# OSINT Threat Intelligence Report

**Date:** 2026-10-20 | **Generated:** 2026-10-20T03:01:48.951Z | **Items:** 326 | **Range:** daily

## Sources
| Source | Count |
|--------|-------|
| cisa-kev | 7 |
| nvd | 4259 |
| otx | 29 |
| cisa-advisories | 14 |
| vendor-blogs | 627 |
| malware-bazaar | 20 |
| abuse-ipdb | 20 |
| threatfox | 3 |
| general-news | 110 |

## Top 10 Highlights
| Severity | Title | Source | CVEs | Tags |
|----------|-------|--------|------|------|
| critical | CVE-2026-109432 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerabili… | nvd | CVE-2026-109432 |  |
| critical | CVE-2026-111057 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From… | nvd | CVE-2026-111057, CVE-2026-111059 |  |
| critical | CVE-2026-111058 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prio… | nvd | CVE-2026-111058 |  |
| critical | CVE-2026-107083 — SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injectio… | nvd | CVE-2026-107083 |  |
| critical | CVE-2026-107188 — A user can upload export reports with any file contents and specify any contents. JSP code can be up… | nvd | CVE-2026-107188 |  |
| critical | CVE-2026-111862 — Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.… | nvd | CVE-2026-111862 | supply-chain |
| critical | CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defau… | nvd | CVE-2026-109437 | rce |
| critical | CVE-2026-112776 — Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-s… | nvd | CVE-2026-112776 |  |
| critical | CVE-2026-112779 — Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for ever… | nvd | CVE-2026-112779 |  |
| critical | CVE-2026-112370 — A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of t… | nvd | CVE-2026-112370 |  |

## All Items
| Severity | Title | Category | Source | Tags | Published |
|----------|-------|----------|--------|------|-----------|
| critical | CVE-2026-109432 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerabili… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-111057 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-111058 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prio… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-107083 — SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injectio… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-107188 — A user can upload export reports with any file contents and specify any contents. JSP code can be up… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-111862 — Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.… | vulnerability | nvd | supply-chain | 2026-10-19 |
| critical | CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defau… | vulnerability | nvd | rce | 2026-10-19 |
| critical | CVE-2026-112776 — Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-s… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-112779 — Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for ever… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-112370 — A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of t… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-112371 — A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the… | vulnerability | nvd |  | 2026-10-19 |
| critical | CVE-2026-109395 — Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc… | vulnerability | nvd |  | 2026-10-20 |
| critical | CVE-2026-109442 — piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat age… | vulnerability | nvd | rce | 2026-10-20 |
| critical | CVE-2026-75128 — Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any register… | vulnerability | nvd |  | 2026-10-20 |
| critical | CVE-2026-77932 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /ap… | vulnerability | nvd | rce | 2026-10-20 |
| critical | CVE-2026-77933 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.ym… | vulnerability | nvd |  | 2026-10-20 |
| critical | CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password… | vulnerability | nvd |  | 2026-10-20 |
| critical | Malicious IP: 151.243.11.150 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 135.119.91.34 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 57.131.50.86 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 109.160.32.123 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 185.223.235.46 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 13.140.80.140 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 14.51.12.142 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 43.135.144.81 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 106.13.95.198 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 103.216.145.2 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 45.115.26.61 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 115.178.75.242 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 43.172.117.23 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 172.209.208.96 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 210.91.153.182 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 186.122.177.140 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 172.212.203.117 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 122.170.99.195 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 2.57.217.229 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | Malicious IP: 77.239.124.77 | ip-reputation | abuse-ipdb |  | 2026-10-20 |
| critical | botnet_cc: undefined | threat-intel | threatfox | Vidar, AISURU, c2, Vshell, c7a50169dbc6d842a7e7d349513f88f1, Loader, stealer, ec141392be2e474ab700bf353b3b9f2c, njrat, remcos, REMOTEHOST, ac32fe0cdedaab512d4ba45a7cfcc26b, honeypot, f7e0bdc53604a00d861131d2693a943c, sliver c2, QuasarRAT, drb-ra, Mythic, Havoc, sliver, PureHVNC, PureRAT, RAT, CobaltStrike, JUNIO777, SERVER2405v2, GP, 332ps1Ago, Star-Baby-27, RatonRAT, RemcosRAT, ValleyRAT, valleyrat_s2, trum, 1718e0679220166cf123fbe6e40c635c, d85b02740b9fbbe0bc098debbc5a5109, moobot, Supershell, shodan, abe-bypass, ClickFix, com-hijacking, DesktopStreamClient, hermes, hermes-stealer, Hvnc, infostealer, loader-c2, Lold, MaaS, SyncService, exfil, FakeGit, LuaJIT, SmartLoader, Mirai, Remus, 373d420e3c3e68da3a553422caafc283, 1ca8afc0e9497e2ea687b455ff40cf1e, Adaptix, AdaptixC2, asyncrat, DinDoor, EvilGinx, EvilGoPhish, TRT UR BEST, XWorm, censys, exe, RevStealer, Android, GhostBat, mParivahan, veltrix, CantoIncognito, cryptomining, PoeLLM, Sektor7, elf, apix, fake-git, powershell, IRC, k4_irc_bot, onlycn, ROOTKIT, minefox, shellcode, stage2, fake-crack, Github, stager, IoT, Mozi, Romulus, ViriBack, 6713982832fdd0efe07912b12c5c5b2b, c1399bfb1be0a51415613edd6f0068c5, 5a4378fb90db39f09c7b18d1f314e645, 945c9f3c8cddcb7f33efce50a9a949ad, modat, murdoc, Covenant, Antidot, dcrat, b9df72d092aeb25d8cb28d34cc4984de, guloader, NSIS, XtremeRAT, NanoCore, Arechclient2, SectopRAT, default-cert, mtls, tofsee, Port$$, codec-cache, cve-2026-96656, miner, plex, Huatai007, CHAOS, Viper, cs-watermark-666666666, cs-watermark-987654321, Gafgyt, CheatSheet, dead-drop, gitlab, pastebin, DPRK, etherhiding, polinrider, backdoor, bot, Sh, dump-yuv, PM-5766, ErrTraffic, Polygon, 521048dd5a8917782e586ac60bc1eceb, WinWordl, botnet, CECbot, DDoS, host, go, legea, 369b7d35486e31c3854c6efc823ab439, sliverc2, d42249d8b3409d0cd65c3cc7f8267ec0, dotNET, fake-cheat, Qt5Widgets, sideloading, TeamSpeak, NUEVAS4001, airashi, Jackskid, rctea, MicroUpdate, apk, GoPhish, BruteRatel, adf0aff417ab94ddd17c189420efb165, ab0a59f4970a96fd6e8daa4f6f8e22cd, b89d843f29af2eed09805e9767a1165f, 379e62cc9396a8acb287a1e7d775797d, tor30fly, runelure, EyePyramid, f8358565e3d80fb9c69fcbe9d3349f1d, dongfeng, drifter, cryptominer, huggingface, MinerWars, GRIDTIDE, Stealc, potassium, woof, 5c07e21ca557de9ff0ce91d009c62e00, 5ecaf10790d5f89db8606b207b2143e4, 625f32b674143ce7827477f4a5675dfe, Meterpreter, d852ede598d72f2b3a4050576466ec62, hook, DanBot, SAVED START, DIVINE, BL-Networks, cab, nginx, payload-delivery, pycached, operator-server, Aptos, blockchain-C2, ContagiousInterview, macOS, MacSync, Protrollzx, WIN, newfish, CK-099, c8ae9fc91602b6596ce53dffcd0c5146, 19ccb70dbc12ef919d5869277e598933, tag, cs-watermark-391144938, inject-2, 20473, Cobalt Strike, 25820, 210558, Oct-1-2026, RemcosAgent, Vjw0rm, WSHRAT, dc2e5904be10c1f064ddfc0f4cca6898, Nexus 31-08-2026, CLOUDHAZE, live-fire-detonation, UNC7072, newember, SUPERMARIO, quasar, Oct_Milli, e5c73f2f0e4a2909e7e914ac4e867b57, d813994ce1dbd4db71c3b48d6cf58bfc, shadowpad, 2debf41cd243fa04fa0d0ba1afd03826, real, ONETOUCH, 0f81469cc7638ba7c82eaddbd6b3c20a, staging, Oct-5-2026 exploit, Oct-14-2026 Frost, EMBER 64, WARDENStealer, injectus, Remcos32b, 4040, RUST, URL, tauri, DarkSword, panel, Coruna, ios, MythicC2, Poseidon, KoiLoader, KoiStealer, BridgeAgent, hidden-desktop, dropped-by-amadey, Electron-ASAR, ExFiles, flomo-abuse, cowrie, dns-xor, OpenNIC, 212317, 202412, botnet_cc, config-server, Wicked Kryptex Test, cveil, NetSupport, poshc2, nuevos 07, SalatStealer, TON, webrat, fake-steam-client, phishing, Steam, Pass2, 317106, Amadey, smokeloader, Cloudzy, fake-ai-tool, Melty, Bst, 4bc2877d1ad24788eb5675dd034f5bad, f1f28418d97a5af5ae1f0ae2e29d2056, 4039, BDmonies, Rem1, GomoRAT, Gh0stRAT, blizzard-net, 8560, NMUOnAPUAPU | 2026-10-20 |
| critical | payload_delivery: undefined | threat-intel | threatfox | Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin, BSC, dead-drop, etherhiding, smart-contract, freight-lure, panel, RAT, NodeJS, Vidar, c2, ec141392be2e474ab700bf353b3b9f2c, Loader, stealer, ClearFake, ClickFix, EtherHidingMagecart, mac-0x68dc, macOS, HadesStealer, HadeStealer, elf, IoT, Mozi, 46ffc506f663afc29ff2cb6c97f94000, mac-0xdcf2, mac-0x0f14, AUR, CHAOS, DirtyBlanket, linux, onion, systemd-fontd, gitflic, wayback, SocGholish, 55001da20373e92a4261b69e9f1087ac, btrf36, Coruna, DarkSword, ios, SilentNet, SmartApeSG, error524, fedex, PhaaS, smishing, 1718e0679220166cf123fbe6e40c635c, d852ede598d72f2b3a4050576466ec62, DHT, protokol, Mac, Kongtuke, Amos, Foxveil, ErrTraffic, Polygon, remcos, moobot, asyncrat, Remus, MacSync, ZigClipper, quasar, Android, GhostBat, ghostx-panel, mParivahan, veltrix, apix, fake-git, powershell, IRC, k4_irc_bot, jar, minecraft, abe-bypass, com-hijacking, hermes, hermes-stealer, infostealer, 6713982832fdd0efe07912b12c5c5b2b, 379e62cc9396a8acb287a1e7d775797d, c7a50169dbc6d842a7e7d349513f88f1, Mirai, DCHOST, guloader, exe, RevStealer, OffLoader, codec-cache, cve-2026-96656, miner, plex, funrat, MaksRAT, PussyRAT, TON, auditpolcore, DLL-sideloading, OVH, CLOUDHAZE, UNC7072, DIVINEX, DvnX, WARDENStealer, YapStealer, ContagiousInterview, DPRK, fake-recruitment, RuntimeBroker, Websocket, DDoS, garble, golang, minefox, ab0a59f4970a96fd6e8daa4f6f8e22cd, b9df72d092aeb25d8cb28d34cc4984de, fallback, go, legea, fabric, java, DGA, Amadey, SalatStealer, xmrig, dropped-by-OffLoader, gamaredon, GammaSteel, CobaltStrike, drb-ra, modat, b89d843f29af2eed09805e9767a1165f, d85b02740b9fbbe0bc098debbc5a5109, sepolia, AppSheet share.google zip PureRAT, runelure, validin, valleyrat_s2, f7e0bdc53604a00d861131d2693a943c, huggingface, SpacesForRent, Stresser, Github, Stealc, RemusStealer, c1399bfb1be0a51415613edd6f0068c5, d42249d8b3409d0cd65c3cc7f8267ec0, 1ca8afc0e9497e2ea687b455ff40cf1e, zero stealer, cab, Certum, Dropper, EV-signed, payload-delivery, pycached, python, signed, socketio, skimming, victim, 5ecaf10790d5f89db8606b207b2143e4, compromised, etherhide, fakeupdates, PayloadDelivery, stager, botnet, malware, XWorm, cracked-software, RUST, staging, vscode, vscode-tasks-folderOpen, PLASMAGRID, GHOSTBLADE, supply-chain, web-drive-by, Mythic, MythicC2, Poseidon, ScreenConnect, msi, cowrie, dns-xor, honeypot, OpenNIC, tauri, fake-steam-client, phishing, Steam, Magecart, fake-ai-tool, Overlord, SloppyRAT, GomoRAT, GhostRAT, Gh0stRAT, FakeLogin, YoungLotus, applescript, ValleyRAT, dcrat | 2026-10-20 |
| critical | Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw | news | general-news | rce | 2026-10-19 |
| high | CVE-2026-112149 — A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a4873… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112150 — A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112151 — A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a4873… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-107567 — Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-107569 — Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a r… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-107571 — Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 throug… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-109431 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulne… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-111045 — CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink po… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112152 — A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112153 — A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112304 — docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() tha… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112305 — Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with t… | vulnerability | nvd | rce | 2026-10-19 |
| high | CVE-2026-112306 — NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112307 — sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject P… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112308 — crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapin… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112309 — @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauth… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112366 — Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows at… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112368 — An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2025-10149 — The SCIM endpoint does not sufficiently validate authorization for federated users when performing o… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-107186 — An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the n… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-107187 — A user can access any database details, such as usernames and passwords by sending a DWR request wit… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-10572 — IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-10743 — IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to i… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-12148 — IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially ex… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-12665 — IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when p… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-6930 — IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2025-52290 — A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-11… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-111759 — markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, spe… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112377 — CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence… | vulnerability | nvd | ransomware | 2026-10-19 |
| high | CVE-2026-3295 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑su… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112252 — A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112260 — A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a hea… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112770 — Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in… | vulnerability | nvd | rce | 2026-10-19 |
| high | CVE-2026-112772 — Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authen… | vulnerability | nvd | rce | 2026-10-19 |
| high | CVE-2026-112774 — Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authen… | vulnerability | nvd | rce | 2026-10-19 |
| high | CVE-2026-112775 — Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attac… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112777 — Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() f… | vulnerability | nvd | rce | 2026-10-19 |
| high | CVE-2026-112780 — Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112782 — Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-71169 — Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-71170 — Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerabi… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-82166 — Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical F… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112301 — A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-76788 — The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes r… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-105814 — TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafte… | vulnerability | nvd | botnet | 2026-10-19 |
| high | CVE-2026-105815 — TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through una… | vulnerability | nvd | botnet | 2026-10-19 |
| high | CVE-2026-112257 — A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112258 — A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list wh… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112261 — A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-112360 — A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the f… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-53995 — MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend… | vulnerability | nvd |  | 2026-10-19 |
| high | CVE-2026-105453 — IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-107366 — IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership ver… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-107400 — IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-109126 — IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-105297 — Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-109440 — LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-109443 — JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated us… | vulnerability | nvd | rce | 2026-10-20 |
| high | CVE-2026-109444 — OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-77926 — Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin user… | vulnerability | nvd | rce | 2026-10-20 |
| high | CVE-2026-77930 — EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to r… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-77934 — Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-77935 — Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-77937 — Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impe… | vulnerability | nvd |  | 2026-10-20 |
| high | CVE-2026-105299 — Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream reques… | vulnerability | nvd |  | 2026-10-20 |
| high | Price Request List  #GSGPRO202600197.exe | malware | malware-bazaar | exe | 2026-10-20 |
| high | 80330f59bad607ce.js | malware | malware-bazaar | js | 2026-10-20 |
| high | export.php | malware | malware-bazaar | ClickFix, Efimer, exe | 2026-10-20 |
| high | file | malware | malware-bazaar | dropped-by-Vidar, exe, f7e0bdc53604a00d861131d2693a943c, infostealer | 2026-10-20 |
| high | SecuriteInfo.com.Heur.10656.3336 | malware | malware-bazaar | msi | 2026-10-20 |
| high | 570e354d.ps1 | malware | malware-bazaar | etherhiding, freight-lure, miner, powershell, telegram | 2026-10-20 |
| high | vnc_bootstrap.ps1 | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | main_v4.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | main_v3.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | main_v2.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | main_v1.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | hello.hta | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 |
| high | 0e814f4d934e4a57.bin | malware | malware-bazaar | macho, snowlight | 2026-10-20 |
| high | 884c70bde746092d.bin | malware | malware-bazaar | macho | 2026-10-20 |
| high | 48e9eab9bb48d75b.bin | malware | malware-bazaar | elf, gafgyt, mirai, botnet | 2026-10-20 |
| high | 05ca064a34061e79.bin | malware | malware-bazaar | macho | 2026-10-20 |
| high | 92e1930e6de81598.bin | malware | malware-bazaar | elf, Mirai, vshell, botnet | 2026-10-20 |
| high | 085dc35f07a9b087.bin | malware | malware-bazaar | elf, Snowlight, vshell | 2026-10-20 |
| high | file | malware | malware-bazaar | B, dropped-by-GCleaner, exe, MIX8.file | 2026-10-20 |
| high | SecuriteInfo.com.Heur.9029.26114 | malware | malware-bazaar | msi | 2026-10-20 |
| high | WordPress SEO plugin Rank Math compromised to backdoor websites | news | general-news | supply-chain | 2026-10-19 |
| high | Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack | news | general-news | supply-chain | 2026-10-19 |
| high | ConnectWise suspends Cloud Backup service after supply chain attack | news | general-news | supply-chain | 2026-10-19 |
| medium | CVE-2026-112147 — A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112328 — The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-86375 — Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive D… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-107566 — Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-107568 — Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply a… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-109433 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerabili… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112158 — A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the functi… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112303 — GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112310 — docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attacke… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112363 — Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-13173 — Tokens associated with user sessions are not revoked when the corresponding user session is terminat… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-13591 — The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response wh… | vulnerability | nvd | phishing | 2026-10-19 |
| medium | CVE-2025-6623 — The carbon console accepts user-supplied XML input without sufficiently encoding potentially executa… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-7043 — The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be t… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-7203 — The Management Console and product files expose sensitive data, including remote log server credenti… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-111061 — russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Pr… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112159 — A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an u… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112190 — A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112195 — A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown funct… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-11828 — IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unenc… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-11829 — IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-11831 — IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very li… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-12155 — IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially craft… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-12350 — IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially cra… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-12670 — IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafte… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-12727 — IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-14511 — IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sen… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-15661 — IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-55667 — A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-111757 — Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 un… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112247 — A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Manage… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112248 — A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the fun… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-11319 — TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in… | vulnerability | nvd | ransomware | 2026-10-19 |
| medium | CVE-2026-1510 — IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-3161 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that co… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-3628 — IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-4405 — IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by anothe… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-4413 — IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an un… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-4418 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-109434 — Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows re… | vulnerability | nvd | ransomware, phishing | 2026-10-19 |
| medium | CVE-2026-112251 — A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRe… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112259 — A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112254 — A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is t… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112297 — A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the func… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112771 — Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass becau… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112781 — Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page edito… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112299 — A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affec… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112300 — A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is th… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112302 — A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function Archiv… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112395 — Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read pa… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-76787 — The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112358 — A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. T… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112361 — A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112396 — Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-36061 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-36069 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2025-36252 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112372 — A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile o… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-19178 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to g… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-19595 — The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c v… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-77684 — The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not… | vulnerability | nvd |  | 2026-10-19 |
| medium | CVE-2026-112373 — A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function… | vulnerability | nvd |  | 2026-10-20 |
| medium | CVE-2026-109441 — LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' s… | vulnerability | nvd |  | 2026-10-20 |
| medium | CVE-2026-77938 — Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tool… | vulnerability | nvd |  | 2026-10-20 |
| medium | payload: undefined | threat-intel | threatfox | Loader, macho, SNOWLIGHT, elf, Vshell, Mirai, cowrie, honeypot, upx, x86, Gafgyt, etherhiding, freight-lure, NodeJS, RAT, VNC, Amos, ClickFix, Foxveil, frame97, macOS, frame, nova, haven, chant, willow, quill, exe, remcos, RemcosRAT, AgentTesla, ps1, Sh, IoT, AUR, CHAOS, DirtyBlanket, linux, systemd-fontd, 0xf00dbeef, CorePayloadManager, Coruna, ios, analystic, DarkSword, GHOSTBLADE, P7, salted-hash, Bashlite, Ngioweb, xorddos, ACR, ACRStealer, fake game, ROM, setup.exe, setup.py, fake game setup, js, QuasarRAT, masslogger, Formbook, asyncrat, cloaked, Dropper, MacSync, dll, Flame, SalatStealer, stealer, cve-2026-96656, miner, plex, Android, GhostBat, ghostx-panel, mParivahan, veltrix, caira, CLOUDHAZE, PageStone, QuartzLine, fake-git, Discord, encrypted, iraenc, gitlab, RUST, IRC, k4_irc_bot, onlycn, ROOTKIT, jar, minecraft, mod, Shell, doc8, python, wraith, RevStealer, HTA, codec-cache, Keylogger, VIPKeylogger, Alien, powershell, UNC7072, auditpolcore, DLL-sideloading, OVH, Python39.rar, DvnX, unpacked, WARDENStealer, YapStealer, rozena, GravityRAT, armv5, DDoS, go, legea, x86_64, MIPS, armv7, mips64, arm64, mipsle, sideloading, Qt5Widgets, TeamSpeak, bingads, Expiro, fba, pdf-suite, UnifyInstaller, dropped-by-OffLoader, acrobat, ppc_free_pdfsuite, puwaders, store-decoy, ChatGPT, CoinMiner, Amadey, FlyLegitBot, Vidar, DDoSAgent, Remus, P2PInfect, appk, sshdkit, SSHDoor, Bobik, clipbanker, 54e64e, dropped-by-amadey, LummaStealer, ZigClipper, dropped-by-RemusStealer, zeus, xmrig, MillenuimRAT, runelure, file-size-evasion, masquerading, terminalfix, token-impersonation, dll-sideloading-adjacent, njrat, arc, 317106, cred.dll, plugin, backdoor, x86-64, ssh-honeypot, shem, mipsel, RustyStealer, BlankGrabber, BlankStealer, Electron-ASAR, ExFiles, flomo-abuse, HijackLoader, infostealer, fake-ai-tool, jcef, crypto-targeting, persistence, token-theft, encrypted-payload, ARM, hajime, Downloader, botnet | 2026-10-20 |
| medium | AOMEI Backupper update servers hijacked to push malware: Check your PC | threat-intel | otx | aomei backupper, remote access backdoor, supply chain attack, upgrade-now.exe, update infrastructure compromise, software distribution hijacking, supply-chain | 2026-10-19 |
| low | CVE-2026-112157 — A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted elemen… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-112193 — A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of th… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-12660 — IBM MQ Web Console could allow an authenticated administrator to write files outside the intended di… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-12669 — IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malf… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-1501 — IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-3303 — IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacke… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-112249 — A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw… | vulnerability | nvd |  | 2026-10-19 |
| low | CVE-2026-111766 — markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark pre… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-107081 — SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJA… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111046 — FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasMan… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111053 — FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the un… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-12254 — Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Clie… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-103038 — PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-107082 — Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perf… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111063 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111064 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, kee… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111065 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111066 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.1… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111748 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111749 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Hos… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2025-55654 — A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2025-60480 — A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-105810 — Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-107084 — Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) a… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111755 — follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. Fr… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-55644 — Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2025-60482 — A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110672 — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a dupl… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110673 — Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110674 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowin… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110675 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys un… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110676 — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110677 — Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key val… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110678 — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental inpu… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110680 — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared h… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110681 — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser ob… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110682 — Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110684 — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110685 — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110686 — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itse… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110687 — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-110688 — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112768 — Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target accou… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112769 — Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112778 — Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Servi… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-111946 — Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the d… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112390 — Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112391 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recu… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112393 — Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and s… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112394 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read pa… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112392 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference inv… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112397 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112398 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write d… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112399 — Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal ba… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112400 — Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112401 — Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112402 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when Imagin… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112403 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width sc… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112404 — Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode path… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112405 — Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112406 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112891 — Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112892 — Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a s… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112893 — Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph point… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112894 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112895 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while pars… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112896 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMa… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112897 — Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112898 — Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112900 — Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument inject… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112901 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to reg… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-112991 — The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF)… | vulnerability | nvd |  | 2026-10-19 |
| unknown | CVE-2026-8355 — IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSR… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-105298 — Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-28850 — An authorization issue was addressed with improved state management. This issue is fixed in visionOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-28853 — The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-28854 — The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Go… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-65356 — An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gat… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-65372 — A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-65379 — The issue was addressed with improved handling of secure input state. This issue is fixed in macOS G… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-65396 — A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden G… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84490 — This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84508 — This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84547 — A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84579 — A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84582 — A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and i… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-84613 — An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86868 — An authentication issue was addressed with improved state management. This issue is fixed in macOS G… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86871 — An integer underflow was addressed with improved input validation. This issue is fixed in macOS Gold… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86872 — A logic issue was addressed with improved state management. This issue is fixed in Safari 27, vision… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86874 — An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27.… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86875 — An input validation issue was addressed with improved input validation. This issue is fixed in Xcode… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86907 — An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86913 — A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86914 — An information disclosure issue was addressed with improved state management. This issue is fixed in… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86915 — A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. A… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86919 — A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and i… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86921 — A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPad… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86922 — A type confusion issue was addressed with improved state management. This issue is fixed in Safari 2… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86928 — A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Ga… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86932 — An authorization issue was addressed with improved state management. This issue is fixed in macOS Go… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86933 — A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86935 — This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Ga… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86940 — This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 2… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86948 — This issue was addressed by enforcing library validation on the affected binaries. This issue is fix… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86955 — An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86957 — An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 a… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86959 — An input validation issue was addressed with improved input validation. This issue is fixed in iOS 2… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86961 — A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86962 — A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 a… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86963 — A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 2… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86975 — An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86977 — An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86979 — A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-86981 — An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in mac… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-102438 — An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execut… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-17518 — Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenti… | vulnerability | nvd |  | 2026-10-20 |
| unknown | CVE-2026-75753 — Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby… | vulnerability | nvd |  | 2026-10-20 |
| unknown | Dispel Zero Trust Engine for OEMs to secure remote industrial service, standardize access, strengthen compliance | advisory | vendor-blogs |  | 2026-10-19 |
| unknown | Nikkei discloses third data breach in a month, 1.8M records exposed | news | general-news |  | 2026-10-19 |
| unknown | Hackers hijack AOMEI update servers to secretly spread malware | news | general-news |  | 2026-10-19 |
| unknown | Bullhorn takes staffing platform offline to contain cyberattack | news | general-news |  | 2026-10-19 |
| unknown | OpenCode hack exposes API keys amid AI distillation attacks | news | general-news |  | 2026-10-19 |
| unknown | Microsoft fixes game, app crashes caused by recent Windows update | news | general-news |  | 2026-10-19 |
| unknown | Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor | news | general-news |  | 2026-10-19 |
| unknown | Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor | news | general-news |  | 2026-10-19 |
| unknown | 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery | news | general-news |  | 2026-10-19 |
| unknown | ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs | news | general-news |  | 2026-10-19 |
| unknown | Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks | news | general-news |  | 2026-10-19 |
| unknown | Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds | news | general-news |  | 2026-10-19 |
| unknown | Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands | news | general-news |  | 2026-10-19 |
| unknown | DHS to ban DeepSeek from federal civilian agencies | news | general-news |  | 2026-10-19 |