.php unrestricted upload","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-102261","owen2345","Camaleon CMS","owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102422","","shell-quote","shell-quote `quote()` command injection via a line terminator in a token after a `{ commen","CRITICAL",9.2,"2026-09-29",0],["CVE-2026-102249","","REBUILD","REBUILD file-editor-save authorization","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-97029","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group","MEDIUM",5.7,"2026-09-29",0],["CVE-2026-102414","browserify","pbkdf2","pbkdf2 rehashes long passwords on every iteration, enabling denial of service","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-102248","","Rebuild","Rebuild Login Endpoint login improper authentication","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-97024","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory f","HIGH",7.1,"2026-09-29",0],["CVE-2026-102247","","FastAdmin","FastAdmin Database Management database.php unnecessary privileges","HIGH",8.5,"2026-09-29",0],["CVE-2026-102245","MODSetter","SurfSense","MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102244","MODSetter","SurfSense","MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102243","MODSetter","SurfSense","MODSetter SurfSense MCP Connector Integration test command injection","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-97685","LimeSurvey","LimeSurvey","LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST surv","HIGH",7.1,"2026-09-29",0],["CVE-2026-102241","Netcore","NAP930","Netcore NAP930 Backup/Restore backup_common.sh hard-coded key","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-102240","Netcore","NAP930","Netcore NAP930 Network Tools CGI network_tools eval os command injection","CRITICAL",10,"2026-09-29",0],["CVE-2026-101878","bitwarden","bitwarden server","Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation","HIGH",7.7,"2026-09-29",0],["CVE-2026-101860","RaspAP","raspap-webgui","RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges manageme","HIGH",8.7,"2026-09-29",0],["CVE-2026-101859","RaspAP","raspap-webgui","RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injec","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-96326","htplugins","HT Contact Form – Drag & Drop Form Builder for WordPress","HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored ","HIGH",7.2,"2026-09-29",0],["CVE-2026-101858","RaspAP","raspap-webgui","RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injecti","MEDIUM",5.1,"2026-09-29",0],["CVE-2026-101354","FAST","FAC1203R","FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-101281","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_dom","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102374","GestSup","GestSup","GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102373","GestSup","GestSup","GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter","HIGH",7.1,"2026-09-29",0],["CVE-2026-102372","GestSup","GestSup","GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-101280","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authenticat","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-101279","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-101278","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin v","MEDIUM",5.3,"2026-09-29",0],["CVE-2024-31026","","","An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote","CRITICAL",9.8,"2026-09-29",0],["CVE-2024-31027","","","Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platf","MEDIUM",5.4,"2026-09-29",0],["CVE-2026-39117","","","An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-67987","","","crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time","HIGH",7.5,"2026-09-29",0],["CVE-2026-67993","","","basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross","HIGH",8.8,"2026-09-29",0],["CVE-2026-77177","","","Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and ","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-79348","","","KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerabilit","MEDIUM",4.3,"2026-09-29",0],["CVE-2026-79403","","","An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via ","HIGH",8.4,"2026-09-29",0],["CVE-2026-79417","","","Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and ear","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-79534","","","mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an imp","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-79535","","","mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP t","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-79536","","","bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /util","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-79537","","","metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in ","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-79538","","","metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the inte","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-94952","","","A stack-based buffer overflow vulnerability exists in the web management interface of TOTO","CRITICAL",9.8,"2026-09-29",0],["CVE-2026-94953","","","A stack-based buffer overflow vulnerability exists in the web management interface of TOTO","HIGH",8.8,"2026-09-29",0],["CVE-2026-94954","","","A stack-based buffer overflow vulnerability exists in the web management interface of TOTO","HIGH",8.8,"2026-09-29",0],["CVE-2026-101277","Trusted Domain Project","OpenDKIM","Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102367","gz-yami","mall4j","mall4j through 4.0 Insufficient Session Expiration via Token Refresh","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102366","gz-yami","mall4j","mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints","LOW",2.1,"2026-09-29",0],["CVE-2026-102364","gz-yami","mall4j","mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102365","gz-yami","mall4j","mall4j through 4.0 Missing Authorization in Admin User Address Endpoints","HIGH",7.1,"2026-09-29",0],["CVE-2026-102363","gz-yami","mall4j","mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number","MEDIUM",6.3,"2026-09-29",0],["CVE-2026-102361","gz-yami","mall4j","mall4j through 4.0 Missing Authentication in Password Update Endpoint","CRITICAL",9.3,"2026-09-29",0],["CVE-2026-102362","gz-yami","mall4j","mall4j through 4.0 Missing Authentication in Product Review Deletion","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-101265","Intelbras","TIP 125i","Intelbras TIP 125i Básico sensitive information in source","LOW",2.3,"2026-09-29",0],["CVE-2026-18747","zephyrproject","zephyr","Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport lead","MEDIUM",6.8,"2026-09-29",0],["CVE-2026-18746","zephyrproject","zephyr","NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhau","MEDIUM",5.9,"2026-09-29",0],["CVE-2026-18417","zephyrproject","zephyr","Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asyn","MEDIUM",6.5,"2026-09-29",0],["CVE-2026-101264","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 set_passwd command injection","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-101263","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 set_online_client command injection","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-101262","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 set_online_client command injection","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-101261","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 firstSetup_wifi command injection","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-102334","NginxProxyManager","nginx-proxy-manager","Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection","CRITICAL",9.1,"2026-09-29",0],["CVE-2026-102335","NginxProxyManager","nginx-proxy-manager","Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config","HIGH",7.1,"2026-09-29",0],["CVE-2026-102333","cle-b","httpdbg","httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102332","amir20","dozzle","Dozzle before 11.1.2 Path Traversal via Log ZIP Download","MEDIUM",4.6,"2026-09-29",0],["CVE-2026-101260","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 firstLogin command injection","CRITICAL",9.4,"2026-09-29",0],["CVE-2026-102296","ZoneMinder","zoneminder","ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response","HIGH",8.3,"2026-09-29",0],["CVE-2026-102297","ZoneMinder","zoneminder","ZoneMinder before 1.38.4 Incorrect Authorization in frames API index","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-101093","Cotonti","Cotonti","Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-101091","siyuan-note","siyuan","SiYuan before v3.8.4 SQL Injection via Block Query Embed","HIGH",7.1,"2026-09-29",0],["CVE-2026-101092","siyuan-note","siyuan","SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages","MEDIUM",6.9,"2026-09-29",0],["CVE-2024-58386","ZoneMinder","zoneminder","ZoneMinder 1.37.x Path Traversal via files view","HIGH",7.1,"2026-09-29",0],["CVE-2026-101205","FastStone","Image Viewer","FastStone Image Viewer PCX Decoder out-of-bounds","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-101204","FastStone","Image Viewer","FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds","MEDIUM",5.3,"2026-09-29",0],["CVE-2024-42002","Open Source Robotics Foundation","Robot Operating System 2 (ROS 2)","Unsafe use of eval() method in ros2 topic hz tool","HIGH",8.6,"2026-09-29",0],["CVE-2026-101203","FastStone","Image Viewer","FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-102281","nestjs","nest","Nest: Remote process termination via a deeply nested microservice message pattern","HIGH",7.5,"2026-09-29",0],["CVE-2026-101202","FastStone","Image Viewer","FastStone Image Viewer TGA Image out-of-bounds write","MEDIUM",5.3,"2026-09-29",0],["CVE-2026-101188","Netcore","POWER13","Netcore POWER13 ubus routerd.passwd_set password recovery","MEDIUM",6.9,"2026-09-29",0],["CVE-2026-102279","laravel","framework","Laravel: XSS in Debug Page Information","LOW",3.1,"2026-09-28",0],["CVE-2026-102278","juliangruber","brace-expansion","brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhau","HIGH",7.5,"2026-09-28",0],["CVE-2026-97027","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus","LOW",3.6,"2026-09-28",0],["CVE-2026-97026","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path","LOW",3.9,"2026-09-28",0],["CVE-2026-97025","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: world-readable oci authentication token in system-helper cache path","LOW",3.2,"2026-09-28",0],["CVE-2026-102277","juliangruber","brace-expansion","brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of ser","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-102276","juliangruber","brace-expansion","brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustio","HIGH",7.5,"2026-09-28",0],["CVE-2026-102265","jpadilla","pyjwt","PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-102006","Wind River Systems Inc","VxWorks 7","VxWorks 7 Memory allocation","MEDIUM",5.5,"2026-09-28",0],["CVE-2026-102275","jpadilla","pyjwt","PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101187","Ziroom","ZHOME A0101","Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-91096","Facebook","proxygen","In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionSt","HIGH",7.5,"2026-09-28",0],["CVE-2026-91095","Facebook","proxygen","In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportU","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-84895","Facebook","proxygen","In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses","HIGH",7.3,"2026-09-28",0],["CVE-2026-102274","jpadilla","pyjwt","PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set","MEDIUM",5.9,"2026-09-28",0],["CVE-2026-102273","jpadilla","pyjwt","PyJWT accepts public JWK containers as HMAC secrets","HIGH",7.4,"2026-09-28",0],["CVE-2026-102272","jpadilla","pyjwt","PyJWT BOM Bypass","HIGH",7.4,"2026-09-28",0],["CVE-2026-102271","jpadilla","pyjwt","PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 ","HIGH",7.4,"2026-09-28",0],["CVE-2026-101146","Eleveo","Quality Management","Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit informati","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-102270","jpadilla","pyjwt","PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.","MEDIUM",4.4,"2026-09-28",0],["CVE-2026-102269","jpadilla","pyjwt","PyJWT: Non-canonical signature segments enable raw-token revocation bypass","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-102268","jpadilla","pyjwt","PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip th","CRITICAL",9.1,"2026-09-28",0],["CVE-2026-102267","jpadilla","pyjwt","PyJWT: PyJWKClient follows redirects when fetching JWKS","HIGH",7.4,"2026-09-28",0],["CVE-2026-102266","jpadilla","pyjwt","PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","HIGH",7.4,"2026-09-28",0],["CVE-2026-100392","InvoicePlane","InvoicePlane","InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Objec","HIGH",7,"2026-09-28",0],["CVE-2026-102005","Wind River Inc","VxWorks 7","VxWorks Memory Allocation","MEDIUM",5.5,"2026-09-28",0],["CVE-2026-100371","InvoicePlane","InvoicePlane","InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Admini","HIGH",8.7,"2026-09-28",0],["CVE-2026-101145","Eleveo","Call Recording Software","Eleveo Call Recording Software User Management userAddAction.do ldap injection","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101918","jpadilla","pyjwt","PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.g","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101917","jpadilla","pyjwt","PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (inc","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100370","rhukster","dom-sanitizer","DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows ","MEDIUM",4.7,"2026-09-28",0],["CVE-2026-101916","grpc","grpc-node","@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certifica","HIGH",7.4,"2026-09-28",0],["CVE-2026-101144","Eleveo","Call Recording Software","Eleveo Call Recording Software Query Builder searchAction.do access control","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-18416","zephyrproject","zephyr","Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)","LOW",3.7,"2026-09-28",0],["CVE-2026-18415","zephyrproject","zephyr","Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-18414","zephyrproject","zephyr","Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size ","HIGH",7.8,"2026-09-28",0],["CVE-2026-18413","zephyrproject","zephyr","Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer si","HIGH",7.8,"2026-09-28",0],["CVE-2026-16513","zephyrproject","zephyr","Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allo","HIGH",7.8,"2026-09-28",0],["CVE-2026-87741","Brainstorm Force","ConvertPlus","ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parame","HIGH",8.8,"2026-09-28",0],["CVE-2026-101915","grpc","grpc-node","@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the c","LOW",3.7,"2026-09-28",0],["CVE-2026-102004","Wind River Systems Inc","VxWorks 7","VxWorks 7","HIGH",7.8,"2026-09-28",0],["CVE-2026-101143","Eleveo","Quality Management","Eleveo Quality Management QMBODownload information disclosure","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-96760","Authlib","Authlib","Authlib library contains a signature‑verification bypass vulnerability","CRITICAL",9.8,"2026-09-28",0],["CVE-2026-101914","grpc","grpc-node","@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for ca","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101142","Eleveo","Quality Management","Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-93355","BerriAI","litellm","LiteLLM Weak JWT Authentication via Email-Based User Lookup","HIGH",7.6,"2026-09-28",0],["CVE-2026-101141","Eleveo","Call Recording Software","Eleveo Call Recording Software Play Audio audio.jsp cross site scripting","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-86950","Apple","iOS and iPadOS","An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi","HIGH",8.8,"2026-09-28",1],["CVE-2026-101139","Webkul","Bagisto","Webkul Bagisto Invoice Mass Status Update state authorization","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-102010","Red Hat","Red Hat Hardened Images","Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in bina","HIGH",7,"2026-09-28",0],["CVE-2026-97023","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy dir","HIGH",7.1,"2026-09-28",0],["CVE-2026-13018","Google","Chrome","Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.","MEDIUM",4.3,"2026-09-28",0],["CVE-2026-97686","Wind River","VxWorks 7","VxWorks 7 Memory Resource leak","MEDIUM",5.5,"2026-09-28",0],["CVE-2026-101111","ordasoft.com","Book Library (Free) extension for Joomla","Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < ","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101132","DeepSeek","deepseek-harness","DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal","LOW",2.3,"2026-09-28",0],["CVE-2026-101109","ordasoft.com","Vehicle Manager (Free) extension for Joomla","Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free)","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101110","ordasoft.com","Book Library (Free) extension for Joomla","Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-100753","ordasoft.com","Real Estate Manager (Free) extension for Joomla","Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (F","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100752","ordasoft.com","Real Estate Manager (Free) extension for Joomla","Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Fr","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-84894","Meta Platforms, Inc","moxygen","In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream","HIGH",7.5,"2026-09-28",0],["CVE-2026-101108","ordasoft.com","Vehicle Manager (Free) extension for Joomla","Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) ","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-101131","deepseek-ai","deepseek-harness","deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decis","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-101105","code-projects","Matrimonial System","code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_f","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101102","deepseek-ai","deepseek-harness","deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-49994","dannymcc","bluehood","Bluehood: Missing authentication on Bluehood API routes when web auth is enabled","CRITICAL",9.1,"2026-09-28",0],["CVE-2026-55160","stringer-rss","stringer","Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer","HIGH",7.6,"2026-09-28",0],["CVE-2026-101913","beaugunderson","ip-address","ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SS","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-55156","ooples","token-optimizer-mcp","Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-55157","ooples","token-optimizer-mcp","Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","HIGH",8.4,"2026-09-28",0],["CVE-2026-101912","beaugunderson","ip-address","ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as i","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-101911","beaugunderson","ip-address","ip-address: Address6 builds a parse diagnostic proportional to the input with no length bo","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-101910","beaugunderson","ip-address","ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SS","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101101","ag-ui-protocol","ag-ui","ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101909","axios","axios","Axios: Prototype Pollution Gadget in axios toFormData Options","HIGH",8.3,"2026-09-28",0],["CVE-2026-75600","FreePBX","security-reporting","FreePBX: Authenticated API generatedocs Host Command Injection","HIGH",8.6,"2026-09-28",0],["CVE-2026-54710","FreePBX","security-reporting","FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclus","HIGH",8.6,"2026-09-28",0],["CVE-2026-54708","FreePBX","security-reporting","Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module","HIGH",8.6,"2026-09-28",0],["CVE-2026-54675","FreePBX","security-reporting","FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Modu","HIGH",8.7,"2026-09-28",0],["CVE-2026-101908","axios","axios","Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-54674","FreePBX","security-reporting","Authenticated Command Injection in FreePBX UCP Interface","HIGH",8.6,"2026-09-28",0],["CVE-2026-45562","FreePBX","security-reporting","FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module","HIGH",7.7,"2026-09-28",0],["CVE-2026-101907","axios","axios","Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF","HIGH",7,"2026-09-28",0],["CVE-2026-101906","axios","axios","Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redi","HIGH",8.2,"2026-09-28",0],["CVE-2026-101905","axios","axios","Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inher","HIGH",7.6,"2026-09-28",0],["CVE-2026-101100","ag-ui-protocol","ag-ui","ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101904","axios","axios","Axios: Header Injection via Inherited headers After Minimal Interceptor","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-96740","Red Hat","StreamsHub Console for Apache Kafka®","Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka c","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101903","axios","axios","Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","HIGH",8.2,"2026-09-28",0],["CVE-2026-101902","axios","axios","Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototyp","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101901","axios","axios","Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initiali","HIGH",8.2,"2026-09-28",0],["CVE-2026-101099","ag-ui-protocol","ag-ui","ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101900","axios","axios","Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101898","axios","axios","Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","HIGH",7,"2026-09-28",0],["CVE-2026-101098","ag-ui-protocol","ag-ui","ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101894","XhmikosR","decompress","@xhmikosr/decompress: Path traversal via symlink chain","CRITICAL",9.1,"2026-09-28",0],["CVE-2026-101891","WatchGuard","WatchGuard AP","WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-86102","WatchGuard","WatchGuard AP","WatchGuard AP Command Injection in Internal Management API Allows Command Execution","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-87969","WatchGuard","WatchGuard AP","WatchGuard AP Authenticated Command Injection in Diagnostic CLI","HIGH",8.6,"2026-09-28",0],["CVE-2026-87114","Red Hat","Red Hat OpenShift Container Platform 4.19","Kube-compare: container:// reference extraction runs the image entrypoint and silently esc","HIGH",7.1,"2026-09-28",0],["CVE-2026-101083","","PMWeb","PMWeb encryptionhelper.dll information disclosure","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-48100","polybase","payy","Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages","HIGH",8.7,"2026-09-28",0],["CVE-2026-55096","leshchenko1979","fast-mcp-telegram","SSRF via DNS-resolution gap in _validate_url_security (file download by URL)","HIGH",7.1,"2026-09-28",0],["CVE-2026-54160","networkupstools","nut","Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with","HIGH",8.2,"2026-09-28",0],["CVE-2026-101082","","PMWeb","PMWeb downloader.aspx path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101081","D-Link","DI-8400","D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based ","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-85644","","XS-Parse-Keyword","XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array refer","HIGH",7.5,"2026-09-28",0],["CVE-2026-88816","","DBI","DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHas","HIGH",7.5,"2026-09-28",0],["CVE-2026-88815","","DBI","DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type","MEDIUM",6.2,"2026-09-28",0],["CVE-2026-101080","Tencent","AI-Infra-Guard","Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal","LOW",2.4,"2026-09-28",0],["CVE-2026-88804","SUSE","Rancher","Unauthenticated update of public UI settings leading to stored cross-site scripting in Ran","CRITICAL",9.6,"2026-09-28",0],["CVE-2026-88805","SUSE","Rancher","Session Not Revoked Server-Side on Logout in Rancher","HIGH",8.1,"2026-09-28",0],["CVE-2026-101861","langflow-ai","langflow","Langflow Code Execution via eval() in Component Input Schema","LOW",2.1,"2026-09-28",0],["CVE-2026-12342","SailPoint Technologies","IdentityIQ","SailPoint IdentityIQ Improper Form Validation Vulnerability","CRITICAL",9.6,"2026-09-28",0],["CVE-2026-101079","agentverus","agentverus-scanner","agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inpu","LOW",2.4,"2026-09-28",0],["CVE-2026-88808","SUSE","Rancher","Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-name","HIGH",8.8,"2026-09-28",0],["CVE-2026-101078","deepseek-ai","deepseek-harness","deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-91154","MarcosCamara01","Ecommerce Template","Missing authentication in Ecommerce Template product cache revalidation allows unauthentic","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-97399","The GNU C Library","glibc","One-byte overread in strncasecmp on Power8","LOW",3.7,"2026-09-28",0],["CVE-2026-101077","Netcore","NR289-GE","Netcore NR289-GE boa_temp process_request missing authentication","CRITICAL",10,"2026-09-28",0],["CVE-2026-93348","unslothai","unsloth-zoo","Unsloth Zoo Code Injection via model_type in config.json","HIGH",8.6,"2026-09-28",0],["CVE-2026-101076","Netcore","NR289-GE","Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection","CRITICAL",10,"2026-09-28",0],["CVE-2026-93540","SUSE","Rancher","Fleet applies namespace labels and annotations without the bundle's service account privil","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101075","Netcore","NR289-GE","Netcore NR289-GE Location Time location_time.cgi system os command injection","CRITICAL",10,"2026-09-28",0],["CVE-2026-96538","EnterpriseDB","WarehousePG","WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation","HIGH",8.7,"2026-09-28",0],["CVE-2026-101333","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on brok","LOW",3.7,"2026-09-28",0],["CVE-2026-101074","Netcore","NR289-GE","Netcore NR289-GE Authentication boa password-check stack-based overflow","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-4556","Extegrity","Exam4","macOS Exam4 Local Privilege Escalation via Command Injection","HIGH",7.8,"2026-09-28",0],["CVE-2026-70413","Dell","Live Optics Collector","Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded ","MEDIUM",5.6,"2026-09-28",0],["CVE-2026-80359","Dell","Boot Optimized Server Storage (BOSS)","Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-C","MEDIUM",6.8,"2026-09-28",0],["CVE-2026-80358","Dell","Boot Optimized Server Storage (BOSS)","Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-C","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-93539","SUSE","Rancher","Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-80357","Dell","Boot Optimized Server Storage (BOSS)","Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-C","HIGH",7,"2026-09-28",0],["CVE-2026-93538","SUSE","Rancher","Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agen","HIGH",7.1,"2026-09-28",0],["CVE-2026-101073","Netcore","NR289-GE","Netcore NR289-GE CGI Dispatcher boa improper authentication","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-90924","Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.","Logsign SIEM","Default Admin Credentials in Innotim Software's Logsign SIEM","CRITICAL",9.8,"2026-09-28",0],["CVE-2026-90925","Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.","Logsign SIEM","Path Traversal in Innotim Software's Logsign SIEM","HIGH",7.1,"2026-09-28",0],["CVE-2026-90926","Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.","Logsign SIEM","Code Injection in Innotim Software's Logsign SIEM","HIGH",8.8,"2026-09-28",0],["CVE-2026-101072","Netcore","NR289-GE","Netcore NR289-GE CGI ap_ip.cgi system os command injection","CRITICAL",10,"2026-09-28",0],["CVE-2026-101071","Acrel Electric","Unet Web Service","Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-93537","SUSE","Rancher","Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle dir","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-87798","Canonical","LXD","LXD client recursive file pull allows directory escape via malicious VM agent","MEDIUM",5.8,"2026-09-28",0],["CVE-2026-87799","Canonical","LXD","Arbitrary file write on LXD host via symlink in migration stream","CRITICAL",9.9,"2026-09-28",0],["CVE-2026-97335","Canonical","LXD","Incorrect authorization in LXD storage volume API allows reading volumes from other projec","HIGH",7.7,"2026-09-28",0],["CVE-2026-85185","Canonical","LXD","Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on hos","CRITICAL",9.6,"2026-09-28",0],["CVE-2026-85526","Canonical","LXD","Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipula","CRITICAL",9.9,"2026-09-28",0],["CVE-2026-86335","Canonical","LXD","LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-86334","Canonical","LXD","CLI Path Traversal via Content-Disposition in LXD Image Export/Copy","MEDIUM",4.2,"2026-09-28",0],["CVE-2026-15953","ABB","Protection and control IED manager (PCM600)","Path Traversal During Project Archive Import","MEDIUM",5.6,"2026-09-28",0],["CVE-2026-101070","","dbgate","dbgate Files Endpoint runners.js files path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-73642","Dayforce","ESS Excelity","Path Traversal in Dayforce ESS Excelity","CRITICAL",9.2,"2026-09-28",0],["CVE-2026-86595","Iron Mountain Archiving Services Inc.","enVision","SQLi in Iron Mountain's enVision","HIGH",8.8,"2026-09-28",0],["CVE-2026-73641","Dayforce","ESS Excelity","Multiple Reflected XSS in Dayforce ESS Excelity","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-73640","Dayforce","ESS Excelity","Time-based SQL Injection in Dayforce ESS Excelity","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-15952","ABB","Protection and control IED manager (PCM600)","Improper Permission Assignment in Scheduler Service","HIGH",7.1,"2026-09-28",0],["CVE-2026-52749","Kaon","AR2140","Improper Authentication in Kaon AR2140X","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-52748","Kaon","AR2140","Missing authentication for backup functionality in Kaon AR2140X","HIGH",7.1,"2026-09-28",0],["CVE-2026-101069","","dbgate","dbgate Export databaseConnections.js exportModelSql path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-59563","Zscaler","zscaler-mcp-server","HMAC Confirmation Token Unbinding in zscaler-mcp-server","MEDIUM",4.6,"2026-09-28",0],["CVE-2026-101068","","dbgate","dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101292","Red Hat","Red Hat JBoss Enterprise Application Platform 7.4.25","Artemis-core-client: unsafe reflection in apache activemq artemis federation message deser","HIGH",8.2,"2026-09-28",0],["CVE-2026-82323","Enocta Educational Technologies Inc.","Enocta Platform","Improper Authorization in Enocta Educational's Enocta Platform","HIGH",8.1,"2026-09-28",0],["CVE-2026-82326","Enocta Educational Technologies Inc.","Enocta Platform","HTML Injection in Enocta Educational's Enocta Platform","MEDIUM",4.1,"2026-09-28",0],["CVE-2026-18825","github.com/antono","connect-cors","Origin validation error in the connect-xcors npm package","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-101067","","dbgate","dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-12265","Zohocorp","DDI Central","Missing Authorization on HA Failover Config allows Complete Data Destruction","HIGH",8.8,"2026-09-28",0],["CVE-2026-86330","Red Hat","Red Hat Openshift Data Foundation 4","Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_intern","HIGH",7.2,"2026-09-28",0],["CVE-2026-101066","","dbgate","dbgate Archive Link Creation archive.js createLink path traversal","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-82936","F&F Filipowski","mH-DEVELOPER","Denial of Service in mH-DEVELOPER","MEDIUM",5.9,"2026-09-28",0],["CVE-2026-82935","F&F Filipowski","mH-DEVELOPER","Use of End-of-Life components in mH-DEVELOPER","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-82933","F&F Filipowski","mH-DEVELOPER","Cleartext Transmission of Sensitive Information in mH-DEVELOPER","MEDIUM",6,"2026-09-28",0],["CVE-2026-82932","F&F Filipowski","mH-DEVELOPER","Missing Firewall Configuration in mH-DEVELOPER","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-82930","F&F Filipowski","mH-DEVELOPER","Missing Authentication in mH-DEVELOPER","MEDIUM",6.4,"2026-09-28",0],["CVE-2026-82929","F&F Filipowski","mH-DEVELOPER","Use of Shared Cryptographic Key in mH-DEVELOPER","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-82928","F&F Filipowski","mH-DEVELOPER","Undocumented access path in mH-DEVELOPER","HIGH",7.7,"2026-09-28",0],["CVE-2026-101055","Thinkware","U3000","Thinkware U3000 TCP Service GET_STATUS information disclosure","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-12264","Zohocorp","DDI Central","Authenticated File Write via HA Failover Config Upload leads to RCE","HIGH",8.8,"2026-09-28",0],["CVE-2026-101054","Thinkware","U3000","Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-78424","SUSE","NeuVector","OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution o","HIGH",8.8,"2026-09-28",0],["CVE-2026-19444","Kubernetes","Kubernetes","Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-87752","Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.","Agentis","HTML Injection in Rolantis Information Technologies' Agentis","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-101053","Thinkware","U3000","Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-94194","elixir-mint","mint","Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, ","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-92103","elixir-mint","mint","Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size","MEDIUM",6.3,"2026-09-28",0],["CVE-2026-91043","elixir-mint","mint","HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhau","HIGH",8.2,"2026-09-28",0],["CVE-2026-101052","refly-ai","refly","refly-ai refly JWT Token app.config.ts hard-coded credentials","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101040","Ricoh","SP 330DN","Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of servic","HIGH",7.1,"2026-09-28",0],["CVE-2026-12267","Zohocorp","DDI Central","Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE","HIGH",7.2,"2026-09-28",0],["CVE-2026-81375","Google Cloud","Application Integration","Confused Deputy in Application Integration allows Internal File Read","HIGH",8.3,"2026-09-28",0],["CVE-2026-12268","Zohocorp","DDI Central","Authenticated PowerShell Injection leads to RCE","HIGH",8.8,"2026-09-28",0],["CVE-2026-81867","Google Cloud","Application Integration","Deserialization of Untrusted Data in Application Integration allows Remote Code Execution","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-101039","FAST","FAC1900R","FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow","CRITICAL",10,"2026-09-28",0],["CVE-2026-91006","Apache Software Foundation","Apache Karaf","Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)","HIGH",8.8,"2026-09-28",0],["CVE-2026-12269","Zohocorp","DDI Central","Authenticated File Write to RCE via keepalived in DDI Central","HIGH",8.8,"2026-09-28",0],["CVE-2026-19759","Google Cloud","Application Integration","Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-101038","FAST","FAC1200R","FAST FAC1200R MmtAtePrase stack-based overflow","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-101037","FAST","FAC1200R","FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-7171","TPVEnlanube","Cloud Web application","Stored Cross-Site Scripting (XSS) in TPVEnlanube","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-7172","TPVEnlanube","Cloud Web application","Stored Cross-Site Scripting (XSS) in TPVEnlanube","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-7170","TPVEnlanube","Cloud Web application","Stored Cross-Site Scripting (XSS) in TPVEnlanube","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-101036","FLB-Music","FLB-Music-Player","FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-90979","Apache Software Foundation","Apache Karaf","Apache Karaf: LDAP filter injection in JAAS LDAP login modules","HIGH",7.3,"2026-09-28",0],["CVE-2026-101035","aligungr","UERANSIM","aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101018","dayrui","XunruiCMS","dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-101017","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-94287","x.org","libXpm","Denial of service via unsigned underflow in libXpm's write path","MEDIUM",5.5,"2026-09-28",0],["CVE-2026-94286","x.org","libXtst","Out-of-bounds read in libXtst's RECORD reply parser","HIGH",7.1,"2026-09-28",0],["CVE-2026-94285","x.org","libX11","Out-of-bounds read in libX11's byte-oriented codeset parser","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-101016","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exception","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-94284","x.org","libX11","Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registrati","MEDIUM",5.5,"2026-09-28",0],["CVE-2026-94283","x.org","libX11","Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-82915","Bimser Solution Software Trade Inc.","eBA Plus Document and Workflow Management System","Path Traversal in Bimser Solution Software's eBA Plus","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101015","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in inp","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-85134","Bimser Solution Software Trade Inc.","eBA Plus Document and Workflow Management System","Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus","HIGH",8.8,"2026-09-28",0],["CVE-2026-86507","Apache Software Foundation","Apache Roller","Apache Roller: Stored XSS in comment moderation via comment author URL","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-82969","Bimser Solution Software Trade Inc.","eBA Plus Document and Workflow Management System","Stored XSS in BİMSER's eBA Plus","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-94282","x.org","libXi","Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion","MEDIUM",5.6,"2026-09-28",0],["CVE-2026-101014","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-95104","BUFFALO INC.","WSR-300HP","Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenti","HIGH",8.7,"2026-09-28",0],["CVE-2026-86530","BUFFALO INC.","WSR-300HP","BUFFALO Wi-Fi products handle some web form input improperly to assemble command line stri","HIGH",8.6,"2026-09-28",0],["CVE-2026-101013","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-82379","Apache Software Foundation","Apache Roller","Apache Roller: WSSE digest authentication headers can be replayed","HIGH",7.7,"2026-09-28",0],["CVE-2026-82380","Apache Software Foundation","Apache Roller","Apache Roller: CSRF protection bypass via self-generated salt validation","HIGH",8.1,"2026-09-28",0],["CVE-2026-82381","Apache Software Foundation","Apache Roller","Apache Roller: Stored cross-site scripting in the authoring UI","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-82382","Apache Software Foundation","Apache Roller","Apache Roller: Reflected cross-site scripting in the frontpage directory parameter","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-82383","Apache Software Foundation","Apache Roller","Apache Roller: Anonymous setup action allows frontpage configuration tampering","HIGH",8.2,"2026-09-28",0],["CVE-2026-82384","Apache Software Foundation","Apache Roller","Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint","CRITICAL",9.8,"2026-09-28",0],["CVE-2026-82375","Apache Software Foundation","Apache Roller","Apache Roller: Server-side request forgery via entry trackback and enclosure URLs","HIGH",7.4,"2026-09-28",0],["CVE-2026-82376","Apache Software Foundation","Apache Roller","Apache Roller: XML external entity processing in trackback response parser","HIGH",7.7,"2026-09-28",0],["CVE-2026-82377","Apache Software Foundation","Apache Roller","Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers","CRITICAL",9.9,"2026-09-28",0],["CVE-2026-82378","Apache Software Foundation","Apache Roller","Apache Roller: OAuth authorization endpoint trusts request-supplied identity","CRITICAL",9,"2026-09-28",0],["CVE-2026-101012","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-82385","Apache Software Foundation","Apache Roller","Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-82386","Apache Software Foundation","Apache Roller","Apache Roller: XML external entity processing in OPML bookmark import","HIGH",7.7,"2026-09-28",0],["CVE-2026-82348","Apache Software Foundation","Apache Roller","Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups","HIGH",7.7,"2026-09-28",0],["CVE-2026-82387","Apache Software Foundation","Apache Roller","Apache Roller: Stored cross-site scripting via uploaded media content type","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-82546","Apache Software Foundation","Apache Roller","Apache Roller: Stored cross-site scripting through incoming Trackback links","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-91204","Apache Software Foundation","Apache Roller","Apache Roller: Stored javascript: URI in HTML comments","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-91206","Apache Software Foundation","Apache Roller","Apache Roller: Reflected XSS in the optional LDAP comment authenticator","MEDIUM",6.1,"2026-09-28",0],["CVE-2026-101011","aaPanel","BaoTa","aaPanel BaoTa Domain domainMod.py get_domain_status sql injection","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-101010","aaPanel","BaoTa","aaPanel BaoTa data.py getData sql injection","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-100750","regularlabs.com","Modules Anywhere (Pro) extension for Joomla","Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 ","HIGH",8.5,"2026-09-28",0],["CVE-2026-101009","aaPanel","BaoTa","aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-100751","regularlabs.com","Tabs & Accordions (Free, Pro) extension for Joomla","Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in","HIGH",7.5,"2026-09-28",0],["CVE-2026-101008","aaPanel","BaoTa","aaPanel BaoTa File Merge files.py merge_split_file command injection","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-101007","aaPanel","BaoTa","aaPanel BaoTa Database Backup database.py InputSql os command injection","CRITICAL",9.3,"2026-09-28",0],["CVE-2026-92996","","Verge3D Publishing and E-Commerce","Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-88828","","Blacklist Manager","Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-89411","","Paymattic","Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-86838","","Bookly","Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-84744","","WPForms","WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Fiel","MEDIUM",6.5,"2026-09-28",0],["CVE-2026-101006","Frappe","HR","Frappe HR Permission Validation __init__.py get_attendance_requests authorization","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-89300","","WP Verify API","WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Reci","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-93000","","SPS-Suite","SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search","MEDIUM",6.8,"2026-09-28",0],["CVE-2026-89303","","Post Voting System","Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter","MEDIUM",6.4,"2026-09-28",0],["CVE-2026-101005","","October CMS","October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101004","notionnext-org","NotionNext","notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101003","Cesanta","Mongoose","Cesanta Mongoose MQTT Broker main.c fn stack-based overflow","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-101002","Netcore","NBR200V2","Netcore NBR200V2 Tools Ping network_tools system os command injection","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-101001","Netcore","NBR200V2","Netcore NBR200V2 Web Management network_tools eval os command injection","CRITICAL",10,"2026-09-28",0],["CVE-2026-101000","Netcore","NBR100V2","Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization","CRITICAL",10,"2026-09-28",0],["CVE-2026-100909","","OctoberCMS","OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100908","","Eyeplus","Eyeplus p2pcam HTTP stack-based overflow","HIGH",8.7,"2026-09-28",0],["CVE-2026-87723","Google","fuse-archive","Untrusted Search Path (PATH Hijacking) in fuse-archive","MEDIUM",5.4,"2026-09-28",0],["CVE-2026-100907","","Eyeplus","Eyeplus p2pcam Service snapshot information disclosure","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100906","","Eyeplus","Eyeplus ONVIF Device GetUsers information disclosure","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100904","amirsanni","mini-inventory-and-sales-management-system","amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-100903","ООО НПО Ритм","GEOritm","ООО НПО Ритм GEOritm REST API obj-groups missing authentication","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100902","Barco","ClickShare CX-20 Gen2","Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic co","HIGH",7.1,"2026-09-28",0],["CVE-2026-100901","athlon1600","youtube-downloader","athlon1600 youtube-downloader stream.php stream server-side request forgery","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100900","DevaslanPHP","project-management","DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side requ","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-100899","DevaslanPHP","project-management","DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injectio","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100898","DevaslanPHP","project-management","DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injec","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100897","fuzui","StudentInfo","fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-100896","TOTOLINK","N150RT","TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection","CRITICAL",9.4,"2026-09-28",0],["CVE-2026-100895","Trusted Domain Project","OpenARC","Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer deref","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100894","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100893","Privoce","VoceChat Server","Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request ","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100892","aligungr","UERANSIM","aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100891","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmar","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100890","Trusted Domain Project","OpenDMARC","Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode nul","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100889","Trusted Domain Project","OpenDKIM","Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100888","Trusted Domain Project","OpenDKIM","Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_se","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100887","amirsanni","Mini-Inventory-and-Sales-Management-System","amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_build","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100886","Seetong","T8108","Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication","CRITICAL",10,"2026-09-28",0],["CVE-2026-100885","Krayin","laravel-crm","Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization","MEDIUM",6.9,"2026-09-28",0],["CVE-2026-100884","Krayin","laravel-crm","Krayin laravel-crm attachment-download Endpoint acl.php resource injection","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-100883","Krayin","laravel-crm","Krayin laravel-crm acl.php access control","MEDIUM",5.3,"2026-09-28",0],["CVE-2026-96284","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci syml","LOW",2.5,"2026-09-28",0],["CVE-2026-100882","Krayin","laravel-crm","Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting","MEDIUM",4.8,"2026-09-28",0],["CVE-2026-96282","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: extension metadata path traversal file existence oracle","LOW",3.1,"2026-09-28",0],["CVE-2026-96283","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoi","LOW",3.3,"2026-09-28",0],["CVE-2026-100881","zhistaredu","StarTraining","zhistaredu StarTraining application.yml cross site scripting","LOW",2.1,"2026-09-28",0],["CVE-2026-96281","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system app","MEDIUM",6.2,"2026-09-28",0],["CVE-2026-100880","zhistaredu","StarTraining","zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting","MEDIUM",5.1,"2026-09-28",0],["CVE-2026-101089","nezhahq","nezha","Nezha before 2.2.7 Information Disclosure via /api/v1/profile","LOW",2.3,"2026-09-27",0],["CVE-2026-101090","nezhahq","nezha","Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri","CRITICAL",9.3,"2026-09-27",0],["CVE-2026-101088","nezhahq","nezha","Nezha before 2.3.1 Denial of Service via Concurrent Server Delete","MEDIUM",6,"2026-09-27",0],["CVE-2026-101086","nezhahq","nezha","Nezha Dashboard before 2.3.5 Task Type Validation Bypass","HIGH",7.1,"2026-09-27",0],["CVE-2026-101087","nezhahq","nezha","Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-101085","nezhahq","nezha","Nezha before 2.3.8 Denial of Service via Alert Rule","HIGH",7.1,"2026-09-27",0],["CVE-2026-101065","obot-platform","obot","Obot Quickstart Docker Deployment Unauthenticated Admin Access","CRITICAL",9.3,"2026-09-27",0],["CVE-2026-101084","obot-platform","obot","obot before v0.21.1 Authorization Bypass via /mcp-connect","CRITICAL",9.3,"2026-09-27",0],["CVE-2026-101064","obot-platform","obot","Obot before v0.23.0 Server-Side Request Forgery via MCP","HIGH",8.3,"2026-09-27",0],["CVE-2026-101062","obot-platform","obot","Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration","HIGH",8.7,"2026-09-27",0],["CVE-2026-101063","obot-platform","obot","Obot before v0.23.0 Authentication Bypass via Registry API","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100879","zhistaredu","StarTraining","zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed author","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100878","zhistaredu","StarTraining","zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-96280","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems","HIGH",7.5,"2026-09-27",0],["CVE-2026-100877","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-96279","Red Hat","Red Hat Enterprise Linux 10","Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks","MEDIUM",6.5,"2026-09-27",0],["CVE-2026-100876","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100875","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100874","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100873","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project cross-site request forgery","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-101061","universal-tool-calling-protocol","python-utcp","utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass","LOW",2.3,"2026-09-27",0],["CVE-2026-101059","universal-tool-calling-protocol","python-utcp","utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass","HIGH",7.1,"2026-09-27",0],["CVE-2026-101060","universal-tool-calling-protocol","python-utcp","python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects","HIGH",8.4,"2026-09-27",0],["CVE-2026-101058","universal-tool-calling-protocol","python-utcp","python-utcp before 1.1.12 SSRF via Remote HTTP Manual","HIGH",7.1,"2026-09-27",0],["CVE-2026-101056","cloudreve","cloudreve","Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-101057","universal-tool-calling-protocol","python-utcp","utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL","LOW",2.3,"2026-09-27",0],["CVE-2026-101051","cloudreve","cloudreve","Cloudreve before 4.16.1 Path Traversal via Remote Download","LOW",2.3,"2026-09-27",0],["CVE-2026-101048","cloudreve","cloudreve","Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-101046","fleetdm","fleet","Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints","LOW",2.3,"2026-09-27",0],["CVE-2026-101047","fleetdm","fleet","Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-101045","fleetdm","fleet","Fleet Homebrew Cask OS Command Injection via Metadata","HIGH",8.9,"2026-09-27",0],["CVE-2026-101043","pnpm","pnpm","pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings","HIGH",8.3,"2026-09-27",0],["CVE-2026-101044","pnpm","pnpm","pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias","HIGH",7.1,"2026-09-27",0],["CVE-2026-88778","Citrix NetScaler","ADC","TCP Initial Sequence Number (ISN) prediction","HIGH",8.8,"2026-09-27",0],["CVE-2026-88777","Citrix NetScaler","ADC","Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ","HIGH",8.8,"2026-09-27",0],["CVE-2026-88776","Citrix NetScaler","ADC","Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ","HIGH",8.8,"2026-09-27",0],["CVE-2026-101049","heymrun","heym","Heym before 0.0.53 Slack Webhook Signature Verification Bypass","HIGH",8.3,"2026-09-27",0],["CVE-2026-101050","heymrun","heym","Heym before 0.0.53 Authentication Bypass via Telegram Webhook","HIGH",8.3,"2026-09-27",0],["CVE-2026-101042","parse-community","parse-server","Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity","HIGH",7.4,"2026-09-27",0],["CVE-2026-88775","Citrix NetScaler","ADC","Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ","HIGH",8.8,"2026-09-27",0],["CVE-2026-88773","Citrix NetScaler","ADC","HTTP Request Smuggling","CRITICAL",9.3,"2026-09-27",0],["CVE-2026-88774","Citrix NetScaler","ADC","Feature policy bypass due to improper HTTP URL based expression usage","HIGH",7,"2026-09-27",0],["CVE-2026-88772","Citrix NetScaler","ADC","Memory overflow vulnerability leading to Remote Code Execution or Denial of Service","CRITICAL",9.5,"2026-09-27",1],["CVE-2026-88771","Citrix NetScaler","ADC","A remote code execution vulnerability exists due to improper input validation, which can a","CRITICAL",9.5,"2026-09-27",1],["CVE-2026-101041","vulnerability-lookup","vulnerability-lookup","Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Passwor","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-101033","TomBursch","kitchenowl","KitchenOwl through 0.7.10 IDOR via unchecked category ID","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-101032","denisidoro","navi","navi through 2.24.0 OS Command Injection via Cheatsheet Variables","HIGH",7.3,"2026-09-27",0],["CVE-2026-100872","Sylius","Sylius","Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite","HIGH",8.7,"2026-09-27",0],["CVE-2026-100871","Sylius","Sylius","Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows A","HIGH",8.7,"2026-09-27",0],["CVE-2026-100869","Sylius","Sylius","Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API","HIGH",8.2,"2026-09-27",0],["CVE-2026-100870","Sylius","Sylius","Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning ","HIGH",8.7,"2026-09-27",0],["CVE-2026-100868","penpot","penpot","Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100866","o2sh","onefetch","onefetch through 2.28.1 Terminal Escape Sequence Injection","MEDIUM",4.8,"2026-09-27",0],["CVE-2026-100867","spaceship-prompt","spaceship-prompt","spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection","MEDIUM",4.8,"2026-09-27",0],["CVE-2026-100748","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-97164","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery ext","HIGH",7,"2026-09-27",0],["CVE-2026-100747","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0","MEDIUM",5.1,"2026-09-27",0],["CVE-2026-100749","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extens","MEDIUM",5.1,"2026-09-27",0],["CVE-2026-97165","svenbluege.de","Event Gallery for Joomla","Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extens","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-15442","wolfSSL","wolfSSL","Heap use-after-free on read during bidirectional (D)TLS shutdown","LOW",2.3,"2026-09-27",0],["CVE-2026-89102","wolfSSL","wolfSSL","OCSP stapling v2 multi accepts non-CA chain certificates as issuers","HIGH",8.3,"2026-09-27",0],["CVE-2026-89133","wolfSSL","wolfSSL","NameConstraints not enforced across unconstrained intermediate CA","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-89134","wolfSSL","wolfSSL","Subject CN name-constraint check bypassed when non-DNS SAN present","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-89135","wolfSSL","wolfSSL","Failed X509_verify_cert leaves unverified CA in shared CertManager","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-89136","wolfSSL","wolfSSL","Client accepts unsolicited RawPublicKey server certificate type","HIGH",8.3,"2026-09-27",0],["CVE-2026-93302","wolfSSL","wolfSSL","Trusted peer certificate match ignores public key, allowing forged CA clones","HIGH",8.3,"2026-09-27",0],["CVE-2026-93304","wolfSSL","wolfSSL","(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-94417","wolfSSL","wolfSSL","CRL check skipped when OCSP enabled and certificate has no OCSP URL","LOW",2.3,"2026-09-27",0],["CVE-2026-94418","wolfSSL","wolfSSL","Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY","LOW",2.3,"2026-09-27",0],["CVE-2026-94419","wolfSSL","wolfSSL","Client session cache reference poisoning allows resumption with wrong server","LOW",2.3,"2026-09-27",0],["CVE-2026-100741","Progressive Robot Ltd","hMailServer","Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in ","CRITICAL",9.8,"2026-09-27",0],["CVE-2026-97319","","PowerPress Podcasting plugin by Blubrry","PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-96895","","WP YouTube Lyte","WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-96896","","Malcure Malware Shield — Removal, Repair, Monitor","Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deleti","HIGH",7.2,"2026-09-27",0],["CVE-2026-96897","","Optima Express IDX","Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Passw","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-96899","","Optima Express IDX","Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-97227","","NextScripts: Social Networks Auto-Poster","NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential","MEDIUM",5.9,"2026-09-27",0],["CVE-2026-89001","","WPeMatico RSS Feed Fetcher","WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing vi","MEDIUM",4.9,"2026-09-27",0],["CVE-2026-89003","","WPeMatico RSS Feed Fetcher","WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview","MEDIUM",4.1,"2026-09-27",0],["CVE-2026-89006","","WPeMatico RSS Feed Fetcher","WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-92436","","Mailchimp for WooCommerce","Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via I","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-92995","","Verge3D Publishing and E-Commerce","Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-86839","","Online Scheduling and Appointment Booking System","Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via I","LOW",3.8,"2026-09-27",0],["CVE-2026-86841","","Online Scheduling and Appointment Booking System","Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced O","MEDIUM",4.7,"2026-09-27",0],["CVE-2026-89000","","WPeMatico RSS Feed Fetcher","WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run","MEDIUM",4.1,"2026-09-27",0],["CVE-2026-81655","","Ad Inserter","Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields","HIGH",7.5,"2026-09-27",0],["CVE-2026-82841","","UpdraftPlus: WP Backup & Migration Plugin","UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migrati","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-84069","","WebFacing™","WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-85002","","EmbedPress","EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-86609","","Download Manager","Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription","HIGH",8.8,"2026-09-27",0],["CVE-2026-100746","coollabsio","Coolify","coollabsio Coolify GitHub App Setup redirect missing authentication","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100745","Edimax","BR-6428nC","Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100837","edgelesssys","contrast","Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-100836","edgelesssys","contrast","Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100864","heymrun","heym","heym before 0.0.91 Remote Code Execution via Expression Engine","HIGH",8.7,"2026-09-27",0],["CVE-2026-100865","heymrun","heym","Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape","HIGH",8.7,"2026-09-27",0],["CVE-2026-100863","heymrun","heym","Heym before 0.0.91 SSRF via image fetching and IPv6 validation","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100861","heymrun","heym","heym before 0.0.105 SSRF via credential-controlled base URLs","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100862","heymrun","heym","heym before 0.0.91 Multiple Secrets Plaintext Storage","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100860","heymrun","heym","heym before 0.0.105 Authentication Bypass via Redis Node","MEDIUM",6.8,"2026-09-27",0],["CVE-2026-100858","heymrun","heym","heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes","HIGH",7.6,"2026-09-27",0],["CVE-2026-100859","heymrun","heym","Heym before 0.0.106 Credential Exfiltration via URL Override","HIGH",7.1,"2026-09-27",0],["CVE-2026-100857","AzuraCast","AzuraCast","AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation","HIGH",8.6,"2026-09-27",0],["CVE-2026-100855","AzuraCast","AzuraCast","AzuraCast before 0.23.6 Missing Permission Check via /play","HIGH",7.1,"2026-09-27",0],["CVE-2026-100856","AzuraCast","AzuraCast","AzuraCast before 0.23.6 Code Injection via Remote Relay Password","HIGH",8.7,"2026-09-27",0],["CVE-2026-100854","AzuraCast","AzuraCast","AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API","MEDIUM",5.3,"2026-09-27",0],["CVE-2026-100852","AzuraCast","AzuraCast","AzuraCast before 0.23.8 Command Injection via Streamer Username","HIGH",8.7,"2026-09-27",0],["CVE-2026-100853","AzuraCast","AzuraCast","AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass","HIGH",8.2,"2026-09-27",0],["CVE-2026-100851","AzuraCast","AzuraCast","AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile","HIGH",7.2,"2026-09-27",0],["CVE-2026-100850","AzuraCast","AzuraCast","AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist","MEDIUM",4.8,"2026-09-27",0],["CVE-2026-100848","AzuraCast","AzuraCast","AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL","HIGH",7.1,"2026-09-27",0],["CVE-2026-100849","AzuraCast","AzuraCast","AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs","HIGH",7.1,"2026-09-27",0],["CVE-2026-100846","Project-MONAI","MONAI","MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization","HIGH",8.8,"2026-09-27",0],["CVE-2026-100847","AzuraCast","AzuraCast","AzuraCast before 0.23.8 DQL Injection via sortOrder","HIGH",8.7,"2026-09-27",0],["CVE-2026-100845","Project-MONAI","MONAI","MONAI before 1.6.0 Remote Code Execution via NumpyReader","HIGH",8.5,"2026-09-27",0],["CVE-2026-100844","Project-MONAI","MONAI","MONAI before 1.6.0 OS Command Injection via dataset_name_or_id","HIGH",8.6,"2026-09-27",0],["CVE-2026-100842","Project-MONAI","MONAI","MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains","HIGH",7.3,"2026-09-27",0],["CVE-2026-100843","Project-MONAI","MONAI","MONAI before 1.6.0 Remote Code Execution via algo_from_pickle","HIGH",8.5,"2026-09-27",0],["CVE-2026-100841","Project-MONAI","MONAI","MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache","HIGH",8.5,"2026-09-27",0],["CVE-2026-100839","edgelesssys","contrast","Contrast before 1.18.0 AML Injection Remote Code Execution","HIGH",8.4,"2026-09-27",0],["CVE-2026-100840","Project-MONAI","MONAI","MONAI through 1.6.0 Remote Code Execution via bundle configuration","HIGH",8.5,"2026-09-27",0],["CVE-2026-100838","edgelesssys","contrast","Contrast before 1.19.1 CopyFile Policy Symlink Subversion","HIGH",8.6,"2026-09-27",0],["CVE-2026-100835","edgelesssys","contrast","Contrast before 1.16.0 Remote Attestation Relay Attack","CRITICAL",9.1,"2026-09-27",0],["CVE-2026-100833","edgelesssys","contrast","Contrast before 1.23.1 Image Substitution via Policy Generation","HIGH",8.6,"2026-09-27",0],["CVE-2026-100834","http4k","http4k","http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass","HIGH",8.2,"2026-09-27",0],["CVE-2026-100725","http4k","http4k","http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage","HIGH",8.3,"2026-09-27",0],["CVE-2026-100723","patriksimek","vm2","vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100724","http4k","http4k","http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy","MEDIUM",6.3,"2026-09-27",0],["CVE-2026-100722","patriksimek","vm2","vm2 before 3.12.2 Host Process Termination via Construct Trap","HIGH",8.9,"2026-09-27",0],["CVE-2026-100721","patriksimek","vm2","vm2 before 3.12.2 Authorization Bypass via Custom Resolver","CRITICAL",9.5,"2026-09-27",0],["CVE-2025-71425","edgelesssys","contrast","Contrast before 1.8.1 Information Disclosure via Logging","HIGH",8.5,"2026-09-27",0],["CVE-2025-71426","edgelesssys","contrast","Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery","HIGH",7.1,"2026-09-27",0],["CVE-2025-71424","edgelesssys","contrast","Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount","MEDIUM",5.1,"2026-09-27",0],["CVE-2025-71422","edgelesssys","contrast","Contrast before 1.12.1 Insecure LUKS2 Persistent Storage","MEDIUM",6.9,"2026-09-27",0],["CVE-2025-71423","edgelesssys","contrast","Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure","HIGH",8.5,"2026-09-27",0],["CVE-2026-100744","coollabsio","Coolify","coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-100740","D-Link","DIR-895L","D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write","CRITICAL",9.4,"2026-09-27",0],["CVE-2026-100739","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection","MEDIUM",6.9,"2026-09-27",0],["CVE-2026-94408","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service","MEDIUM",4.9,"2026-09-26",0],["CVE-2026-94397","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-94396","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-94400","Elastic","Kibana","Uncontrolled Resource Consumption in Kibana Leading to denial of service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-94399","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-94398","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-82300","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-82294","Elastic","Elasticsearch","Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-78582","Elastic","Kibana","Missing Authorization in Kibana Leading to Unauthorized Deletion of Data","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-72662","Elastic","Kibana","Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclos","MEDIUM",6.3,"2026-09-26",0],["CVE-2026-72668","Elastic","Kibana","Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escala","HIGH",7.3,"2026-09-26",0],["CVE-2026-82901","themefic","Ultra Addons for Contact Form 7","Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Sign","CRITICAL",9.8,"2026-09-26",0],["CVE-2026-77203","itthinx","Groups – Memberships and Access Control","Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Short","HIGH",8.8,"2026-09-26",0],["CVE-2026-85984","cyberlord92","miniOrange OTP Login, Verification and SMS Notifications","miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authen","CRITICAL",9.8,"2026-09-26",0],["CVE-2026-97161","lomart.fr","UP plugin for Joomla","Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin e","CRITICAL",9.2,"2026-09-26",0],["CVE-2026-97163","lomart.fr","UP plugin for Joomla","Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin exten","CRITICAL",10,"2026-09-26",0],["CVE-2026-97162","lomart.fr","UP plugin for Joomla","Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-","HIGH",8.3,"2026-09-26",0],["CVE-2026-97160","lomart.fr","UP plugin for Joomla","Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugi","CRITICAL",9.4,"2026-09-26",0],["CVE-2026-94131","acymailing.com","AcyMailing extension for Joomla","Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing ","HIGH",8.3,"2026-09-26",0],["CVE-2026-94132","acymailing.com","AcyMailing Enterprise extension for Joomla","Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action ","CRITICAL",9.5,"2026-09-26",0],["CVE-2026-94130","joomlaboat.com","YouTube Gallery extension for Joomla","Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery exten","CRITICAL",9.3,"2026-09-26",0],["CVE-2026-100626","Cap-go","capgo.app","capgo through 12.128.2 IDOR via PUT /app icon endpoint","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100720","froxlor","froxlor","Froxlor before 2.3.12 Stored XSS via SSL certificate issuer","CRITICAL",9.3,"2026-09-26",0],["CVE-2026-100718","froxlor","froxlor","Froxlor before 2.3.12 Authentication Bypass via EmailSender.add","HIGH",7.1,"2026-09-26",0],["CVE-2026-100719","froxlor","froxlor","Froxlor before 2.3.12 Credential Disclosure via DirProtections API","HIGH",7.1,"2026-09-26",0],["CVE-2026-100717","froxlor","froxlor","froxlor before 2.3.12 CRLF Injection via validateUrl userinfo","HIGH",8.5,"2026-09-26",0],["CVE-2026-100715","froxlor","froxlor","Froxlor before 2.3.12 Arbitrary File Deletion via Symlink","HIGH",8.5,"2026-09-26",0],["CVE-2026-100716","froxlor","froxlor","Froxlor before 2.3.12 Privilege Escalation via Symlink","CRITICAL",9.4,"2026-09-26",0],["CVE-2026-100714","froxlor","froxlor","Froxlor before 2.3.12 Command Injection via letsencryptchallengepath","CRITICAL",9.4,"2026-09-26",0],["CVE-2026-100712","froxlor","froxlor","froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF","HIGH",7.1,"2026-09-26",0],["CVE-2026-100713","froxlor","froxlor","Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync","HIGH",7.1,"2026-09-26",0],["CVE-2026-100711","froxlor","froxlor","froxlor before 2.3.12 Authentication Bypass via Session Persistence","HIGH",8.7,"2026-09-26",0],["CVE-2026-100710","froxlor","froxlor","Froxlor before 2.3.12 DKIM Private Key Disclosure via API","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100708","froxlor","froxlor","Froxlor before 2.3.13 Private Key Disclosure via Certificates API","HIGH",7.1,"2026-09-26",0],["CVE-2026-100709","froxlor","froxlor","Froxlor before 2.3.12 2FA Bypass via Namespace Confusion","HIGH",7.7,"2026-09-26",0],["CVE-2026-100707","kyverno","kyverno","Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path","HIGH",8.3,"2026-09-26",0],["CVE-2026-100706","kyverno","kyverno","kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath","CRITICAL",9.4,"2026-09-26",0],["CVE-2026-100704","kyverno","kyverno","Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass","HIGH",8.3,"2026-09-26",0],["CVE-2026-100705","kyverno","kyverno","Kyverno before 1.19.1 SSRF via legacy apiCall service executor","HIGH",8.3,"2026-09-26",0],["CVE-2026-100703","kyverno","kyverno","Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib","HIGH",8.3,"2026-09-26",0],["CVE-2026-100701","nodemailer","nodemailer","Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion","MEDIUM",6,"2026-09-26",0],["CVE-2026-100702","nodemailer","nodemailer","Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays","HIGH",8.2,"2026-09-26",0],["CVE-2026-100700","nodemailer","nodemailer","nodemailer before 10.0.6 Denial of Service via addressparser","HIGH",8.7,"2026-09-26",0],["CVE-2026-100698","vrana","adminer","Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100699","nodemailer","nodemailer","Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100697","vrana","adminer","Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100696","vrana","adminer","Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100694","gohugoio","hugo","Hugo before 0.166.0 Cross-Site Scripting via text/org","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100695","vrana","adminer","Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100693","gohugoio","hugo","Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass","HIGH",8.6,"2026-09-26",0],["CVE-2026-100691","gohugoio","hugo","Hugo before 0.166.0 Stored XSS via lineAnchors code block option","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100692","gohugoio","hugo","Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots","HIGH",8.7,"2026-09-26",0],["CVE-2026-100690","gohugoio","hugo","Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks","HIGH",8.7,"2026-09-26",0],["CVE-2026-100688","budibase","server","Budibase server before 3.45.0 Cross-Tenant Information Disclosure","HIGH",7.1,"2026-09-26",0],["CVE-2026-100689","gitpython-developers","GitPython","GitPython before 3.1.62 Path Traversal via gitmodules path","HIGH",8.7,"2026-09-26",0],["CVE-2026-100687","budibase","server","Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast","HIGH",7,"2026-09-26",0],["CVE-2026-100686","budibase","server","Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:g","HIGH",8.6,"2026-09-26",0],["CVE-2026-100684","budibase","server","Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC","CRITICAL",9.2,"2026-09-26",0],["CVE-2026-100685","budibase","server","Budibase before 3.45.0 Information Disclosure via Chat Links","HIGH",8.3,"2026-09-26",0],["CVE-2026-100683","budibase","server","Budibase before 3.45.0 SQL Injection via column-rename DDL","HIGH",8.9,"2026-09-26",0],["CVE-2026-100681","budibase","server","Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook","MEDIUM",6.3,"2026-09-26",0],["CVE-2026-100682","budibase","server","Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink","HIGH",8.7,"2026-09-26",0],["CVE-2026-100680","budibase","server","Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import","HIGH",8.6,"2026-09-26",0],["CVE-2026-100679","stoatchat","stoatchat","stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket","HIGH",7.1,"2026-09-26",0],["CVE-2026-100678","stoatchat","stoatchat","stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting","HIGH",8.3,"2026-09-26",0],["CVE-2026-100676","stoatchat","stoatchat","stoatchat before 0.15.5 Local Filesystem Read via SVG","HIGH",8.8,"2026-09-26",0],["CVE-2026-100677","stoatchat","stoatchat","stoatchat before 0.15.5 Account Enumeration via Error Location","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100675","stoatchat","stoatchat","stoatchat before 0.15.5 Denial of Service via mass mentions","HIGH",7.1,"2026-09-26",0],["CVE-2026-100674","stoatchat","stoatchat","stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100672","getgrav","grav-plugin-comments","grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure","HIGH",8.7,"2026-09-26",0],["CVE-2026-100673","getgrav","grav-plugin-datamanager","Grav Data Manager before 1.4.5 Stored XSS via item-detail view","HIGH",8.4,"2026-09-26",0],["CVE-2026-100671","getgrav","grav","Grav before 2.0.25 Session Cookie Theft via Twig Sandbox","HIGH",8.6,"2026-09-26",0],["CVE-2026-100669","getgrav","grav","Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass","HIGH",8.7,"2026-09-26",0],["CVE-2026-100670","getgrav","grav","Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass","HIGH",8.7,"2026-09-26",0],["CVE-2026-100668","getgrav","grav","Grav before 2.0.25 Sandbox Escape via array Filter","HIGH",7.1,"2026-09-26",0],["CVE-2026-100667","getgrav","grav","grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100665","netty","netty","Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass","HIGH",8.7,"2026-09-26",0],["CVE-2026-100666","netty","netty","Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100664","netty","netty","Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion","HIGH",8.7,"2026-09-26",0],["CVE-2026-100663","netty","netty","Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3","HIGH",8.7,"2026-09-26",0],["CVE-2026-100661","netty","netty","Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation","HIGH",8.7,"2026-09-26",0],["CVE-2026-100662","netty","netty","Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS","HIGH",8.7,"2026-09-26",0],["CVE-2026-100660","netty","netty","Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention","HIGH",8.7,"2026-09-26",0],["CVE-2026-100659","netty","netty","Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100654","vllm-project","vllm","vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids","HIGH",7.1,"2026-09-26",0],["CVE-2026-100653","vllm-project","vllm","vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","HIGH",8.3,"2026-09-26",0],["CVE-2026-100651","vllm-project","vllm","vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass","HIGH",7.1,"2026-09-26",0],["CVE-2026-100652","vllm-project","vllm","vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids","HIGH",8.2,"2026-09-26",0],["CVE-2026-100650","vllm-project","vllm","vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization","HIGH",7.1,"2026-09-26",0],["CVE-2026-100649","vllm-project","vllm","vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass","MEDIUM",6.3,"2026-09-26",0],["CVE-2026-100647","vllm-project","vllm","vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100648","vllm-project","vllm","vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100646","siyuan-note","siyuan","SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header","HIGH",8.6,"2026-09-26",0],["CVE-2026-100644","siyuan-note","siyuan","SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath","HIGH",8.7,"2026-09-26",0],["CVE-2026-100645","siyuan-note","siyuan","SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban","HIGH",8.6,"2026-09-26",0],["CVE-2026-100643","siyuan-note","siyuan","SiYuan before v3.8.4 Stored XSS via Attribute View textarea","HIGH",8.5,"2026-09-26",0],["CVE-2026-100642","siyuan-note","siyuan","SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth","HIGH",7.2,"2026-09-26",0],["CVE-2026-100640","siyuan-note","siyuan","SiYuan before v3.8.4 Clipboard Data Disclosure via IPC","HIGH",8.6,"2026-09-26",0],["CVE-2026-100641","siyuan-note","siyuan","SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content","HIGH",8.6,"2026-09-26",0],["CVE-2026-100639","siyuan-note","siyuan","SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL","HIGH",8.6,"2026-09-26",0],["CVE-2026-100637","siyuan-note","siyuan","SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID","HIGH",8.3,"2026-09-26",0],["CVE-2026-100638","siyuan-note","siyuan","SiYuan before v3.8.4 Path Traversal via setNotebookIcon","HIGH",8.3,"2026-09-26",0],["CVE-2026-100636","siyuan-note","siyuan","SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder","HIGH",8.3,"2026-09-26",0],["CVE-2026-100634","siyuan-note","siyuan","SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100635","siyuan-note","siyuan","SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie","HIGH",8.2,"2026-09-26",0],["CVE-2026-100633","siyuan-note","siyuan","SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations","HIGH",8.5,"2026-09-26",0],["CVE-2026-100631","parse-community","parse-server","Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection","HIGH",8.7,"2026-09-26",0],["CVE-2026-100632","parse-community","parse-server","Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery","HIGH",7.1,"2026-09-26",0],["CVE-2026-100630","WWBN","AVideo","AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100628","Cap-go","capgo.app","capgo.app before 12.128.12 Authentication Bypass via apikey","HIGH",8.7,"2026-09-26",0],["CVE-2026-100629","Cap-go","capgo.app","Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH","HIGH",7,"2026-09-26",0],["CVE-2026-100627","Cap-go","capgo.app","Capgo bundle promotion API channel RBAC deny override bypass","HIGH",7.2,"2026-09-26",0],["CVE-2026-100625","Cap-go","capgo.app","Capgo Build Upload Proxy Authorization Bypass via TUS Resource","HIGH",8.7,"2026-09-26",0],["CVE-2026-100624","Cap-go","capgo.app","Capgo.app before 12.264.5 Upload Expiry Bypass via build upload","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100623","Cap-go","capgo.app","Capgo Authentication Bypass via Direct PostgREST org_users Table Write","HIGH",8.7,"2026-09-26",0],["CVE-2026-100621","Cap-go","capgo.app","capgo.app Content-Lock Bypass via r2-direct Bundle Mutation","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100622","Cap-go","capgo.app","capgo.app through 12.129.0 Cache Restoration of Deleted Bundles","HIGH",8.7,"2026-09-26",0],["CVE-2026-100620","Cap-go","@capgo/cli","Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service A","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100618","Cap-go","capgo.app","Capgo App Icon Update Privilege Escalation via Service-Role Worker","HIGH",8.7,"2026-09-26",0],["CVE-2026-100619","Cap-go","capgo.app","Capgo OTA Manifest Poisoning via app_versions.manifest Bypass","HIGH",8.7,"2026-09-26",0],["CVE-2026-100617","Cap-go","capgo.app","Cap-go capgo.app Authorization Bypass via channel_permission_overrides","HIGH",8.7,"2026-09-26",0],["CVE-2026-100615","Cap-go","capgo.app","Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation","HIGH",8.7,"2026-09-26",0],["CVE-2026-100616","Cap-go","capgo.app","capgo.app Authentication Bypass via PostgREST customer_id Mutation","HIGH",7,"2026-09-26",0],["CVE-2026-100614","Cap-go","capgo.app","Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker","HIGH",8.7,"2026-09-26",0],["CVE-2026-100613","Cap-go","capgo.app","capgo.app Authorization Bypass via Stale Channel Permission Overrides","MEDIUM",6,"2026-09-26",0],["CVE-2026-100611","Cap-go","capgo.app","Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list","HIGH",7.1,"2026-09-26",0],["CVE-2026-100612","Cap-go","capgo.app","Capgo SSO Provider ID Authentication Bypass via Incomplete Migration","HIGH",8.6,"2026-09-26",0],["CVE-2026-100610","FlowiseAI","Flowise","Flowise through 3.1.4 Missing Authorization via upsert-history","HIGH",7.7,"2026-09-26",0],["CVE-2026-100608","FlowiseAI","Flowise","Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard","HIGH",8.7,"2026-09-26",0],["CVE-2026-100609","FlowiseAI","Flowise","Flowise through 3.1.4 Insecure Direct Object Reference via Credential","HIGH",7.6,"2026-09-26",0],["CVE-2026-100607","FlowiseAI","Flowise","Flowise through 3.1.4 Authentication Bypass via Email-Only SSO","CRITICAL",9.2,"2026-09-26",0],["CVE-2026-100605","FlowiseAI","Flowise","Flowise through 3.1.4 Missing Authorization via Chat Message Routes","HIGH",7.5,"2026-09-26",0],["CVE-2026-100606","FlowiseAI","Flowise","Flowise through 3.1.4 Authentication Bypass via SSO Email Match","CRITICAL",9.2,"2026-09-26",0],["CVE-2026-100604","openclaw","clawhub","ClawHub Authentication Bypass via Former Publisher Skill Control","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100602","openclaw","clawhub","ClawHub Changelog Preview Information Disclosure via Authorization Bypass","HIGH",7.1,"2026-09-26",0],["CVE-2026-100603","openclaw","clawhub","ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports","HIGH",8.7,"2026-09-26",0],["CVE-2026-100601","openclaw","clawhub","ClawHub SSRF via Unchecked DNS Resolution in Profile Image","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100600","openclaw","clawhub","ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100315","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100314","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100313","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100312","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-98163","Linux","Linux","cgroup: Avoid iteration of dying tasks with zero refcount","HIGH",7.8,"2026-09-26",0],["CVE-2026-100311","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross s","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-18143","Addify","Request a Quote for WooCommerce","Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX ","CRITICAL",9.8,"2026-09-26",0],["CVE-2026-96531","","Optimole","Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-96532","","Testimonials Widget","Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update","HIGH",7.5,"2026-09-26",0],["CVE-2026-96533","","Testimonials Widget","Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL","MEDIUM",5.8,"2026-09-26",0],["CVE-2026-85081","","File Manager","Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass","HIGH",7.5,"2026-09-26",0],["CVE-2026-92411","","WP Delicious","WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-96524","","MCP Server for WordPress","MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF","HIGH",8.8,"2026-09-26",0],["CVE-2026-96525","","MCP Server for WordPress","MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Mis","LOW",2.7,"2026-09-26",0],["CVE-2026-96526","","MCP Server for WordPress","MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workfl","LOW",2.7,"2026-09-26",0],["CVE-2026-19708","","File Manager","File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure","MEDIUM",5.9,"2026-09-26",0],["CVE-2026-84095","","wp-review-slider-pro","WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import","HIGH",8,"2026-09-26",0],["CVE-2026-84096","","wp-review-slider-pro","WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields","HIGH",8,"2026-09-26",0],["CVE-2026-84097","","wp-review-slider-pro","WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-11871","","Team Members","Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-16591","","WP Directory Kit","WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and I","HIGH",7.2,"2026-09-26",0],["CVE-2026-89237","","Bluff Post","Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-15273","Automatic.css","Automatic.css","Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI","MEDIUM",6.4,"2026-09-26",0],["CVE-2026-100598","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Approval Binding Logic Error","HIGH",7.5,"2026-09-26",0],["CVE-2026-100599","OpenClaw","OpenClaw","OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome","HIGH",8.7,"2026-09-26",0],["CVE-2026-100597","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Path Traversal via Filesystem Race","HIGH",8.8,"2026-09-26",0],["CVE-2026-100595","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via diagnostics","HIGH",7.1,"2026-09-26",0],["CVE-2026-100596","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration","HIGH",8.7,"2026-09-26",0],["CVE-2026-100594","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via trajectory export","HIGH",7.1,"2026-09-26",0],["CVE-2026-100592","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100593","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via activation","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100591","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via Active Memory","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100589","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node","HIGH",8.7,"2026-09-26",0],["CVE-2026-100590","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via voice set","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100588","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via node.invoke","HIGH",8.7,"2026-09-26",0],["CVE-2026-100586","OpenClaw","OpenClaw","OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind","HIGH",8.7,"2026-09-26",0],["CVE-2026-100587","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via Codex Install","HIGH",8.7,"2026-09-26",0],["CVE-2026-100585","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel","HIGH",8.6,"2026-09-26",0],["CVE-2026-100583","openclaw","discord","OpenClaw Discord before 2026.7.1 Authorization Bypass","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100584","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows","MEDIUM",5.4,"2026-09-26",0],["CVE-2026-100582","openclaw","msteams","OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass","HIGH",7.1,"2026-09-26",0],["CVE-2026-100580","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Remote Code Execution via cron tool","HIGH",8.7,"2026-09-26",0],["CVE-2026-100581","OpenClaw","OpenClaw","OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-100579","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester","HIGH",7.2,"2026-09-26",0],["CVE-2026-100577","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100578","OpenClaw","OpenClaw","OpenClaw before 2026.7.1 Authorization Bypass via chat.send","HIGH",7.2,"2026-09-26",0],["CVE-2026-100576","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100574","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS","HIGH",8.2,"2026-09-26",0],["CVE-2026-100575","openclaw","slack","OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM","HIGH",8.7,"2026-09-26",0],["CVE-2026-100573","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback","MEDIUM",4.8,"2026-09-26",0],["CVE-2026-100571","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100572","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Denial of Service via Rate Limit","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100570","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS","HIGH",8.5,"2026-09-26",0],["CVE-2026-100568","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Unauthorized Command Job Access","HIGH",8.7,"2026-09-26",0],["CVE-2026-100569","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-100567","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname","HIGH",8.9,"2026-09-26",0],["CVE-2026-100564","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100566","openclaw","line","OpenClaw LINE before 2026.8.1 Access Control Inheritance","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100563","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100562","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authorization Bypass via sessions.create","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100560","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass","HIGH",7.7,"2026-09-26",0],["CVE-2026-100561","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper","HIGH",8.6,"2026-09-26",0],["CVE-2026-100559","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Command Injection via Escaped Newlines","HIGH",8.6,"2026-09-26",0],["CVE-2026-100557","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch","HIGH",8.7,"2026-09-26",0],["CVE-2026-100558","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade","HIGH",8.7,"2026-09-26",0],["CVE-2026-100556","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authentication Bypass via Session Reset","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100554","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass","LOW",2.3,"2026-09-26",0],["CVE-2026-100555","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery","HIGH",7.1,"2026-09-26",0],["CVE-2026-100553","OpenClaw","OpenClaw","OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100552","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Policy Bypass via Native Tools","HIGH",8.7,"2026-09-26",0],["CVE-2026-100551","OpenClaw","OpenClaw","OpenClaw iOS Control UI TLS Pin Enforcement Bypass","CRITICAL",9,"2026-09-26",0],["CVE-2026-100549","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100550","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authentication Bypass via Access Group","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100547","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authentication Bypass via File URL","MEDIUM",6.8,"2026-09-26",0],["CVE-2026-100548","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback","MEDIUM",6,"2026-09-26",0],["CVE-2026-100546","OpenClaw","OpenClaw","OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript","MEDIUM",6.1,"2026-09-26",0],["CVE-2026-100544","openclaw","voice-call","openclaw voice-call before 2026.8.1 Authorization Bypass","HIGH",8.7,"2026-09-26",0],["CVE-2026-100545","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation","MEDIUM",6,"2026-09-26",0],["CVE-2026-100543","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash","HIGH",7.7,"2026-09-26",0],["CVE-2026-100541","openclaw","matrix","OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding","HIGH",7.7,"2026-09-26",0],["CVE-2026-100542","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2","LOW",2.3,"2026-09-26",0],["CVE-2026-100540","openclaw","feishu","OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account","HIGH",7.6,"2026-09-26",0],["CVE-2026-100538","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Local File Read via Outbound Attachments","HIGH",7.1,"2026-09-26",0],["CVE-2026-100539","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Memory Access Control Bypass","LOW",2.1,"2026-09-26",0],["CVE-2026-100537","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authentication Bypass via Active Memory","LOW",2.3,"2026-09-26",0],["CVE-2026-100535","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Privilege Escalation via Session Memory","HIGH",7.7,"2026-09-26",0],["CVE-2026-100536","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Path Traversal via Structured Attachments","HIGH",7.1,"2026-09-26",0],["CVE-2026-100534","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass","LOW",2.3,"2026-09-26",0],["CVE-2026-100532","openclaw","whatsapp","openclaw WhatsApp before 2026.8.1 Authentication Bypass","HIGH",7.2,"2026-09-26",0],["CVE-2026-100533","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback","MEDIUM",6,"2026-09-26",0],["CVE-2026-100531","openclaw","slack","openclaw Slack before 2026.8.1 Authorization Bypass","HIGH",7.1,"2026-09-26",0],["CVE-2026-100529","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer","HIGH",7.4,"2026-09-26",0],["CVE-2026-100530","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Exec Approval Directory Binding","HIGH",8.5,"2026-09-26",0],["CVE-2026-100528","OpenClaw","OpenClaw","OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint","MEDIUM",5.9,"2026-09-26",0],["CVE-2026-100526","openclaw","discord","Vulnerability in discord","MEDIUM",6,"2026-09-26",0],["CVE-2026-100527","OpenClaw","OpenClaw","OpenClaw before 2026.8.2 Denial of Service via Browser Relay","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100525","openclaw","diagnostics-prometheus","OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100523","Cotonti","Cotonti","Cotonti through 1.0.0 Open Redirect via message.php redirect parameter","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100524","Cotonti","Cotonti","Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-100522","Cotonti","Cotonti","Cotonti through 1.0.0 Reflected XSS via message.php lng parameter","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100520","crivion","Laranode","Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint","HIGH",8.7,"2026-09-26",0],["CVE-2026-100521","Cotonti","Cotonti","Cotonti through 1.0.0 Reflected XSS via search highlight parameter","MEDIUM",5.1,"2026-09-26",0],["CVE-2026-100505","NationalSecurityAgency","ghidra","Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager","MEDIUM",4.8,"2026-09-26",0],["CVE-2026-100504","NationalSecurityAgency","ghidra","Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128","HIGH",7.3,"2026-09-26",0],["CVE-2026-100503","NationalSecurityAgency","ghidra","Ghidra through 12.1.4 Heap Use-After-Free in Decompiler","MEDIUM",4.8,"2026-09-26",0],["CVE-2026-86066","horilla","horilla-hr","Horilla attendance approval endpoint is vulnerable to cross-site request forgery","MEDIUM",5.9,"2026-09-26",0],["CVE-2026-96795","horilla","horilla-hr","Horilla: Authenticated RCE in Horilla List-View Export","HIGH",8.8,"2026-09-26",0],["CVE-2026-57449","actualbudget","actual","Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositori","HIGH",7.1,"2026-09-26",0],["CVE-2026-100502","pawelmalak","flame","Flame through 2.4.0 Admin Token Insufficient Session Expiration","MEDIUM",5.9,"2026-09-26",0],["CVE-2026-100501","pawelmalak","flame","Flame through 2.4.0 Brute-Force Attack via Login Endpoint","HIGH",8.3,"2026-09-26",0],["CVE-2026-100418","pawelmalak","flame","Flame through 2.4.0 Information Exposure via GET /api/config","MEDIUM",6.9,"2026-09-26",0],["CVE-2026-100419","GitoxideLabs","gitoxide","gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink","HIGH",7.3,"2026-09-26",0],["CVE-2026-71483","horilla","horilla-hr","Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View","HIGH",8.5,"2026-09-26",0],["CVE-2026-63432","horilla","horilla-hr","Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authentica","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-63431","horilla","horilla-hr","Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structur","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-88003","InvoicePlane","InvoicePlane","InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade","HIGH",7.5,"2026-09-26",0],["CVE-2026-92842","PHP Group","PHP","OOB read / info leak in convert.* stream filters when line-break-chars contains NUL","MEDIUM",5.9,"2026-09-26",0],["CVE-2026-91768","PHP Group","PHP","IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcm","MEDIUM",6.5,"2026-09-26",0],["CVE-2026-100383","Wikimedia Foundation","Mediawiki - WikiLambda Extension","Stored i18n XSS in WikiLambda's VisualEditor integration","MEDIUM",4.8,"2026-09-26",0],["CVE-2026-100382","Wikimedia Foundation","Mediawiki - ExternalData Extension","Unauthenticated remote code execution through wikitext in ExternalData","CRITICAL",10,"2026-09-26",0],["CVE-2026-100381","Wikimedia Foundation","Mediawiki - UploadWizard Extension","UploadWizard Flickr collection and set titles allow DOM XSS","MEDIUM",5.3,"2026-09-26",0],["CVE-2026-91769","PHP Group","PHP","TLS Hostname Verification Falls Back to CN After SAN Mismatch","MEDIUM",4.3,"2026-09-25",0],["CVE-2026-100380","Wikimedia Foundation","Mediawiki - Wikibase Extension","Reflected XSS in Wikibase Special:SetLabel language validation","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-100379","Wikimedia Foundation","Wikipedia Android App","Cross-request disclosure of CentralAuth cookies in Wikipedia Android App","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-91767","PHP Group","PHP","Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard ","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-100378","Wikimedia Foundation","Mediawiki - Translate Extension","Missing permission check in the Translate sandbox doRemind action","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-10758","Esri","Lerc","Esri Lerc has a security vulnerability","HIGH",7.5,"2026-09-25",0],["CVE-2026-100376","Wikimedia Foundation","Mediawiki - TemplateSandbox Extension","TemplateSandbox can be abused for XSS by asking another user to preview a page with a cert","MEDIUM",4.8,"2026-09-25",0],["CVE-2025-1218","PHP Group","PHP","Various packet overreads in mysqlnd_writeprotocol.c","LOW",3.4,"2026-09-25",0],["CVE-2026-100377","Wikimedia Foundation","Mediawiki - WikiLambda Extension","Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbst","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-91766","PHP Group","PHP","Cross-origin credential leak in HTTP stream wrapper redirects","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-57443","issdandavis","SCBE-AETHERMOORE","SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","HIGH",7.5,"2026-09-25",0],["CVE-2026-91765","PHP Group","PHP","SOAP: Unbounded Recursion in Server-Side cleanup_xml_node","HIGH",7.5,"2026-09-25",0],["CVE-2026-100369","alastairlundy","CliInvoke","CliInvoke: Argument Injection in Extensibility Runner Factory","HIGH",8.4,"2026-09-25",0],["CVE-2025-14181","PHP Group","PHP","Integer overflow to buffer overflow in soap HTTP parsing","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-100417","rustdesk","rustdesk","RustDesk before 1.5.0 One-Way File Transfer Bypass","LOW",2.3,"2026-09-25",0],["CVE-2026-17545","PHP Group","PHP","PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can ca","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-100391","mhdzumair","mediaflow-proxy","MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation","HIGH",8.8,"2026-09-25",0],["CVE-2026-100390","tobychui","zoraxy","Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-100389","GestSup","GestSup","GestSup before 3.2.62 Remote Code Execution via IMAP Attachment","CRITICAL",9.2,"2026-09-25",0],["CVE-2026-100388","rustdesk","rustdesk","RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-100387","pgpointcloud","pointcloud","pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization","HIGH",7.2,"2026-09-25",0],["CVE-2026-96879","The Wikimedia Foundation","Mediawiki - FlaggedRevs extension","\"Checked by\" label in page history should not be shown if the underlying review log entry ","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-6103","PHP Group","PHP","Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection","MEDIUM",4.3,"2026-09-25",0],["CVE-2026-93682","PHP Group","PHP","Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Loca","MEDIUM",5.8,"2026-09-25",0],["CVE-2026-100368","alastairlundy","CliInvoke.Specializations","CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers","HIGH",8.4,"2026-09-25",0],["CVE-2026-96878","The Wikimedia Foundation","Mediawiki - Cargo extension","Cargo Exhibit field alias allows stored XSS","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-96877","The Wikimedia Foundation","Mediawiki - Cargo extension","Reflected XSS through Cargo Drilldown full-text search","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-100208","Microsoft","Microsoft 365 Apps for Enterprise","Microsoft Office Outlook Remote Code Execution Vulnerability","HIGH",7.5,"2026-09-25",0],["CVE-2026-100372","MacWarrior","clipbucket-v5","ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php","HIGH",8.6,"2026-09-25",0],["CVE-2026-100373","open-metadata","OpenMetadata","OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-100310","GNU","libextractor","GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX","HIGH",7.3,"2026-09-25",0],["CVE-2026-96876","The Wikimedia Foundation","Mediawiki - Cargo extension","Anonymous reflected XSS in CargoExport invalid-alias errors","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-96875","The Wikimedia Foundation","Mediawiki - Cargo extension","Reflected XSS in Cargo Drilldown hierarchy filters","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-5267","Ciena","Navigator NCS","Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS","HIGH",7.5,"2026-09-25",0],["CVE-2026-100305","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endp","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-100306","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-100304","TDuckCloud","tduck-survey-form","TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check","MEDIUM",6,"2026-09-25",0],["CVE-2026-100303","TDuckCloud","tduck-survey-form","TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-97897","Krayin","laravel-crm","Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-53629","glpi-project","glpi","GLPI: SQL injection in history tab","HIGH",7.1,"2026-09-25",0],["CVE-2026-53626","glpi-project","glpi","GLPI: Arbitrary Document Read via Form Context Authorization Bypass","HIGH",7.1,"2026-09-25",0],["CVE-2026-48482","glpi-project","glpi","GLPI: RCE via Form import","CRITICAL",9.4,"2026-09-25",0],["CVE-2026-53625","glpi-project","glpi","GLPI: Privilege Escalation via authtype API manipulation","HIGH",7.5,"2026-09-25",0],["CVE-2026-53610","glpi-project","glpi","GLPI: Reflected XSS in dashboards","HIGH",7.5,"2026-09-25",0],["CVE-2026-47679","glpi-project","glpi","GLPI: arbitrary file deletion","HIGH",8.5,"2026-09-25",0],["CVE-2026-55214","glpi-project","glpi","GLPI: Stored XSS in suppliers","HIGH",8.5,"2026-09-25",0],["CVE-2026-49470","glpi-project","glpi","GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Fo","HIGH",7.7,"2026-09-25",0],["CVE-2026-97896","krayin","laravel-crm","krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-55217","glpi-project","glpi","GLPI: Unallowed modfication of knowbase items comments and translations","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-53628","glpi-project","glpi","GLPI: Unallowed authentication method update by administrator","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-45801","glpi-project","glpi","GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-53627","glpi-project","glpi","GLPI: Unexpected access to update operations through the API","MEDIUM",6,"2026-09-25",0],["CVE-2026-49469","glpi-project","glpi","GLPI: LDAP filter injection in user import feature","MEDIUM",4.6,"2026-09-25",0],["CVE-2026-63208","zammad","zammad","Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-63006","zammad","zammad","Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/sr","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-63204","zammad","zammad","Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets","LOW",2.3,"2026-09-25",0],["CVE-2026-61855","zammad","zammad","Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-84461","zammad","zammad","Zammad: Missing rate limiting allows password brute-forcing during two-factor login","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-63207","zammad","zammad","Zammad: Sensitive Information Exposure in Integration Administration API","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-84465","zammad","zammad","Zammad: S/MIME signature verification allows forged sender impersonation","HIGH",7.1,"2026-09-25",0],["CVE-2026-84463","zammad","zammad","Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switch","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-84464","zammad","zammad","Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organizati","HIGH",7.1,"2026-09-25",0],["CVE-2026-63216","zammad","zammad","Zammad: Stored XSS via unescaped option labels in the object attribute options context UI","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-84458","zammad","zammad","Zammad: Account takeover via unverified email matching during SSO auto-link","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-97895","krayin","laravel-crm","krayin laravel-crm User Management UserController.php privileges management","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-84460","zammad","zammad","Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-63206","zammad","zammad","Zammad: Remote image tracking bypass via shortened URL scheme","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-63205","zammad","zammad","Zammad: Channel admins can read unauthorized attachments via signature rich-text body","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-97063","yzcheng90","X-SpringBoot","X-SpringBoot through 6.0 Authentication Bypass via Login Code","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-97064","yzcheng90","X-SpringBoot","X-SpringBoot through 6.0 Authentication Bypass via Static Master Code","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-97060","yzcheng90","X-SpringBoot","X-SpringBoot through 6.0 Authorization Bypass via User Management","HIGH",8.6,"2026-09-25",0],["CVE-2026-100192","yzcheng90","X-SpringBoot","X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-97886","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-91841","GNOME","NetworkManager-vpnc","Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root pr","HIGH",7.8,"2026-09-25",0],["CVE-2026-91840","GNOME","NetworkManager-vpnc","Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline i","HIGH",7.8,"2026-09-25",0],["CVE-2026-91839","GNOME","NetworkManager-fortisslvpn","Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root","HIGH",7.8,"2026-09-25",0],["CVE-2026-91838","GNOME","NetworkManager-sstp","Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell inj","HIGH",7.8,"2026-09-25",0],["CVE-2026-97885","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-97884","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-84462","zammad","zammad","Zammad: AI Agent template sanitizer bypass leads to remote code execution","HIGH",8.6,"2026-09-25",0],["CVE-2026-65828","zammad","zammad","Zammad: Pending upload deletion bypass via legacy attachment endpoint","LOW",2.3,"2026-09-25",0],["CVE-2026-97883","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-61525","zammad","zammad","Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Control","HIGH",8.8,"2026-09-25",0],["CVE-2026-56728","zammad","zammad","Zammad: Cross-User Taskbar Item Access Control Vulnerability","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-56725","zammad","zammad","Zammad: Denial of Service via OTRS Import Controller","HIGH",8.7,"2026-09-25",0],["CVE-2026-56732","zammad","zammad","Zammad: Malicious input in Ticket Body Enables Session Termination","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-56730","zammad","zammad","Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers","LOW",2.1,"2026-09-25",0],["CVE-2026-56733","zammad","zammad","Zammad: Incorrect Authorization and Improper Privilege Management","HIGH",8.7,"2026-09-25",0],["CVE-2026-56731","zammad","zammad","Zammad: Cross-Site Scripting in Ticket Notifications","HIGH",8.4,"2026-09-25",0],["CVE-2026-56735","zammad","zammad","Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-56727","zammad","zammad","Zammad: PGP signature spoofing via unvalidated verification return","HIGH",7.1,"2026-09-25",0],["CVE-2026-56734","zammad","zammad","Zammad: Avatar Image URL Server-Side Request Forwarding","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-56726","zammad","zammad","Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket dat","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-93366","Bludit","Bludit CMS","Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-97882","mathurvishal","CloudClassroom-PHP-Project","mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql in","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-93365","Bludit","Bludit CMS","Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint","HIGH",7.1,"2026-09-25",0],["CVE-2026-56729","zammad","zammad","Zammad: Titles of knowledge base answers will be shown across all categories via the globa","LOW",2.1,"2026-09-25",0],["CVE-2026-93364","Bludit","Bludit CMS","Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-93363","payloadcms","payload","Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-56723","zammad","zammad","Zammad: Missing authorization on ticket attachment download","HIGH",7.1,"2026-09-25",0],["CVE-2026-100237","The Wikimedia Foundation","Mediawiki - Thanks Extension","Stored i18n XSS in the Flow integration of Thanks","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-56724","zammad","zammad","Zammad: Incorrect implementation of permission checks in the knowledge base module","HIGH",7.1,"2026-09-25",0],["CVE-2026-97879","zhistaredu","StarTraining","zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-94445","golang.org/x/playground","golang.org/x/playground","Malicious user input may lead to RCE in golang.org/x/playground","HIGH",8.8,"2026-09-25",0],["CVE-2026-67420","rabbitmq","rabbitmq-server","RabbitMQ OAuth credential refresh retains revoked runtime tags","LOW",2.3,"2026-09-25",0],["CVE-2026-67419","rabbitmq","rabbitmq-server","RabbitMQ: Consecutive topic wildcards cause combinatorial routing work","HIGH",7.1,"2026-09-25",0],["CVE-2026-67421","rabbitmq","rabbitmq-server","RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling","MEDIUM",4.5,"2026-09-25",0],["CVE-2026-67408","rabbitmq","rabbitmq-server","RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node","HIGH",7.1,"2026-09-25",0],["CVE-2026-67406","rabbitmq","rabbitmq-server","RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Creden","MEDIUM",4.6,"2026-09-25",0],["CVE-2026-95835","Kovid Goyal","kitty","Missing ownership check on the shared memory object named by the kitty askpass escape code","MEDIUM",5.6,"2026-09-25",0],["CVE-2026-67410","rabbitmq","rabbitmq-server","RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint","HIGH",8.2,"2026-09-25",0],["CVE-2026-67227","rabbitmq","rabbitmq-server","RabbitMQ: Atom exhaustion: to_atom on global-parameter :name","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-67407","rabbitmq","rabbitmq-server","RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, le","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-97878","zhistaredu","StarTraining","zhistaredu StarTraining Druid Console index.html anonymous missing authentication","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-67226","rabbitmq","rabbitmq-server","RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-95834","Kovid Goyal","kitty","Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-","MEDIUM",4.6,"2026-09-25",0],["CVE-2026-18311","Readwise","Reader","CVE-2026-18311","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-18320","Readwise","Reader","CVE-2026-18320","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-18312","Readwise","Reader","CVE-2026-18312","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-67411","rabbitmq","rabbitmq-server","RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass","MEDIUM",6,"2026-09-25",0],["CVE-2026-67413","rabbitmq","rabbitmq-server","RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an U","MEDIUM",6,"2026-09-25",0],["CVE-2026-61837","rabbitmq","rabbitmq-server","RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authent","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-80432","Kovid Goyal","kitty","Missing authorization in the kitty drag and drop protocol allows a client to obtain dragge","MEDIUM",6,"2026-09-25",0],["CVE-2026-67415","rabbitmq","rabbitmq-server","RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Servic","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-67412","rabbitmq","rabbitmq-server","RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message acces","MEDIUM",6,"2026-09-25",0],["CVE-2026-67409","rabbitmq","rabbitmq-server","RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Au","HIGH",8.2,"2026-09-25",0],["CVE-2026-67242","rabbitmq","rabbitmq-server","RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-97877","zhistaredu","StarTraining","zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded ","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-67223","rabbitmq","rabbitmq-server","RabbitMQ: LDAP DN injection via unescaped substitution","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-91837","GNOME","NetworkManager-iodine","Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via names","HIGH",7.8,"2026-09-25",0],["CVE-2026-67239","rabbitmq","rabbitmq-server","RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI","HIGH",7.6,"2026-09-25",0],["CVE-2026-67241","rabbitmq","rabbitmq-server","RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check","MEDIUM",4.8,"2026-09-25",0],["CVE-2026-100248","Rattadan","Cosmowarp Contract","The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintende","HIGH",8.4,"2026-09-25",0],["CVE-2026-66071","rabbitmq","rabbitmq-server","RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values","MEDIUM",6,"2026-09-25",0],["CVE-2026-66078","rabbitmq","rabbitmq-server","RabbitMQ: protected tag bypass via bulk-delete","LOW",2.1,"2026-09-25",0],["CVE-2026-66073","rabbitmq","rabbitmq-server","RabbitMQ: Atom table exhaustion via management API node field","MEDIUM",6,"2026-09-25",0],["CVE-2026-67237","rabbitmq","rabbitmq-server","RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint","HIGH",7.5,"2026-09-25",0],["CVE-2026-89032","BerriAI","litellm","BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer","HIGH",8.7,"2026-09-25",0],["CVE-2026-67234","rabbitmq","rabbitmq-server","RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference","LOW",2.3,"2026-09-25",0],["CVE-2026-67225","rabbitmq","rabbitmq-server","RabbitMQ: Stream-protocol frame length never validated against frame_max","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-67230","rabbitmq","rabbitmq-server","RabbitMQ: Web-STOMP unbounded pre-auth accumulation","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-67222","rabbitmq","rabbitmq-server","RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-97871","Zhonglun","CloudPos","Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-67236","rabbitmq","rabbitmq-server","RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /","HIGH",8.2,"2026-09-25",0],["CVE-2026-92161","FriendsOfFlarum","oauth","FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Disc","CRITICAL",9.8,"2026-09-25",0],["CVE-2026-42322","Piwigo","Piwigo","Piwigo: Authenticated RCE via File Upload in Logo Upload Feature","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-42324","Piwigo","Piwigo","Piwigo: Second-Order SQL Injection","HIGH",7.2,"2026-09-25",0],["CVE-2026-44642","Piwigo","Piwigo","Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorizati","HIGH",8.1,"2026-09-25",0],["CVE-2026-62262","Piwigo","Piwigo","Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-42323","Piwigo","Piwigo","Piwigo: SQL Injection in Batch Manager","HIGH",7.2,"2026-09-25",0],["CVE-2026-97469","DALIBO","PostgreSQL Anonymizer","PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink","MEDIUM",4.3,"2026-09-25",0],["CVE-2026-49850","InvoicePlane","InvoicePlane","InvoicePlane: Missing CSRF Protection on State-Changing delete Actions","HIGH",7.5,"2026-09-25",0],["CVE-2026-50547","InvoicePlane","InvoicePlane","InvoicePlane permits local file inclusion through the e-invoice XML configuration identifi","HIGH",7.5,"2026-09-25",0],["CVE-2026-33639","InvoicePlane","InvoicePlane","InvoicePlane permits DDL injection through tax_rate_decimal_places","HIGH",7.2,"2026-09-25",0],["CVE-2026-100230","input-leap","Input Leap","Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option ","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-39353","InvoicePlane","InvoicePlane","InvoicePlane: Remote Code Execution via Writable Templates Directory","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-85293","InvoicePlane","InvoicePlane","InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mail","MEDIUM",4.8,"2026-09-25",0],["CVE-2026-85291","InvoicePlane","InvoicePlane","InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorizati","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-85289","InvoicePlane","InvoicePlane","InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-85292","InvoicePlane","InvoicePlane","InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)","MEDIUM",4.8,"2026-09-25",0],["CVE-2026-85274","InvoicePlane","InvoicePlane","InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-85290","InvoicePlane","InvoicePlane","InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-39372","InvoicePlane","InvoicePlane","InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments","MEDIUM",4.9,"2026-09-25",0],["CVE-2026-54790","InvoicePlane","InvoicePlane","InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field ","MEDIUM",6,"2026-09-25",0],["CVE-2026-97869","","langchain4j","langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerialize","LOW",2.1,"2026-09-25",0],["CVE-2026-97868","sheshbabu","zen","sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-96874","The Wikimedia Foundation","Mediawiki - Cargo extension","Stored XSS in Cargo Drilldown tab names","LOW",2.3,"2026-09-25",0],["CVE-2026-96812","Google","gVisor","Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE","HIGH",8.8,"2026-09-25",0],["CVE-2026-97866","Zhonglun","CloudPOS","Zhonglun CloudPOS Automatic Update Program.cs channel accessible","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-93030","IBM","IBM Financial Transaction Manager (FTM) for Redhat OpenShift","FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information du","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-93306","IBM","Server Firmware","This Power System update is being released to address","HIGH",7.1,"2026-09-25",0],["CVE-2026-84862","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.2,"2026-09-25",0],["CVE-2026-84882","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.5,"2026-09-25",0],["CVE-2026-84884","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.5,"2026-09-25",0],["CVE-2026-84893","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.6,"2026-09-25",0],["CVE-2026-93647","Zimbra","Zimbra Collaboration Suite (ZCS)","Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Cale","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-93643","Zimbra","Zimbra Collaboration Suite (ZCS)","Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Ex","CRITICAL",9.8,"2026-09-25",0],["CVE-2026-85029","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",7.5,"2026-09-25",0],["CVE-2026-93642","Zimbra","Zimbra Collaboration Suite (ZCS)","Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share ","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-93641","Zimbra","Zimbra Collaboration Suite (ZCS)","Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-85542","IBM","Guardium Data Protection","IBM Guardium Data Protection is affected by multiple vulnerabilities.","HIGH",8.8,"2026-09-25",0],["CVE-2026-100190","ail project","ail framework","Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain P","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-97222","GNOME","Gnumeric","Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook","MEDIUM",5.5,"2026-09-25",0],["CVE-2026-85750","Piwigo","Piwigo","Piwigo arbitrary file read and remote code execution via insecure image processing","HIGH",7.2,"2026-09-25",0],["CVE-2026-100187","ail project","ail framework","AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain ","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-93834","Red Hat","Red Hat Enterprise Linux 10","Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape","HIGH",8.8,"2026-09-25",0],["CVE-2026-100177","ail project","ail framework","Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Coo","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-97865","","Open-Web-Analytics","Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-100176","ail project","ail framework","Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip","HIGH",8.5,"2026-09-25",0],["CVE-2026-80431","Kovid Goyal","kitty","Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal p","MEDIUM",6.8,"2026-09-25",0],["CVE-2026-100174","ail project","ail framework","Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-100172","ail project","ail framework","Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-","HIGH",8.5,"2026-09-25",0],["CVE-2026-80430","Kovid Goyal","kitty","Improper link resolution in the kitty drag and drop protocol allows a client to create fil","MEDIUM",4.6,"2026-09-25",0],["CVE-2026-98161","Linux","Linux","nvdimm: pmem: keep PREFLUSH before data writes","","","2026-09-25",0],["CVE-2026-98162","Linux","Linux","smb/server: fix tree connection leak in smb2_tree_connect()","","","2026-09-25",0],["CVE-2026-98160","Linux","Linux","staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()","","","2026-09-25",0],["CVE-2026-100078","Linux","Linux","wifi: iwlwifi: mei: pass correct argument to function","","","2026-09-25",0],["CVE-2026-100079","Linux","Linux","usb: typec: ucsi: unregister debugfs entries on teardown","","","2026-09-25",0],["CVE-2026-100076","Linux","Linux","staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths","","","2026-09-25",0],["CVE-2026-100077","Linux","Linux","drm/msm: Recover HW before retire hung submit","","","2026-09-25",0],["CVE-2026-100075","Linux","Linux","RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters","CRITICAL",9.8,"2026-09-25",0],["CVE-2026-100073","Linux","Linux","ext4: fix transaction overflow during writeback","","","2026-09-25",0],["CVE-2026-100074","Linux","Linux","bpf: Mark bpf_refcount field as unique","","","2026-09-25",0],["CVE-2026-100072","Linux","Linux","ACPI: platform: Use acpi_bus_get_primary_device()","","","2026-09-25",0],["CVE-2026-100070","Linux","Linux","netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet","","","2026-09-25",0],["CVE-2026-100071","Linux","Linux","net: hsr: free learned nodes on device setup failure","","","2026-09-25",0],["CVE-2026-97864","GibbonEdu","Gibbon","GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-95832","Kovid Goyal","kitty","Reflected unknown field names in the kitty colour control escape code allow command execut","CRITICAL",9.3,"2026-09-25",0],["CVE-2026-97875","rojo-rbx","rojo","DNS rebinding vulnerability in rojo serve HTTP API","HIGH",8.1,"2026-09-25",0],["CVE-2026-98159","Linux","Linux","wifi: mt76: mt7921: validate CLC firmware records","","","2026-09-25",0],["CVE-2026-98157","Linux","Linux","EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation","","","2026-09-25",0],["CVE-2026-98158","Linux","Linux","ppp_async: drop the errored frame instead of resetting its headroom","","","2026-09-25",0],["CVE-2026-98156","Linux","Linux","drm/virtio: use the DMA API for resource backing on Xen","HIGH",7.8,"2026-09-25",0],["CVE-2026-98154","Linux","Linux","nvme-rdma: fix -EIO cleanup order in queue_rq","HIGH",7,"2026-09-25",0],["CVE-2026-98155","Linux","Linux","accel/qaic: Address potential out-of-bounds read in resp_worker()","","","2026-09-25",0],["CVE-2026-98152","Linux","Linux","nvmet-rdma: fix queue leak when connect backlog is exceeded","","","2026-09-25",0],["CVE-2026-98153","Linux","Linux","nvme: fix racy access to FDP placement id array","","","2026-09-25",0],["CVE-2026-98151","Linux","Linux","bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic","","","2026-09-25",0],["CVE-2026-98149","Linux","Linux","bpf: Fix percpu map update indexing with sparse CPU IDs","","","2026-09-25",0],["CVE-2026-98150","Linux","Linux","bpf: Fix BPF_F_CPU validation for sparse CPU IDs","HIGH",7,"2026-09-25",0],["CVE-2026-98148","Linux","Linux","drm/gud: validate GUD_ROTATION_0 is present in supported rotations","","","2026-09-25",0],["CVE-2026-98146","Linux","Linux","accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain","","","2026-09-25",0],["CVE-2026-98147","Linux","Linux","printk: Don't WARN on kthread_run failure.","","","2026-09-25",0],["CVE-2026-98144","Linux","Linux","accel/amdxdna: put the chained BO when its mapping fails","","","2026-09-25",0],["CVE-2026-98145","Linux","Linux","accel/amdxdna: reject a command chain that carries no commands","","","2026-09-25",0],["CVE-2026-98143","Linux","Linux","accel: ethosu: Don't read the U65 rounding mode as a storage mode","HIGH",7.8,"2026-09-25",0],["CVE-2026-98141","Linux","Linux","ntfs: propagate reparse index insertion failure","","","2026-09-25",0],["CVE-2026-98142","Linux","Linux","drm/cirrus-qemu: Validate BAR0 size during probe","","","2026-09-25",0],["CVE-2026-98140","Linux","Linux","ntfs: fix kmap_local leak in write_mft_record_nolock() error paths","","","2026-09-25",0],["CVE-2026-98138","Linux","Linux","ntfs: do not mark the volume clean in sync_fs when errors were recorded","","","2026-09-25",0],["CVE-2026-98139","Linux","Linux","ntfs: only count successfully cleared runs when freeing clusters","","","2026-09-25",0],["CVE-2026-98136","Linux","Linux","ntfs: bound $AttrDef table walk to the loaded table size","","","2026-09-25",0],["CVE-2026-98137","Linux","Linux","ntfs: treat any nonzero dio zero-range return as an error","","","2026-09-25",0],["CVE-2026-98135","Linux","Linux","ntfs: reject invalid sectors_per_cluster in the boot sector","","","2026-09-25",0],["CVE-2026-98133","Linux","Linux","ntfs: leave HasEA flag untouched on setxattr failure","","","2026-09-25",0],["CVE-2026-98134","Linux","Linux","bpf: check_cond_jmp_op(): properly infer if register is null","","","2026-09-25",0],["CVE-2026-98131","Linux","Linux","net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","","","2026-09-25",0],["CVE-2026-98132","Linux","Linux","bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO","","","2026-09-25",0],["CVE-2026-98130","Linux","Linux","sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START","HIGH",8.1,"2026-09-25",0],["CVE-2026-98128","Linux","Linux","scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()","","","2026-09-25",0],["CVE-2026-98129","Linux","Linux","scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()","","","2026-09-25",0],["CVE-2026-98127","Linux","Linux","smb/client: validate new EOF for insert range","","","2026-09-25",0],["CVE-2026-98125","Linux","Linux","smb/client: fix stale page cache in insert/collapse range","","","2026-09-25",0],["CVE-2026-98126","Linux","Linux","smb/client: validate new EOF for zero range","","","2026-09-25",0],["CVE-2026-98124","Linux","Linux","smb/client: invalidate fscache for fallocate range operations","","","2026-09-25",0],["CVE-2026-98122","Linux","Linux","vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()","HIGH",7.8,"2026-09-25",0],["CVE-2026-98123","Linux","Linux","sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration","","","2026-09-25",0],["CVE-2026-98120","Linux","Linux","netfs: Fix subreq ref leak","","","2026-09-25",0],["CVE-2026-98121","Linux","Linux","watchdog: msc313e: Fix NULL pointer dereference in PM callbacks","","","2026-09-25",0],["CVE-2026-98119","Linux","Linux","netfs: break unbuffered write when netfs_alloc_subrequest() fails","","","2026-09-25",0],["CVE-2026-98117","Linux","Linux","cachefiles: Fix potential UAF/KASAN warning","","","2026-09-25",0],["CVE-2026-98118","Linux","Linux","netfs: Fix readahead synchronisation issues by loading all folios upfront","","","2026-09-25",0],["CVE-2026-98115","Linux","Linux","ksmbd: safely drain sessions during logoff","HIGH",8.8,"2026-09-25",0],["CVE-2026-98116","Linux","Linux","ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF","HIGH",7.8,"2026-09-25",0],["CVE-2026-98114","Linux","Linux","ksmbd: propagate DACL parsing errors","","","2026-09-25",0],["CVE-2026-98112","Linux","Linux","ksmbd: fix listener task lifetime on netdev events","HIGH",7.8,"2026-09-25",0],["CVE-2026-98113","Linux","Linux","ksmbd: rate limit unmapped SID errors","","","2026-09-25",0],["CVE-2026-98110","Linux","Linux","Bluetooth: btintel: bound firmware ID by TLV length","","","2026-09-25",0],["CVE-2026-98111","Linux","Linux","Bluetooth: btintel: validate version TLV value lengths","","","2026-09-25",0],["CVE-2026-98109","Linux","Linux","Bluetooth: hci_core: Fix race condition during device registration","","","2026-09-25",0],["CVE-2026-98107","Linux","Linux","Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","","","2026-09-25",0],["CVE-2026-98108","Linux","Linux","Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","HIGH",7.5,"2026-09-25",0],["CVE-2026-98105","Linux","Linux","net: ethernet: oa_tc6: Improve the error recovery","","","2026-09-25",0],["CVE-2026-98106","Linux","Linux","drm/pagemap: Prevent double migration of device pages","","","2026-09-25",0],["CVE-2026-98104","Linux","Linux","net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted","","","2026-09-25",0],["CVE-2026-98102","Linux","Linux","ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","","","2026-09-25",0],["CVE-2026-98103","Linux","Linux","igmp: convert struct ip_sf_list to RCU","","","2026-09-25",0],["CVE-2026-98101","Linux","Linux","ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","","","2026-09-25",0],["CVE-2026-27867","Teldat","Regesta Smart HD-PLC - TLDPH16D2","CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT","MEDIUM",4.8,"2026-09-25",0],["CVE-2026-97228","Rapid7","Platform","Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup","LOW",2.7,"2026-09-25",0],["CVE-2026-98098","Linux","Linux","tipc: fix NULL deref in tipc_named_node_up() on empty publication list","","","2026-09-25",0],["CVE-2026-98099","Linux","Linux","ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","","","2026-09-25",0],["CVE-2026-98096","Linux","Linux","ipv6: sr: restore network header before routing and forwarding","HIGH",7.4,"2026-09-25",0],["CVE-2026-98097","Linux","Linux","tipc: Dont send random pad bytes in RESET/ACTIVATE messages","","","2026-09-25",0],["CVE-2026-98095","Linux","Linux","af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().","","","2026-09-25",0],["CVE-2026-98093","Linux","Linux","ASoC: fsl_micfil: balance mclk enable/disable","","","2026-09-25",0],["CVE-2026-98094","Linux","Linux","staging: fbtft: make dirty_lock IRQ-safe","","","2026-09-25",0],["CVE-2026-98091","Linux","Linux","btrfs: detach failed sprout device from transaction update list","","","2026-09-25",0],["CVE-2026-98092","Linux","Linux","ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()","","","2026-09-25",0],["CVE-2026-98090","Linux","Linux","btrfs: restore active device pointers after failed sprout","","","2026-09-25",0],["CVE-2026-98088","Linux","Linux","scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()","","","2026-09-25",0],["CVE-2026-98089","Linux","Linux","bonding: alb: fix uninitialized transport header access in alb_determine_nd()","","","2026-09-25",0],["CVE-2026-98086","Linux","Linux","ALSA: ump: do not touch legacy_rmidi before it exists","","","2026-09-25",0],["CVE-2026-98087","Linux","Linux","sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","","","2026-09-25",0],["CVE-2026-98085","Linux","Linux","bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","","","2026-09-25",0],["CVE-2026-98083","Linux","Linux","btrfs: fix transaction use-after-free in raid stripe insertion","HIGH",7,"2026-09-25",0],["CVE-2026-98084","Linux","Linux","bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","","","2026-09-25",0],["CVE-2026-98081","Linux","Linux","btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","","","2026-09-25",0],["CVE-2026-98082","Linux","Linux","btrfs: fix the possible bioc_list memory leak during error","","","2026-09-25",0],["CVE-2026-98080","Linux","Linux","btrfs: do not force reloc root creation during qgroup_account_snapshot()","","","2026-09-25",0],["CVE-2026-98078","Linux","Linux","ipvs: fix reversed sequence option serialization","","","2026-09-25",0],["CVE-2026-98079","Linux","Linux","btrfs: zstd: fix lost wakeup when waiting for a workspace","","","2026-09-25",0],["CVE-2026-98076","Linux","Linux","tracing/probes: Fix use-after-free on field name/type of events with multiple probes","","","2026-09-25",0],["CVE-2026-98077","Linux","Linux","netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()","","","2026-09-25",0],["CVE-2026-98075","Linux","Linux","bpf: reject BPF_PSEUDO_FUNC reference to the main program","","","2026-09-25",0],["CVE-2026-98073","Linux","Linux","net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","HIGH",7.8,"2026-09-25",0],["CVE-2026-98074","Linux","Linux","bonding: do not clear curr_active_slave prematurely when releasing all slaves","","","2026-09-25",0],["CVE-2026-98071","Linux","Linux","net/rds: clear cp_flags bits individually in rds_conn_path_reset()","","","2026-09-25",0],["CVE-2026-98072","Linux","Linux","net/rds: use wq_has_sleeper() in release_in_xmit()","","","2026-09-25",0],["CVE-2026-98070","Linux","Linux","net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()","HIGH",8.1,"2026-09-25",0],["CVE-2026-98068","Linux","Linux","net/rds: don't let rds_conn_shutdown() consume a concurrent drop","","","2026-09-25",0],["CVE-2026-98069","Linux","Linux","net/rds: acquire the fastpath locks in rds_conn_shutdown()","HIGH",8.1,"2026-09-25",0],["CVE-2026-98067","Linux","Linux","erofs: disable LZ4 rolling decompression for now","","","2026-09-25",0],["CVE-2026-98065","Linux","Linux","bpf: Reject key-less BTF for hash maps","","","2026-09-25",0],["CVE-2026-98066","Linux","Linux","ALSA: caiaq: Fix potential double-free at error path","","","2026-09-25",0],["CVE-2026-98063","Linux","Linux","bpf: Fix NULL-ptr-deref in btf_var_show()","","","2026-09-25",0],["CVE-2026-98064","Linux","Linux","bpf: Fix NULL-ptr-deref when showing a void BTF type","","","2026-09-25",0],["CVE-2026-98061","Linux","Linux","bpf: Reject tail calls directly from callback frames","","","2026-09-25",0],["CVE-2026-98062","Linux","Linux","bpf: Mark signal tracepoint siginfo arguments as scalar","","","2026-09-25",0],["CVE-2026-98060","Linux","Linux","bpf: Reject resilient lock operations in rbtree callbacks","","","2026-09-25",0],["CVE-2026-98058","Linux","Linux","bpf: Mark syscall helpers as sleepable","","","2026-09-25",0],["CVE-2026-98059","Linux","Linux","bpf: Mark sched_process_wait argument as nullable","","","2026-09-25",0],["CVE-2026-98057","Linux","Linux","ring-buffer: Add checking nr_subbufs to persistent ring buffer validation","","","2026-09-25",0],["CVE-2026-98055","Linux","Linux","ASoC: Intel: avs: Clean up the bus when fetching ML caps fails","","","2026-09-25",0],["CVE-2026-98056","Linux","Linux","nvme: remove stale namespaces by NSID range during scan","HIGH",7.5,"2026-09-25",0],["CVE-2026-98053","Linux","Linux","ASoC: Intel: avs: Refactor and fix init_config access","","","2026-09-25",0],["CVE-2026-98054","Linux","Linux","ASoC: Intel: avs: Fix unbalanced module reference count","","","2026-09-25",0],["CVE-2026-98052","Linux","Linux","net: bcmasp: clear txcb->last before writing each descriptor","HIGH",7.8,"2026-09-25",0],["CVE-2026-98050","Linux","Linux","mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context","HIGH",7.5,"2026-09-25",0],["CVE-2026-98051","Linux","Linux","net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times","","","2026-09-25",0],["CVE-2026-98049","Linux","Linux","bpf: zero extend the result of an arena 32-bit cmpxchg","","","2026-09-25",0],["CVE-2026-98047","Linux","Linux","bpf: Check ancestor frames for rbtree callbacks","","","2026-09-25",0],["CVE-2026-98048","Linux","Linux","bpf: don't rewrite bpf_fastcall patterns entered by a jump","","","2026-09-25",0],["CVE-2026-98045","Linux","Linux","bpf: Mark faultable stack helpers as sleepable","","","2026-09-25",0],["CVE-2026-98046","Linux","Linux","bpf: Mark bpf_btf_find_by_name_kind() as sleepable","","","2026-09-25",0],["CVE-2026-98044","Linux","Linux","bpf: Reject legacy packet loads from callbacks","","","2026-09-25",0],["CVE-2026-98042","Linux","Linux","bpf: Don't resurrect a scalar id dropped by collect_linked_regs()","","","2026-09-25",0],["CVE-2026-98043","Linux","Linux","bpf: Don't infer non-NULL from a pointer with an unbounded offset","","","2026-09-25",0],["CVE-2026-98040","Linux","Linux","bpf: Mark the zero register precise for a register-form NULL check","","","2026-09-25",0],["CVE-2026-98041","Linux","Linux","bpf: Don't predict JMP32 pointer vs zero comparisons","HIGH",7,"2026-09-25",0],["CVE-2026-98039","Linux","Linux","bpf: Require MEM_PERCPU for percpu kptr stores","","","2026-09-25",0],["CVE-2026-98037","Linux","Linux","bpf: Reject untrusted allocated-object pointers","","","2026-09-25",0],["CVE-2026-98038","Linux","Linux","bpf: Keep refcount_acquire nullable for borrowed RCU kptrs","","","2026-09-25",0],["CVE-2026-98036","Linux","Linux","bpf: Preserve special fields in recycled rhtab elements","","","2026-09-25",0],["CVE-2026-98034","Linux","Linux","bpf: Mark NULL kptr stores precise","","","2026-09-25",0],["CVE-2026-98035","Linux","Linux","bpf: Cancel special fields when recycling rhtab elements","","","2026-09-25",0],["CVE-2026-98032","Linux","Linux","tracing: Fix subbuf resize races with trace_pipe_raw readers","","","2026-09-25",0],["CVE-2026-98033","Linux","Linux","bpf: Preserve inner map identity in callback frames","","","2026-09-25",0],["CVE-2026-98031","Linux","Linux","nexthop: Initialize extack in remove_nh_grp_entry()","","","2026-09-25",0],["CVE-2026-98029","Linux","Linux","eth: nfp: bound the ntuple rule dump by the caller's buffer size","HIGH",7,"2026-09-25",0],["CVE-2026-98030","Linux","Linux","net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size","HIGH",7,"2026-09-25",0],["CVE-2026-98027","Linux","Linux","net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size","HIGH",7,"2026-09-25",0],["CVE-2026-98028","Linux","Linux","eth: nfp: drop the replaced rule from the list when reprogramming fails","","","2026-09-25",0],["CVE-2026-98026","Linux","Linux","net: bridge: mcast: properly convert mglist to rcu","","","2026-09-25",0],["CVE-2026-98024","Linux","Linux","s390/ism: folio_put() after error","","","2026-09-25",0],["CVE-2026-98025","Linux","Linux","net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap ","","","2026-09-25",0],["CVE-2026-98022","Linux","Linux","net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations","","","2026-09-25",0],["CVE-2026-98023","Linux","Linux","vxlan: reject dynamic fdb entries that reference a nexthop id","HIGH",7.8,"2026-09-25",0],["CVE-2026-98021","Linux","Linux","net: reject oversized tx_queue_len at netlink parse time","","","2026-09-25",0],["CVE-2026-98019","Linux","Linux","bpf: mark a NULL call argument precise","","","2026-09-25",0],["CVE-2026-98020","Linux","Linux","pds_core: fix cmd_regs access racing BAR unmap on reset","","","2026-09-25",0],["CVE-2026-98017","Linux","Linux","net/sched: defer qdisc freeing after failed creation","HIGH",7.8,"2026-09-25",0],["CVE-2026-98018","Linux","Linux","net: mctp: i3c: serialize probe with bus removal","","","2026-09-25",0],["CVE-2026-98016","Linux","Linux","net/mlx5e: Fix use-after-free race in sample_restore_put()","","","2026-09-25",0],["CVE-2026-98014","Linux","Linux","net/mlx5: E-Switch, prevent mc_list repopulation during vport disable","","","2026-09-25",0],["CVE-2026-98015","Linux","Linux","net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put","","","2026-09-25",0],["CVE-2026-98013","Linux","Linux","net/sched: fq_pie: clamp quantum in change path","","","2026-09-25",0],["CVE-2026-98011","Linux","Linux","net/sched: hhf: clamp quantum in change and init paths","","","2026-09-25",0],["CVE-2026-98012","Linux","Linux","net/sched: sfq: clamp quantum in change path","","","2026-09-25",0],["CVE-2026-98009","Linux","Linux","net/sched: ets: clamp quantum in parse and fallback paths","","","2026-09-25",0],["CVE-2026-98010","Linux","Linux","net/sched: drr: clamp quantum in change class","","","2026-09-25",0],["CVE-2026-98008","Linux","Linux","net: macb: fix NULL pointer dereference on unbind with fixed-link","","","2026-09-25",0],["CVE-2026-98006","Linux","Linux","ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev","","","2026-09-25",0],["CVE-2026-98007","Linux","Linux","bpf: Reject non-scalar bpf_loop iteration counts","","","2026-09-25",0],["CVE-2026-98004","Linux","Linux","iommu/riscv: Serialize command queue publishing","","","2026-09-25",0],["CVE-2026-98005","Linux","Linux","erofs: delimit inode_share cache key components","","","2026-09-25",0],["CVE-2026-98003","Linux","Linux","iommu/amd: Do not reallocate GA log buffers on resume","","","2026-09-25",0],["CVE-2026-98001","Linux","Linux","hwmon: (ltc4282) Make sure clk_init_data is fully initialized","","","2026-09-25",0],["CVE-2026-98002","Linux","Linux","iommu/amd: Fix ineffective error check in nested domain allocation","HIGH",7.8,"2026-09-25",0],["CVE-2026-97998","Linux","Linux","netfilter: nfnetlink_log: cope with concurrent instance destruction","","","2026-09-25",0],["CVE-2026-98000","Linux","Linux","hwmon: Fix potential UAF in pec_store","","","2026-09-25",0],["CVE-2026-97997","Linux","Linux","virtio_ring: fix stale descriptor flags after a failed packed add","","","2026-09-25",0],["CVE-2026-97995","Linux","Linux","virtio_console: do not free control-out buffers on remove","","","2026-09-25",0],["CVE-2026-97996","Linux","Linux","virtio: fix use-after-free in unregister_virtio_device()","","","2026-09-25",0],["CVE-2026-97993","Linux","Linux","vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx","","","2026-09-25",0],["CVE-2026-97994","Linux","Linux","vhost/vdpa: reject VRING_NUM larger than device max","","","2026-09-25",0],["CVE-2026-97992","Linux","Linux","vhost-vdpa: protect config_ctx from being freed under the config callback","","","2026-09-25",0],["CVE-2026-97990","Linux","Linux","vdpa_sim_net: check TX pull result before RX copy","HIGH",7.5,"2026-09-25",0],["CVE-2026-97991","Linux","Linux","vdpa_sim_blk: reject out-of-range sector starts","HIGH",7.8,"2026-09-25",0],["CVE-2026-97989","Linux","Linux","vduse: validate virtqueue alignment","","","2026-09-25",0],["CVE-2026-97987","Linux","Linux","virtio_input: reset device if input_register_device() fails","","","2026-09-25",0],["CVE-2026-97988","Linux","Linux","vhost: invalidate vring access on IOTLB transitions","","","2026-09-25",0],["CVE-2026-97985","Linux","Linux","af_unix: Update last skb marker in manage_oob().","","","2026-09-25",0],["CVE-2026-97986","Linux","Linux","virtio_input: stop callbacks before unregistering input device","","","2026-09-25",0],["CVE-2026-97984","Linux","Linux","net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","","","2026-09-25",0],["CVE-2026-97982","Linux","Linux","net: ethernet: cortina: Fix budget accounting","","","2026-09-25",0],["CVE-2026-97983","Linux","Linux","vduse: return compat ioctl results directly","","","2026-09-25",0],["CVE-2026-97980","Linux","Linux","s390/debug: Fix NULL pointer dereference in debug_set_level()","","","2026-09-25",0],["CVE-2026-97981","Linux","Linux","net: ethernet: cortina: Count dropped frames as NAPI work","","","2026-09-25",0],["CVE-2026-97979","Linux","Linux","ice: add missing xa_destroy for sched_node_ids","","","2026-09-25",0],["CVE-2026-97977","Linux","Linux","Bluetooth: btusb: Fix UAF of btusb_data by rx_work","","","2026-09-25",0],["CVE-2026-97978","Linux","Linux","eth: ice: don't dereference pointers from TP_printk()","","","2026-09-25",0],["CVE-2026-97976","Linux","Linux","Bluetooth: btintel_pcie: validate packet_len before skb_put_data","","","2026-09-25",0],["CVE-2026-97974","Linux","Linux","ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()","","","2026-09-25",0],["CVE-2026-97975","Linux","Linux","Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","","","2026-09-25",0],["CVE-2026-97972","Linux","Linux","net: macb: put the \"mdio\" child node reference on success","","","2026-09-25",0],["CVE-2026-97973","Linux","Linux","net: macb: destroy the phylink instance on the probe error path","","","2026-09-25",0],["CVE-2026-97971","Linux","Linux","nstree: check listing permission before taking a namespace reference","HIGH",7.8,"2026-09-25",0],["CVE-2026-97969","Linux","Linux","watchdog: msc313e: Fix clock leak and spurious timer in settimeout()","","","2026-09-25",0],["CVE-2026-97970","Linux","Linux","watchdog: msc313e: Avoid division by zero","","","2026-09-25",0],["CVE-2026-97967","Linux","Linux","hwmon: (corsair-cpro) Remove debugfs entries when probe fails","","","2026-09-25",0],["CVE-2026-97968","Linux","Linux","hwmon: (corsair-cpro) Create debugfs entries after hwmon registration","","","2026-09-25",0],["CVE-2026-97966","Linux","Linux","octeontx2-pf: reset HTB scheduler topology before freeing queues","","","2026-09-25",0],["CVE-2026-97964","Linux","Linux","ppp_synctty: ensure a writeable skb header","","","2026-09-25",0],["CVE-2026-97965","Linux","Linux","vxlan: initialize _md in vxlan_xmit_one()","","","2026-09-25",0],["CVE-2026-97962","Linux","Linux","net/mlx5e: Move representor vnic reporter to eswitch devlink port","","","2026-09-25",0],["CVE-2026-97963","Linux","Linux","net: stmmac: initialize ptp_lock at probe time","","","2026-09-25",0],["CVE-2026-97961","Linux","Linux","perf/core: Allow list_del during perf_event_overflow()","","","2026-09-25",0],["CVE-2026-97959","Linux","Linux","net/sched: cls_route: free emptied bucket on filter move","","","2026-09-25",0],["CVE-2026-97960","Linux","Linux","perf/x86/intel: Prevent drain_pebs() reentry","","","2026-09-25",0],["CVE-2026-97957","Linux","Linux","net: hinic: fix mailbox segment buffer overflow","HIGH",8.8,"2026-09-25",0],["CVE-2026-97958","Linux","Linux","net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().","","","2026-09-25",0],["CVE-2026-97956","Linux","Linux","net: net_failover: Fix the deadlock in net_failover_slave_name_change()","","","2026-09-25",0],["CVE-2026-97954","Linux","Linux","net/rds: fix tcp stream corruption with large pages","","","2026-09-25",0],["CVE-2026-97955","Linux","Linux","net: mana: restore the XDP program pointer when pre-allocation fails","","","2026-09-25",0],["CVE-2026-97952","Linux","Linux","sunvdc: unmap LDC cookies when the descriptor send fails","","","2026-09-25",0],["CVE-2026-97953","Linux","Linux","net: stmmac: fix TX descriptor availability check for TSO traffic","HIGH",7,"2026-09-25",0],["CVE-2026-97951","Linux","Linux","scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands","","","2026-09-25",0],["CVE-2026-97949","Linux","Linux","configfs: unhash the dentry before dropping the item in rmdir","","","2026-09-25",0],["CVE-2026-97950","Linux","Linux","configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","","","2026-09-25",0],["CVE-2026-97947","Linux","Linux","x86/amd_node: Fix potential NULL pointer dereference","","","2026-09-25",0],["CVE-2026-97948","Linux","Linux","powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver","","","2026-09-25",0],["CVE-2026-97946","Linux","Linux","x86/amd_node: Fix PCI device reference counting in amd_smn_init()","","","2026-09-25",0],["CVE-2026-97944","Linux","Linux","x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()","","","2026-09-25",0],["CVE-2026-97945","Linux","Linux","x86/mm: Fix user-space data loss with MADV_FREE and THP","","","2026-09-25",0],["CVE-2026-97942","Linux","Linux","x86/alternatives: Exclude text poking against change_page_attr()","","","2026-09-25",0],["CVE-2026-97943","Linux","Linux","x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF","","","2026-09-25",0],["CVE-2026-97941","Linux","Linux","mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race","HIGH",7.8,"2026-09-25",0],["CVE-2026-97939","Linux","Linux","ipmr: account multicast table and route memory","","","2026-09-25",0],["CVE-2026-97940","Linux","Linux","ipv6: fix fib6 walker UAF on seq stop","HIGH",7.8,"2026-09-25",0],["CVE-2026-97937","Linux","Linux","ftrace: fork: Initialize function graph state before copy_exec_state()","HIGH",7.8,"2026-09-25",0],["CVE-2026-97938","Linux","Linux","reboot: fix cad_pid use-after-free race","","","2026-09-25",0],["CVE-2026-97936","Linux","Linux","tracing: Fix memory corruption from the histogram stacktrace modifier","","","2026-09-25",0],["CVE-2026-97934","Linux","Linux","tracing: Fix memory corruption from a \"STACKTRACE\" histogram key","","","2026-09-25",0],["CVE-2026-97935","Linux","Linux","tracing: Set the trace clock before registering the histogram trigger","","","2026-09-25",0],["CVE-2026-97933","Linux","Linux","tracing: Take trace_array reference when opening a tracer options file","","","2026-09-25",0],["CVE-2026-97931","Linux","Linux","ALSA: us122l: Prevent write upgrades for read mappings","HIGH",7,"2026-09-25",0],["CVE-2026-97932","Linux","Linux","tracing: Don't dereference trace_event_file in deferred trigger free","","","2026-09-25",0],["CVE-2026-97929","Linux","Linux","ALSA: usbusx2y: validate URB actual_length in interrupt callback","","","2026-09-25",0],["CVE-2026-97930","Linux","Linux","ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf","","","2026-09-25",0],["CVE-2026-97928","Linux","Linux","drm/amdgpu: skip the VMID 0 flush for VRAM","","","2026-09-25",0],["CVE-2026-97926","Linux","Linux","ufs: validate cylinder group metadata before caching it","HIGH",7,"2026-09-25",0],["CVE-2026-97927","Linux","Linux","ufs: create the root dentry after loading cylinder metadata","","","2026-09-25",0],["CVE-2026-97925","Linux","Linux","tick/broadcast: Plug clockevents replacement race","","","2026-09-25",0],["CVE-2026-97923","Linux","Linux","tracing: Free histogram the var ref when its initialization fails","","","2026-09-25",0],["CVE-2026-97924","Linux","Linux","tracing/user_events: Don't destroy fields when event removal fails","","","2026-09-25",0],["CVE-2026-97921","Linux","Linux","tracing: Free histogram the field rejected for a bad modifier","","","2026-09-25",0],["CVE-2026-97922","Linux","Linux","tracing: Free histogram var refs regardless of how often they are referenced","","","2026-09-25",0],["CVE-2026-97920","Linux","Linux","tracing: Keep the entry count when the histogram stats allocation fails","","","2026-09-25",0],["CVE-2026-97918","Linux","Linux","tracing: Undo the registration when enabling the histogram trigger fails","","","2026-09-25",0],["CVE-2026-97919","Linux","Linux","tracing: Take the reference before publishing the named histogram trigger","","","2026-09-25",0],["CVE-2026-97917","Linux","Linux","accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr","","","2026-09-25",0],["CVE-2026-97915","Linux","Linux","accel/ivpu: Limit firmware log name prints to field size","","","2026-09-25",0],["CVE-2026-97916","Linux","Linux","accel/ivpu: Validate firmware log buffer metadata","","","2026-09-25",0],["CVE-2026-97914","Linux","Linux","accel: ethosu: Fix ethosu_job_open() return value","","","2026-09-25",0],["CVE-2026-97912","Linux","Linux","accel: ethosu: Ensure SRAM size is 0 on mapping failure","","","2026-09-25",0],["CVE-2026-97913","Linux","Linux","accel: ethosu: Ensure cmd stream ends with a stop op","","","2026-09-25",0],["CVE-2026-97910","Linux","Linux","ASoC: sprd: validate compress buffer sizes against fixed allocations","HIGH",7.8,"2026-09-25",0],["CVE-2026-97911","Linux","Linux","accel: ethosu: Ensure SRAM region size matches job","HIGH",7.8,"2026-09-25",0],["CVE-2026-97909","Linux","Linux","ASoC: sti: initialize IRQ lock before requesting IRQ","","","2026-09-25",0],["CVE-2026-97907","Linux","Linux","Bluetooth: btrtl: Don't leak return code when parsing firmware format v2","","","2026-09-25",0],["CVE-2026-97908","Linux","Linux","Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev","","","2026-09-25",0],["CVE-2026-97905","Linux","Linux","cpufreq: zero-initialize policy cpumask before sysfs publication","","","2026-09-25",0],["CVE-2026-97906","Linux","Linux","bootconfig: Fix integer overflow in initrd size check","","","2026-09-25",0],["CVE-2026-97904","Linux","Linux","cpufreq: initialize policy rwsem before sysfs publication","","","2026-09-25",0],["CVE-2026-97902","Linux","Linux","fs: don't return -EINVAL for successful nested thaw","","","2026-09-25",0],["CVE-2026-97903","Linux","Linux","exit: hold a reference to thread_pid across proc_flush_pid","HIGH",7.8,"2026-09-25",0],["CVE-2026-97900","Linux","Linux","drm/drm_exec: fix up contended obj when num_objects is 0","","","2026-09-25",0],["CVE-2026-97901","Linux","Linux","genetlink: pin family module during policy dump","","","2026-09-25",0],["CVE-2026-97899","Linux","Linux","drm/i915: Fix memory leak in query_perf_config_list()","","","2026-09-25",0],["CVE-2026-97620","Linux","Linux","drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches","","","2026-09-25",0],["CVE-2026-97621","Linux","Linux","drm/rockchip: analogix_dp: fix unchecked bound endpoint name length","","","2026-09-25",0],["CVE-2026-97618","Linux","Linux","io_uring/net: don't overconsume buffers when using MSG_TRUNC","","","2026-09-25",0],["CVE-2026-97619","Linux","Linux","io_uring/rw: end write accounting from ->ki_complete","","","2026-09-25",0],["CVE-2026-97617","Linux","Linux","ring-buffer: Check resize_disabled before publishing the new subbuf order","","","2026-09-25",0],["CVE-2026-97615","Linux","Linux","net: bridge: use option bits for CFM/MRP frame handlers","","","2026-09-25",0],["CVE-2026-97616","Linux","Linux","net/sched: act_api: release all action references on NEWACTION failure","","","2026-09-25",0],["CVE-2026-97613","Linux","Linux","net: mana: Reserve extra CQ slot for the fence completion CQE","","","2026-09-25",0],["CVE-2026-97614","Linux","Linux","net: dsa: tag_brcm: legacy FCS: request needed tailroom","","","2026-09-25",0],["CVE-2026-97612","Linux","Linux","net: mpls: clear inner_protocol when the last label is popped","HIGH",7.8,"2026-09-25",0],["CVE-2026-97610","Linux","Linux","netfs: Fix uninitialized return value in netfs_unbuffered_write()","","","2026-09-25",0],["CVE-2026-97611","Linux","Linux","net: openvswitch: fix use-after-free of the flow table mask array","HIGH",7.8,"2026-09-25",0],["CVE-2026-97608","Linux","Linux","netfilter: nf_log: unregister loggers before per-net teardown","HIGH",7,"2026-09-25",0],["CVE-2026-97609","Linux","Linux","netfilter: cttimeout: prevent UAF during module unload","HIGH",7,"2026-09-25",0],["CVE-2026-97607","Linux","Linux","vdpa: ifcvf: Put device on unsupported feature error","","","2026-09-25",0],["CVE-2026-97605","Linux","Linux","erofs: preserve LZMA decoders on resize failure","","","2026-09-25",0],["CVE-2026-97606","Linux","Linux","fs: autofs: fix memory leak in autofs_fill_super()","","","2026-09-25",0],["CVE-2026-97603","Linux","Linux","idpf: disable DIM work before freeing q_vectors","","","2026-09-25",0],["CVE-2026-97604","Linux","Linux","fbdev: vfb: defer cleanup until the last reference","","","2026-09-25",0],["CVE-2026-97602","Linux","Linux","inet: frags: invalidate queues before flushing them","HIGH",7.8,"2026-09-25",0],["CVE-2026-97600","Linux","Linux","ieee802154: cc2520: fix FIFOP work use-after-free","","","2026-09-25",0],["CVE-2026-97601","Linux","Linux","ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink","","","2026-09-25",0],["CVE-2026-97599","Linux","Linux","ieee802154: hwsim: serialize pib updates to fix double-free","","","2026-09-25",0],["CVE-2026-97597","Linux","Linux","ipv6: flowlabel: cap duplicate leases per socket","","","2026-09-25",0],["CVE-2026-97598","Linux","Linux","ipv4: fib: bound automatic table ID allocation","","","2026-09-25",0],["CVE-2026-97595","Linux","Linux","mac802154: fix use-after-free of sdata via queued RX frames","HIGH",7.5,"2026-09-25",0],["CVE-2026-97596","Linux","Linux","ipvs: reject invalid states in connection template sync records","","","2026-09-25",0],["CVE-2026-97594","Linux","Linux","landlock: Fix use-after-free of the source's parent directory","HIGH",7.8,"2026-09-25",0],["CVE-2026-97592","Linux","Linux","s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm","","","2026-09-25",0],["CVE-2026-97593","Linux","Linux","iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX","","","2026-09-25",0],["CVE-2026-97590","Linux","Linux","s390/crypto: Fix missing scrub of temp buffers with PAES algorithm","","","2026-09-25",0],["CVE-2026-97591","Linux","Linux","s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine","","","2026-09-25",0],["CVE-2026-97589","Linux","Linux","s390/crypto: Fix wrong return code to engine in asynch callbacks","HIGH",7,"2026-09-25",0],["CVE-2026-97587","Linux","Linux","perf: RISC-V: store available counter mask as bitmap","","","2026-09-25",0],["CVE-2026-97588","Linux","Linux","s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly","","","2026-09-25",0],["CVE-2026-97586","Linux","Linux","afs: Fix missing kunmap in afs_dir_search_bucket()","","","2026-09-25",0],["CVE-2026-97584","Linux","Linux","afs: Fix incorrect free in candidate cleanup in afs_lookup_server()","HIGH",7.8,"2026-09-25",0],["CVE-2026-97585","Linux","Linux","afs: Fix double-unmap of directory block","","","2026-09-25",0],["CVE-2026-97582","Linux","Linux","hwmon: (gpio-fan) Fix use-after-free in alarm work","","","2026-09-25",0],["CVE-2026-97583","Linux","Linux","afs: Clear stale peer app data after address list changes","HIGH",7.5,"2026-09-25",0],["CVE-2026-97581","Linux","Linux","media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity","","","2026-09-25",0],["CVE-2026-97579","Linux","Linux","media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity","HIGH",7.8,"2026-09-25",0],["CVE-2026-97580","Linux","Linux","media: rkvdec: bound HEVC tile loops and PPS id to the array capacity","HIGH",7.8,"2026-09-25",0],["CVE-2026-97578","Linux","Linux","media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer","HIGH",7.8,"2026-09-25",0],["CVE-2026-97576","Linux","Linux","media: v4l2-ctrls: validate HEVC tile counts","HIGH",7.8,"2026-09-25",0],["CVE-2026-97577","Linux","Linux","media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity","HIGH",7.8,"2026-09-25",0],["CVE-2026-97574","Linux","Linux","bnxt_en: Don't free the live ring's TPA state on queue restart failure","","","2026-09-25",0],["CVE-2026-97575","Linux","Linux","media: v4l2-ctrls: validate AV1 tile counts","HIGH",7.8,"2026-09-25",0],["CVE-2026-97573","Linux","Linux","bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()","HIGH",8.1,"2026-09-25",0],["CVE-2026-97571","Linux","Linux","bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()","","","2026-09-25",0],["CVE-2026-97572","Linux","Linux","bnxt_en: Propagate RX ring init failures in bnxt_init_nic()","","","2026-09-25",0],["CVE-2026-97570","Linux","Linux","bnxt_en: Bound SW TPA IDs to prevent crashes","HIGH",8.1,"2026-09-25",0],["CVE-2026-97568","Linux","Linux","mptcp: syncookies: remember the request backup flag","","","2026-09-25",0],["CVE-2026-97569","Linux","Linux","bnxt_en: Prevent queue stop with deferred completions","","","2026-09-25",0],["CVE-2026-97566","Linux","Linux","mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","","","2026-09-25",0],["CVE-2026-97567","Linux","Linux","mptcp: prevent race between disconnect() and rtx","","","2026-09-25",0],["CVE-2026-97565","Linux","Linux","smb: client: reject short READ responses in CIFSSMBRead()","","","2026-09-25",0],["CVE-2026-97563","Linux","Linux","smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","","","2026-09-25",0],["CVE-2026-97564","Linux","Linux","smb: client: reject userspace cifs.idmap descriptions","","","2026-09-25",0],["CVE-2026-97561","Linux","Linux","smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid","","","2026-09-25",0],["CVE-2026-97562","Linux","Linux","smb: client: pin DFS superblock in iterator callback","HIGH",7.5,"2026-09-25",0],["CVE-2026-97560","Linux","Linux","smb: client: fix one-byte OOB read in smb2_parse_native_symlink()","","","2026-09-25",0],["CVE-2026-97558","Linux","Linux","smb: client: fix cifsFileInfo reference leak in deferred close","","","2026-09-25",0],["CVE-2026-97559","Linux","Linux","smb: client: fail DACL rewrite when the new DACL exceeds 64K","","","2026-09-25",0],["CVE-2026-97556","Linux","Linux","smb: client: avoid leaking refcount when cifs_sb_tlink() fails","","","2026-09-25",0],["CVE-2026-97557","Linux","Linux","smb: client: avoid leaking refcount in cifs_queue_oplock_break()","HIGH",7.5,"2026-09-25",0],["CVE-2026-97555","Linux","Linux","smb: client: fix heap overflow in DACL owner/group rewrite","HIGH",8.8,"2026-09-25",0],["CVE-2026-97553","Linux","Linux","xfs: lock the healthmon when inserting unmount event","","","2026-09-25",0],["CVE-2026-97554","Linux","Linux","smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()","","","2026-09-25",0],["CVE-2026-97551","Linux","Linux","xfs: initialise args->total for parent pointer updates","","","2026-09-25",0],["CVE-2026-97552","Linux","Linux","xfs: initialise error in xfs_defer_finish_one()","","","2026-09-25",0],["CVE-2026-97550","Linux","Linux","xfs: fix unit conversions in per_binval computation","","","2026-09-25",0],["CVE-2026-97548","Linux","Linux","xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions","HIGH",7.8,"2026-09-25",0],["CVE-2026-97549","Linux","Linux","xfs: fix under-reservation of blocks when repairing sf directories","","","2026-09-25",0],["CVE-2026-97546","Linux","Linux","xfs: don't spin forever on zero-length dirents when salvaging them","","","2026-09-25",0],["CVE-2026-97547","Linux","Linux","xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN","","","2026-09-25",0],["CVE-2026-97545","Linux","Linux","xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails","","","2026-09-25",0],["CVE-2026-97543","Linux","Linux","xfs: destroy seen inode bitmap when we fail to add a dirpath","","","2026-09-25",0],["CVE-2026-97544","Linux","Linux","xfs: don't leak dqacct if rhashtable insertion fails","","","2026-09-25",0],["CVE-2026-97541","Linux","Linux","wifi: ath9k_htc: don't store usb_device_id","","","2026-09-25",0],["CVE-2026-97542","Linux","Linux","xfs: bail out on bitmap errors in xrep_agfl_fill","","","2026-09-25",0],["CVE-2026-97540","Linux","Linux","net: usb: pegasus: don't rely on id table pointer arithmetic","","","2026-09-25",0],["CVE-2026-97538","Linux","Linux","hwmon: (asus_rog_ryujin) Validate HID report lengths","","","2026-09-25",0],["CVE-2026-97539","Linux","Linux","usb: xusbatm: don't rely on id table pointer arithmetic","","","2026-09-25",0],["CVE-2026-97537","Linux","Linux","scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking","","","2026-09-25",0],["CVE-2026-97535","Linux","Linux","scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size","","","2026-09-25",0],["CVE-2026-97536","Linux","Linux","scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown","HIGH",7.5,"2026-09-25",0],["CVE-2026-97533","Linux","Linux","x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF","","","2026-09-25",0],["CVE-2026-97534","Linux","Linux","f2fs: accurately adjust free_sections during free_segment_range","","","2026-09-25",0],["CVE-2026-97532","Linux","Linux","scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path","","","2026-09-25",0],["CVE-2026-97530","Linux","Linux","scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature","","","2026-09-25",0],["CVE-2026-97531","Linux","Linux","scsi: qla2xxx: Skip vport under deletion in report ID acquisition","HIGH",7.5,"2026-09-25",0],["CVE-2026-97528","Linux","Linux","scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error","HIGH",8.8,"2026-09-25",0],["CVE-2026-97529","Linux","Linux","scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]","","","2026-09-25",0],["CVE-2026-97527","Linux","Linux","scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock","HIGH",8.8,"2026-09-25",0],["CVE-2026-97525","Linux","Linux","x86/mm/pat: Allocate split page tables as kernel page tables","HIGH",8.2,"2026-09-25",0],["CVE-2026-97526","Linux","Linux","s390/pai: Support CPU hotplug for PMU PAI","","","2026-09-25",0],["CVE-2026-97523","Linux","Linux","mptcp: close race between scheduler and state change","HIGH",7.5,"2026-09-25",0],["CVE-2026-97524","Linux","Linux","mptcp: avoid unneeded actions on subflow reset","HIGH",7.5,"2026-09-25",0],["CVE-2026-97522","Linux","Linux","mptcp: fix bad accounting in __mptcp_subflow_push_pending()","","","2026-09-25",0],["CVE-2026-97898","akia","akia","Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms","HIGH",8.4,"2026-09-25",0],["CVE-2026-92106","dashbitco","lazy_html","lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS","LOW",2.3,"2026-09-25",0],["CVE-2026-88848","","MasterStudy LMS","MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restrictio","MEDIUM",4.2,"2026-09-25",0],["CVE-2026-80514","","wpForo Forum","wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-6088","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-6087","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-6086","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-6085","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-86837","","Bookly","Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-6084","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-6083","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-6082","Novadigits technologies","StockAgile","Stored Cross-Site Scripting in StockAgile by Novadigits technologies","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-92550","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authen","HIGH",7.5,"2026-09-25",0],["CVE-2026-92560","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authen","HIGH",7.5,"2026-09-25",0],["CVE-2026-92573","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-97863","misp","misp-modules","misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Modu","MEDIUM",6.3,"2026-09-25",0],["CVE-2026-92564","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication","HIGH",7.5,"2026-09-25",0],["CVE-2026-92608","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10","HIGH",7.5,"2026-09-25",0],["CVE-2026-92609","Apache Software Foundation","Apache Qpid Broker-J","Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication","CRITICAL",9.8,"2026-09-25",0],["CVE-2026-95864","themifyme","Themify Builder","Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Pa","HIGH",7.2,"2026-09-25",0],["CVE-2026-19804","clavaque","s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in P","HIGH",8.8,"2026-09-25",0],["CVE-2026-89426","knitpay","Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more","Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms R","HIGH",8.8,"2026-09-25",0],["CVE-2026-94573","addonsorg","Repeater Fields for Elementor Forms","Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting","HIGH",7.2,"2026-09-25",0],["CVE-2026-12037","gabelivan","Asset CleanUp: Page Speed Booster","Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side ","MEDIUM",5.5,"2026-09-25",0],["CVE-2026-84280","radykal","Fancy Product Designer","Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcod","HIGH",7.2,"2026-09-25",0],["CVE-2026-13179","flippercode","WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_valu","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-89406","wpchill","Modula Image Gallery – Photo Grid & Video Gallery","Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery I","HIGH",7.5,"2026-09-25",0],["CVE-2026-93901","ihomefinder","Optima Express IDX","Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJ","HIGH",7.3,"2026-09-25",0],["CVE-2026-17602","sslzen","SSL Zen — SSL Certificate Installer & HTTPS Redirects","SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read v","MEDIUM",4.9,"2026-09-25",0],["CVE-2026-95866","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Fie","HIGH",7.2,"2026-09-25",0],["CVE-2026-96568","jetmonsters","Restaurant Menu and Food Ordering","Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting ","HIGH",7.2,"2026-09-25",0],["CVE-2026-13456","flippercode","WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter","HIGH",7.5,"2026-09-25",0],["CVE-2026-93656","cozmoslabs","User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vi","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-17577","sslzen","SSL Zen — SSL Certificate Installer & HTTPS Redirects","SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-92713","wpchill","Modula Image Gallery – Photo Grid & Video Gallery","Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary","HIGH",8.1,"2026-09-25",0],["CVE-2026-93654","codename065","Premium Packages – Sell Digital Products Securely","Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][","HIGH",7.2,"2026-09-25",0],["CVE-2026-88996","smub","WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More","WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-93747","tomdever","wpForo Forum","wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'teleg","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-96752","bmarshall511","Zero Spam for WordPress","Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested","HIGH",7.2,"2026-09-25",0],["CVE-2026-96448","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privileg","MEDIUM",6.6,"2026-09-25",0],["CVE-2026-93477","ash-project","ash","Private action arguments can be set by user input on the bulk destroy and bulk update path","MEDIUM",5.9,"2026-09-25",0],["CVE-2026-14281","101gen","Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code","Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_f","CRITICAL",9.8,"2026-09-25",0],["CVE-2026-92746","jegstudio","Gutenverse – WordPress Blocks, Page Builder & Site Editor","Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Co","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-94376","wordplus","Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripti","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-93303","htplugins","HT Contact Form – Drag & Drop Form Builder for WordPress","HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'for","HIGH",7.2,"2026-09-25",0],["CVE-2026-96039","bookingalgorithms","BA Book Everything","BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name ","HIGH",7.2,"2026-09-25",0],["CVE-2026-92799","ladela","Online Scheduling and Appointment Booking System – Bookly","Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization B","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-92829","pr-gateway","Blog2Social: Social Media Auto Post & Scheduler","Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authen","MEDIUM",4.3,"2026-09-25",0],["CVE-2026-93399","ladela","Online Scheduling and Appointment Booking System – Bookly","Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Referenc","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-19775","allterraindeveloper","OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin","OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Info","MEDIUM",4.3,"2026-09-25",0],["CVE-2026-89055","ivole","Customer Reviews for WooCommerce","Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arb","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-96766","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bus","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-84279","radykal","Fancy Product Designer","Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_","HIGH",7.2,"2026-09-25",0],["CVE-2026-93899","wordplus","Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Messag","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-83591","mohammed_kaludi","AMP for WP – Accelerated Mobile Pages","AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Reg","HIGH",7.2,"2026-09-25",0],["CVE-2026-84281","radykal","Fancy Product Designer","Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'product","HIGH",7.2,"2026-09-25",0],["CVE-2026-92212","jetmonsters","JetFormBuilder — Dynamic Blocks Form Builder","JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variab","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-93897","paoltaia","GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-62062","Elementor","Elementor Website Builder","WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vu","HIGH",8.8,"2026-09-25",0],["CVE-2026-75553","Tohoku Electric Power Company, Incorporated","Tohoku Electric Power \"Yorisou e Net\" Android App","Smartphone application Tohoku Electric Power \"Yorisou e Net\" uses a hard-coded cryptograph","LOW",2.4,"2026-09-25",0],["CVE-2026-97846","Red Hat","Red Hat Build of Keycloak","Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-k","MEDIUM",6.8,"2026-09-25",0],["CVE-2026-78393","","Link Library","Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb ","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-78394","","Link Library","Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter","MEDIUM",4.1,"2026-09-25",0],["CVE-2026-78397","","Link Library","Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation","MEDIUM",4,"2026-09-25",0],["CVE-2026-97721","Sanluan","PublicCMS","Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminContro","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-97818","phpipam","phpIPAM","phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/co","HIGH",8.6,"2026-09-25",0],["CVE-2026-97764","allauth","django-allauth","django-allauth before 65.19.4 does not have the expected limits on failed login attempts b","LOW",3.7,"2026-09-25",0],["CVE-2026-97737","muety","Wakapi","In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an uni","HIGH",7.4,"2026-09-25",0],["CVE-2026-97736","tinyauth","tinyauth","tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is cau","MEDIUM",5.4,"2026-09-25",0],["CVE-2026-97735","ITFlow","ITFlow","ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_p","HIGH",8,"2026-09-25",0],["CVE-2025-14814","wipeoutmedia","CSS & JavaScript Toolbox","CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Script","MEDIUM",6.4,"2026-09-25",0],["CVE-2026-97732","IRONMACE","Ironshield","IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client e","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-97731","MinIO","MinIO","MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also ","HIGH",7.1,"2026-09-25",0],["CVE-2026-97730","Netgate","pfSense Plus","In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (","HIGH",8.5,"2026-09-25",0],["CVE-2026-97650","ningzichun","student-management-system","ningzichun student-management-system addLog.php echo cross site scripting","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-97724","swmansion","React Native Reanimated","A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-97723","madpsy","ka9q_ubersdr","madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in","MEDIUM",5.4,"2026-09-25",0],["CVE-2026-97649","ningzichun","student-management-system","ningzichun student-management-system example_lite.sql default credentials","MEDIUM",5.1,"2026-09-25",0],["CVE-2026-95811","","Lemonldap-NG-Handler","Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-97648","ningzichun","student-management-system","ningzichun student-management-system cross-site request forgery","MEDIUM",5.3,"2026-09-25",0],["CVE-2026-97647","ningzichun","student-management-system","ningzichun student-management-system editLog.php authorization","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-92289","","Lemonldap-NG-Portal","Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for ","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-97646","ningzichun","student-management-system","ningzichun student-management-system getStudent.php authorization","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-92288","","Lemonldap-NG-Portal","Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Pe","CRITICAL",9.1,"2026-09-25",0],["CVE-2026-53493","containerd","containerd","Containerd has image-pull DoS via crafted OCI index graph amplification","MEDIUM",6.9,"2026-09-25",0],["CVE-2026-85417","Brocade","SANnav","Incomplete property masking in the SANnav logging subsystem","MEDIUM",6.4,"2026-09-25",0],["CVE-2025-51457","","","D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerabilit","HIGH",8.8,"2026-09-25",0],["CVE-2026-51772","","","A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenSta","MEDIUM",6.5,"2026-09-25",0],["CVE-2026-51773","","","An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated a","HIGH",8.1,"2026-09-25",0],["CVE-2026-52622","","","An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, W","HIGH",7.5,"2026-09-25",0],["CVE-2026-78902","","","Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker t","MEDIUM",6.1,"2026-09-25",0],["CVE-2026-79153","","","Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnera","HIGH",7.8,"2026-09-25",0],["CVE-2026-88389","","","Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGet","MEDIUM",6.2,"2026-09-25",0],["CVE-2026-88420","","","A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component","MEDIUM",5.4,"2026-09-25",0],["CVE-2026-88421","","","Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 thro","HIGH",7.5,"2026-09-25",0]]