# OSINT Threat Intelligence Report **Date:** 2026-10-20 | **Generated:** 2026-10-20T03:01:48.951Z | **Items:** 5076 | **Range:** full ## Sources | Source | Count | |--------|-------| | cisa-kev | 7 | | nvd | 4259 | | otx | 29 | | cisa-advisories | 14 | | vendor-blogs | 627 | | malware-bazaar | 20 | | abuse-ipdb | 20 | | threatfox | 3 | | general-news | 110 | ## Top 10 Highlights | Severity | Title | Source | CVEs | Tags | |----------|-------|--------|------|------| | critical | CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | cisa-kev, nvd, otx | CVE-2026-102764, CVE-2023-46805, CVE-2024-21887 | beyondtrust, sawfly, credential harvesting, tunneler, bareclaw, privilege escalation, cve-2026-102764, prc-nexus, zero-day exploitation, webshell, remote support, zeroday, phishing | | critical | CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability | cisa-kev, nvd | CVE-2026-76519 | | | critical | CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure | cisa-advisories | | zeroday | | critical | CVE-2026-96119 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive informa… | nvd | CVE-2026-96119 | | | critical | CVE-2026-87689 — The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::Web… | nvd | CVE-2026-87689 | | | critical | CVE-2026-89107 — SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by… | nvd | CVE-2026-89107 | | | critical | CVE-2026-89108 — SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundarie… | nvd | CVE-2026-89108 | | | critical | CVE-2026-89110 — SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal fun… | nvd | CVE-2026-89110 | | | critical | CVE-2026-89111 — The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applic… | nvd | CVE-2026-89111 | | | critical | CVE-2026-85529 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3… | nvd | CVE-2026-85529, CVE-2026-97229 | | ## All Items | Severity | Title | Category | Source | Tags | Published | |----------|-------|----------|--------|------|-----------| | critical | CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | vulnerability | cisa-kev, nvd, otx | beyondtrust, sawfly, credential harvesting, tunneler, bareclaw, privilege escalation, cve-2026-102764, prc-nexus, zero-day exploitation, webshell, remote support, zeroday, phishing | 2026-10-16 | | critical | CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability | vulnerability | cisa-kev, nvd | | 2026-10-14 | | critical | CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure | advisory | cisa-advisories | zeroday | 2026-10-13 | | critical | CVE-2026-96119 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive informa… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-87689 — The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::Web… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-89107 — SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-89108 — SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundarie… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-89110 — SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal fun… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-89111 — The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applic… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-85529 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-108971 — A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109108 — A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the functio… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109109 — A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the functio… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-108179 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109110 — A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the c… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-89309 — The authorization middleware of the WMS MobileServer fails to require authentication in two distinct… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-44415 — Affected systems do not properly restrict access to internal APIs and paths for authenticated users.… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-63350 — Affected devices do not properly restrict executable content contained in imported trace files. This… | vulnerability | nvd | phishing, ics | 2026-10-13 | | critical | CVE-2026-63353 — Affected devices do not properly sanitize comment fields contained in imported trace files before re… | vulnerability | nvd | phishing, ics | 2026-10-13 | | critical | CVE-2026-63354 — Affected devices do not properly validate and sanitize visual marker data contained in imported CSV… | vulnerability | nvd | phishing, ics | 2026-10-13 | | critical | CVE-2026-109157 — A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the func… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109705 — Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Net… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109707 — Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Fi… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109708 — Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109740 — Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerabili… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109745 — Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109750 — Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firef… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109755 — Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-65162 — NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initializatio… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-65173 — NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation end… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-74040 — Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterH… | vulnerability | nvd | rce | 2026-10-13 | | critical | CVE-2026-74041 — Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-74043 — Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_r… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-104192 — Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueOb… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-53709 — MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.p… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-55675 — The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-55695 — FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-78802 — An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allo… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-102989 — TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework f… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-106042 — An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 all… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-109412 — An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attac… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110116 — Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in t… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-54454 — OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and h… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-55183 — RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes effi… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-55562 — Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.11… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69227 — A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoi… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-77459 — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15,… | vulnerability | nvd | botnet | 2026-10-13 | | critical | CVE-2026-78799 — Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 En… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-94603 — Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-106173 — A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fo… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-37107 — An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-52394 — DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-92892 — Potential arbitrary code execution, under specific configurations. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-100133 — Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-100202 — Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-100219 — Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-100222 — Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-102210 — Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code o… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-102229 — Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-103849 — Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engi… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-104584 — reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-104816 — Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS comp… | vulnerability | nvd | ransomware | 2026-10-13 | | critical | CVE-2026-105008 — No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105010 — Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105016 — Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110130 — Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authent… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69634 — Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69639 — Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code ove… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69705 — Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69883 — Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-69886 — Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70024 — Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70092 — Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70096 — Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to exec… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70131 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70157 — Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70158 — Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an… | vulnerability | nvd | rce | 2026-10-13 | | critical | CVE-2026-70188 — Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70215 — Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70242 — Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70279 — Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-70300 — Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83519 — Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute cod… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83578 — Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to exec… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83780 — Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a ne… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83782 — Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83797 — Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83862 — Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code ove… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83869 — Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83910 — Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83928 — Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthor… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-83935 — Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-84015 — Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthor… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-85806 — Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacke… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-85818 — Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-85928 — Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacke… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-88102 — Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a ne… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-88117 — Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-88156 — Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-92464 — Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitr… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-92909 — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrar… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96096 — Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code o… | vulnerability | nvd | ransomware | 2026-10-13 | | critical | CVE-2026-96113 — Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a netw… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96252 — Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) all… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96320 — Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code ov… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96864 — Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96909 — Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-96924 — Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-97749 — Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a netwo… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-97816 — Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-103848 — Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-104252 — Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2,… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-104585 — Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105895 — Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-106629 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-48382 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result i… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-63146 — Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, atta… | vulnerability | nvd | rce | 2026-10-13 | | critical | CVE-2026-83662 — Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An att… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-90531 — Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('X… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105897 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in pr… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105898 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105899 — ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that coul… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105903 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-105994 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security f… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-106613 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-49950 — Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows… | vulnerability | nvd | rce | 2026-10-13 | | critical | CVE-2026-90530 — ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-93895 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticate… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-93909 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentica… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110136 — Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute a… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110142 — Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ex… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110149 — Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execu… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110152 — Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote atta… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110159 — Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110161 — Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execu… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-110165 — Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attack… | vulnerability | nvd | | 2026-10-13 | | critical | CVE-2026-97381 — Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1… | vulnerability | nvd | ransomware | 2026-10-13 | | critical | CVE-2026-110385 — A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-110392 — Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-92097 — The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution i… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-93388 — The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticat… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-110002 — The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all vers… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-110447 — Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows r… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-97657 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass v… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-97668 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the g… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-104800 — The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-87855 — The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-107594 — The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path take… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-89310 — A parameter taken from the request body is inserted into a T-SQL statement without parameterization… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-100163 — The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-104748 — The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for Wor… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-103904 — The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitor… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-107424 — Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboa… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-108291 — Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injec… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-16740 — Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on vi… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-108065 — SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Softw… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-98395 — In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irq_soft_mask… | vulnerability | nvd | ransomware | 2026-10-14 | | critical | CVE-2026-98396 — In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in… | vulnerability | nvd | ransomware | 2026-10-14 | | critical | CVE-2026-110612 — vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated atta… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110631 — Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that all… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110634 — git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execut… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110635 — webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js h… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110636 — pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110638 — doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to exec… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110639 — @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110640 — Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to e… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110643 — transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110644 — nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() th… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110645 — Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attacker… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110649 — Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execut… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110650 — The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-59774 — Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endp… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-86002 — Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-l… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-91881 — Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Valid… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101950 — A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101956 — An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks J… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101980 — An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo con… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101986 — An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101990 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-102031 — An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-pr… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-102175 — A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-102178 — A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS a… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-102182 — A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-109439 — Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authe… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-33792 — A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SR… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-67418 — RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and… | vulnerability | nvd | ransomware | 2026-10-14 | | critical | CVE-2026-77524 — KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a name… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101954 — An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session h… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-101983 — A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Ju… | vulnerability | nvd | rce | 2026-10-14 | | critical | CVE-2026-108390 — Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-55572 — e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-55573 — e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controll… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-102471 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the… | vulnerability | nvd | ransomware | 2026-10-14 | | critical | CVE-2026-110536 — A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the f… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-85714 — Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-55680 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-55683 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110862 — Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that all… | vulnerability | nvd | | 2026-10-14 | | critical | CVE-2026-110911 — Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-108587 — The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is… | vulnerability | nvd | rce | 2026-10-15 | | critical | CVE-2026-101306 — SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transfe… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-101307 — When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeate… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-109145 — The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-72528 — "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability.… | vulnerability | nvd | ransomware, phishing | 2026-10-15 | | critical | CVE-2026-109694 — Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Priv… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-104025 — Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZ… | vulnerability | nvd | ransomware | 2026-10-15 | | critical | CVE-2026-109686 — Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper a… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-109892 — Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-front… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-99999 — In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start be… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-110957 — A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element i… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-46691 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authentic… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-110958 — A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown f… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-57155 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Al… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-110812 — Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engin… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111105 — Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows r… | vulnerability | nvd | rce | 2026-10-15 | | critical | CVE-2026-84731 — An unauthenticated remote attacker can bypass authentication and gain full access to administrative… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-102946 — joserfc is a Python library that provides an implementation of several JSON Object Signing and Encry… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111235 — An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridia… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-55239 — Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29,… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-57496 — NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-105032 — The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and pr… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-105037 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-105038 — The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model adminis… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-105039 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-110916 — Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attack… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111281 — Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution… | vulnerability | nvd | rce | 2026-10-15 | | critical | CVE-2026-111283 — BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111322 — Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthentic… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111329 — JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow un… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-94134 — The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key… | vulnerability | nvd | | 2026-10-15 | | critical | CVE-2026-111444 — Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKS… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-104798 — The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalatio… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-109219 — The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, an… | vulnerability | nvd | rce | 2026-10-16 | | critical | CVE-2026-109515 — The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin fo… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-103768 — The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitr… | vulnerability | nvd | rce | 2026-10-16 | | critical | CVE-2026-89079 — The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover i… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-104730 — The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPre… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-94169 — Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-gr… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-107617 — An attacker can use a hard-coded credential to log in to EseeCloud devices. | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-18516 — An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, u… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-105279 — In the default configuration, the archive accepts DICOM associations from an unregistered calling AE… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-95182 — An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbit… | vulnerability | nvd | botnet | 2026-10-16 | | critical | CVE-2026-97851 — The storage status-change REST service allows location records still associated with DICOM instances… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-41582 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 a… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-102692 — RIOT is an open-source microcontroller operating system designed for Internet of Things devices and… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-57169 — Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endp… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-85745 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-85748 — MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, S… | vulnerability | nvd | rce | 2026-10-16 | | critical | CVE-2026-111626 — Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauth… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111641 — FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111643 — Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauth… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111673 — IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated att… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111687 — WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthent… | vulnerability | nvd | rce | 2026-10-16 | | critical | CVE-2026-111690 — Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthen… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111692 — DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unaut… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111693 — DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allo… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111704 — LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthen… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111708 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allo… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111711 — Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-102608 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, d… | vulnerability | nvd | | 2026-10-16 | | critical | CVE-2026-111823 — Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknow… | vulnerability | nvd | | 2026-10-17 | | critical | CVE-2026-104736 — The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inc… | vulnerability | nvd | | 2026-10-17 | | critical | CVE-2026-111911 — phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registrat… | vulnerability | nvd | | 2026-10-17 | | critical | CVE-2026-110372 — Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privile… | vulnerability | nvd | | 2026-10-18 | | critical | CVE-2026-110885 — Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivep… | vulnerability | nvd | | 2026-10-18 | | critical | CVE-2026-110886 — Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot con… | vulnerability | nvd | | 2026-10-18 | | critical | CVE-2026-111998 — Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated r… | vulnerability | nvd | | 2026-10-18 | | critical | CVE-2026-98645 — In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98691 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98741 — In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched c… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98782 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor pl… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98785 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc_state_… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98786 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc_sink d… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98836 — In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized pl… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98867 — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-98868 — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that ov… | vulnerability | nvd | ransomware | 2026-10-18 | | critical | CVE-2026-108983 — A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-111406 — Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-64943 — Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects… | vulnerability | nvd | ransomware | 2026-10-19 | | critical | CVE-2026-90910 — Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apac… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-78162 — Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: fr… | vulnerability | nvd | rce | 2026-10-19 | | critical | CVE-2026-112292 — CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated at… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-112296 — FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthentica… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-109432 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerabili… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-111057 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-111058 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prio… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-107083 — SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injectio… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-107188 — A user can upload export reports with any file contents and specify any contents. JSP code can be up… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-111862 — Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.… | vulnerability | nvd | supply-chain | 2026-10-19 | | critical | CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defau… | vulnerability | nvd | rce | 2026-10-19 | | critical | CVE-2026-112776 — Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-s… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-112779 — Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for ever… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-112370 — A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of t… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-112371 — A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the… | vulnerability | nvd | | 2026-10-19 | | critical | CVE-2026-109395 — Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc… | vulnerability | nvd | | 2026-10-20 | | critical | CVE-2026-109442 — piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat age… | vulnerability | nvd | rce | 2026-10-20 | | critical | CVE-2026-75128 — Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any register… | vulnerability | nvd | | 2026-10-20 | | critical | CVE-2026-77932 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /ap… | vulnerability | nvd | rce | 2026-10-20 | | critical | CVE-2026-77933 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.ym… | vulnerability | nvd | | 2026-10-20 | | critical | CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password… | vulnerability | nvd | | 2026-10-20 | | critical | CVE-2026-70197 .NET Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-19 | | critical | CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-83831 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-85806 Network Policy Server (NPS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-70213 Microsoft Power Apps Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-70013 Windows iSCSI Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-97776 Microsoft Office Excel Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-96202 Windows Raw Image Extension Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-78524 Microsoft Office Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-81396 Microsoft Excel Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-16 | | critical | CVE-2026-102858 Microsoft Office OneNote Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-105599 Microsoft Office PowerPoint Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-105715 Microsoft Office Word Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-108448 Microsoft Office Outlook Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-70096 Windows Rich Text Edit Control Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-32157 Remote Desktop Client Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-15 | | critical | CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-14 | | critical | CVE-2026-69351 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability | advisory | vendor-blogs | ransomware | 2026-10-14 | | critical | CVE-2026-69620 Windows DHCP Server Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-14 | | critical | CVE-2026-69334 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-14 | | critical | CVE-2026-81352 Web Media Extensions Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-14 | | critical | CVE-2026-102849 Microsoft Office Access Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-108400 HEVC Video Extensions Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-108457 Microsoft Windows PDF Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-102227 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-102235 Visual Studio Code Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-102855 Microsoft Office Visio Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-108467 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-105733 Windows Hyper-V Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-108460 Windows Message Queuing Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69639 Windows libarchive Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69913 Windows TCP/IP Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69942 Windows Overlay Filter Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70014 Windows Cryptographic Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70127 Windows Domain Name Service Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70126 Windows Bluetooth Port Driver Remote Code Execution | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70119 Windows DNS Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70247 HTTP.sys Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-67625 Microsoft SQL Server Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83578 Microsoft PowerShell Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83693 Windows Error Reporting Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83700 Windows Now Playing Session Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | ransomware | 2026-10-13 | | critical | CVE-2026-83712 Windows NTFS Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83754 Microsoft OpenSSH for Windows Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83759 Windows Encrypting File System (EFS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83780 Windows CCFFilter Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83836 Windows Event Tracing Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70089 Windows GDI Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70275 Windows CD-ROM File System Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83914 Microsoft XML Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83919 Microsoft Internet Messaging API Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83928 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69886 Windows Imaging Component Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-84012 Windows Remote Desktop Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-84015 Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85339 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85373 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability | advisory | vendor-blogs | ransomware | 2026-10-13 | | critical | CVE-2026-85798 Windows Distributed File System (DFS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85814 Microsoft Windows Media Foundation Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85856 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability | advisory | vendor-blogs | ics, rce | 2026-10-13 | | critical | CVE-2026-88159 Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-88165 Windows Active Directory Domain Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85926 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-88102 Microsoft Failover Cluster Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-88136 Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70024 Windows Internet Information Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96864 Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96096 Windows Media Player Remote Code Execution Vulnerability | advisory | vendor-blogs | ransomware, rce | 2026-10-13 | | critical | CVE-2026-69992 Remote Desktop Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70157 Windows System Information Console Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69765 Windows Storport Miniport Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69326 Graphic Fonts Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83523 Windows Image Acquisition Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83725 Microsoft Windows Search Component Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83739 Windows Bluetooth Service Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83770 Windows Text Shaping Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83797 Windows Partition Management Driver Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83856 Windows Event Logging Service Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83889 Windows DNS Server Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-83910 RPC Runtime Library Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-85874 Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69789 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-88115 Windows Server for NFS Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-88174 Windows Deployment Services Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70112 Windows Spaceport.sys Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70143 Windows Network File System Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70250 Windows DHCP Client Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70297 Skype for Business Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70571 Microsoft Exchange Server Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-69802 Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-94512 SQL Server Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-70343 Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96230 ASP.NET Core Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96321 Remote Desktop Display Driver Information Disclosure Vulnerability | advisory | vendor-blogs | ransomware | 2026-10-13 | | critical | CVE-2026-96909 Windows BitLocker Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96924 Windows OLE Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-21413 Raw Image Extension Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96953 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-96071 Windows Media Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100207 Azure CycleCloud Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100214 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100218 Remote Desktop Gateway Service Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100219 Microsoft QUIC Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100220 Windows Media Video Decoder Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-102203 RPC Runtime Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-100215 Microsoft Graphics Component Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-105005 Windows Schannel Remote Code Execution Vulnerability | advisory | vendor-blogs | rce | 2026-10-13 | | critical | CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH) | advisory | vendor-blogs | rce | 2026-10-15 | | critical | Malicious IP: 151.243.11.150 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 135.119.91.34 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 57.131.50.86 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 109.160.32.123 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 185.223.235.46 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 13.140.80.140 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 14.51.12.142 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 43.135.144.81 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 106.13.95.198 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 103.216.145.2 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 45.115.26.61 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 115.178.75.242 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 43.172.117.23 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 172.209.208.96 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 210.91.153.182 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 186.122.177.140 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 172.212.203.117 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 122.170.99.195 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 2.57.217.229 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | Malicious IP: 77.239.124.77 | ip-reputation | abuse-ipdb | | 2026-10-20 | | critical | botnet_cc: undefined | threat-intel | threatfox | Vidar, AISURU, c2, Vshell, c7a50169dbc6d842a7e7d349513f88f1, Loader, stealer, ec141392be2e474ab700bf353b3b9f2c, njrat, remcos, REMOTEHOST, ac32fe0cdedaab512d4ba45a7cfcc26b, honeypot, f7e0bdc53604a00d861131d2693a943c, sliver c2, QuasarRAT, drb-ra, Mythic, Havoc, sliver, PureHVNC, PureRAT, RAT, CobaltStrike, JUNIO777, SERVER2405v2, GP, 332ps1Ago, Star-Baby-27, RatonRAT, RemcosRAT, ValleyRAT, valleyrat_s2, trum, 1718e0679220166cf123fbe6e40c635c, d85b02740b9fbbe0bc098debbc5a5109, moobot, Supershell, shodan, abe-bypass, ClickFix, com-hijacking, DesktopStreamClient, hermes, hermes-stealer, Hvnc, infostealer, loader-c2, Lold, MaaS, SyncService, exfil, FakeGit, LuaJIT, SmartLoader, Mirai, Remus, 373d420e3c3e68da3a553422caafc283, 1ca8afc0e9497e2ea687b455ff40cf1e, Adaptix, AdaptixC2, asyncrat, DinDoor, EvilGinx, EvilGoPhish, TRT UR BEST, XWorm, censys, exe, RevStealer, Android, GhostBat, mParivahan, veltrix, CantoIncognito, cryptomining, PoeLLM, Sektor7, elf, apix, fake-git, powershell, IRC, k4_irc_bot, onlycn, ROOTKIT, minefox, shellcode, stage2, fake-crack, Github, stager, IoT, Mozi, Romulus, ViriBack, 6713982832fdd0efe07912b12c5c5b2b, c1399bfb1be0a51415613edd6f0068c5, 5a4378fb90db39f09c7b18d1f314e645, 945c9f3c8cddcb7f33efce50a9a949ad, modat, murdoc, Covenant, Antidot, dcrat, b9df72d092aeb25d8cb28d34cc4984de, guloader, NSIS, XtremeRAT, NanoCore, Arechclient2, SectopRAT, default-cert, mtls, tofsee, Port$$, codec-cache, cve-2026-96656, miner, plex, Huatai007, CHAOS, Viper, cs-watermark-666666666, cs-watermark-987654321, Gafgyt, CheatSheet, dead-drop, gitlab, pastebin, DPRK, etherhiding, polinrider, backdoor, bot, Sh, dump-yuv, PM-5766, ErrTraffic, Polygon, 521048dd5a8917782e586ac60bc1eceb, WinWordl, botnet, CECbot, DDoS, host, go, legea, 369b7d35486e31c3854c6efc823ab439, sliverc2, d42249d8b3409d0cd65c3cc7f8267ec0, dotNET, fake-cheat, Qt5Widgets, sideloading, TeamSpeak, NUEVAS4001, airashi, Jackskid, rctea, MicroUpdate, apk, GoPhish, BruteRatel, adf0aff417ab94ddd17c189420efb165, ab0a59f4970a96fd6e8daa4f6f8e22cd, b89d843f29af2eed09805e9767a1165f, 379e62cc9396a8acb287a1e7d775797d, tor30fly, runelure, EyePyramid, f8358565e3d80fb9c69fcbe9d3349f1d, dongfeng, drifter, cryptominer, huggingface, MinerWars, GRIDTIDE, Stealc, potassium, woof, 5c07e21ca557de9ff0ce91d009c62e00, 5ecaf10790d5f89db8606b207b2143e4, 625f32b674143ce7827477f4a5675dfe, Meterpreter, d852ede598d72f2b3a4050576466ec62, hook, DanBot, SAVED START, DIVINE, BL-Networks, cab, nginx, payload-delivery, pycached, operator-server, Aptos, blockchain-C2, ContagiousInterview, macOS, MacSync, Protrollzx, WIN, newfish, CK-099, c8ae9fc91602b6596ce53dffcd0c5146, 19ccb70dbc12ef919d5869277e598933, tag, cs-watermark-391144938, inject-2, 20473, Cobalt Strike, 25820, 210558, Oct-1-2026, RemcosAgent, Vjw0rm, WSHRAT, dc2e5904be10c1f064ddfc0f4cca6898, Nexus 31-08-2026, CLOUDHAZE, live-fire-detonation, UNC7072, newember, SUPERMARIO, quasar, Oct_Milli, e5c73f2f0e4a2909e7e914ac4e867b57, d813994ce1dbd4db71c3b48d6cf58bfc, shadowpad, 2debf41cd243fa04fa0d0ba1afd03826, real, ONETOUCH, 0f81469cc7638ba7c82eaddbd6b3c20a, staging, Oct-5-2026 exploit, Oct-14-2026 Frost, EMBER 64, WARDENStealer, injectus, Remcos32b, 4040, RUST, URL, tauri, DarkSword, panel, Coruna, ios, MythicC2, Poseidon, KoiLoader, KoiStealer, BridgeAgent, hidden-desktop, dropped-by-amadey, Electron-ASAR, ExFiles, flomo-abuse, cowrie, dns-xor, OpenNIC, 212317, 202412, botnet_cc, config-server, Wicked Kryptex Test, cveil, NetSupport, poshc2, nuevos 07, SalatStealer, TON, webrat, fake-steam-client, phishing, Steam, Pass2, 317106, Amadey, smokeloader, Cloudzy, fake-ai-tool, Melty, Bst, 4bc2877d1ad24788eb5675dd034f5bad, f1f28418d97a5af5ae1f0ae2e29d2056, 4039, BDmonies, Rem1, GomoRAT, Gh0stRAT, blizzard-net, 8560, NMUOnAPUAPU | 2026-10-20 | | critical | payload_delivery: undefined | threat-intel | threatfox | Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin, BSC, dead-drop, etherhiding, smart-contract, freight-lure, panel, RAT, NodeJS, Vidar, c2, ec141392be2e474ab700bf353b3b9f2c, Loader, stealer, ClearFake, ClickFix, EtherHidingMagecart, mac-0x68dc, macOS, HadesStealer, HadeStealer, elf, IoT, Mozi, 46ffc506f663afc29ff2cb6c97f94000, mac-0xdcf2, mac-0x0f14, AUR, CHAOS, DirtyBlanket, linux, onion, systemd-fontd, gitflic, wayback, SocGholish, 55001da20373e92a4261b69e9f1087ac, btrf36, Coruna, DarkSword, ios, SilentNet, SmartApeSG, error524, fedex, PhaaS, smishing, 1718e0679220166cf123fbe6e40c635c, d852ede598d72f2b3a4050576466ec62, DHT, protokol, Mac, Kongtuke, Amos, Foxveil, ErrTraffic, Polygon, remcos, moobot, asyncrat, Remus, MacSync, ZigClipper, quasar, Android, GhostBat, ghostx-panel, mParivahan, veltrix, apix, fake-git, powershell, IRC, k4_irc_bot, jar, minecraft, abe-bypass, com-hijacking, hermes, hermes-stealer, infostealer, 6713982832fdd0efe07912b12c5c5b2b, 379e62cc9396a8acb287a1e7d775797d, c7a50169dbc6d842a7e7d349513f88f1, Mirai, DCHOST, guloader, exe, RevStealer, OffLoader, codec-cache, cve-2026-96656, miner, plex, funrat, MaksRAT, PussyRAT, TON, auditpolcore, DLL-sideloading, OVH, CLOUDHAZE, UNC7072, DIVINEX, DvnX, WARDENStealer, YapStealer, ContagiousInterview, DPRK, fake-recruitment, RuntimeBroker, Websocket, DDoS, garble, golang, minefox, ab0a59f4970a96fd6e8daa4f6f8e22cd, b9df72d092aeb25d8cb28d34cc4984de, fallback, go, legea, fabric, java, DGA, Amadey, SalatStealer, xmrig, dropped-by-OffLoader, gamaredon, GammaSteel, CobaltStrike, drb-ra, modat, b89d843f29af2eed09805e9767a1165f, d85b02740b9fbbe0bc098debbc5a5109, sepolia, AppSheet share.google zip PureRAT, runelure, validin, valleyrat_s2, f7e0bdc53604a00d861131d2693a943c, huggingface, SpacesForRent, Stresser, Github, Stealc, RemusStealer, c1399bfb1be0a51415613edd6f0068c5, d42249d8b3409d0cd65c3cc7f8267ec0, 1ca8afc0e9497e2ea687b455ff40cf1e, zero stealer, cab, Certum, Dropper, EV-signed, payload-delivery, pycached, python, signed, socketio, skimming, victim, 5ecaf10790d5f89db8606b207b2143e4, compromised, etherhide, fakeupdates, PayloadDelivery, stager, botnet, malware, XWorm, cracked-software, RUST, staging, vscode, vscode-tasks-folderOpen, PLASMAGRID, GHOSTBLADE, supply-chain, web-drive-by, Mythic, MythicC2, Poseidon, ScreenConnect, msi, cowrie, dns-xor, honeypot, OpenNIC, tauri, fake-steam-client, phishing, Steam, Magecart, fake-ai-tool, Overlord, SloppyRAT, GomoRAT, GhostRAT, Gh0stRAT, FakeLogin, YoungLotus, applescript, ValleyRAT, dcrat | 2026-10-20 | | critical | RSVP to Disaster: How One Click Installs a RAT | threat-intel | otx | captcha manipulation, social engineering, connectwise exploitation, fake invitation, remote access trojan, screenconnect, phishing campaign, screenconnect abuse, holiday-themed attack, phishing | 2026-10-13 | | critical | Drupal patches critical RCE flaws, warns exploits may emerge soon | news | general-news | rce | 2026-10-17 | | critical | ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More | news | general-news | zeroday | 2026-10-19 | | critical | UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing | news | general-news | apt, phishing | 2026-10-16 | | critical | China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers | news | general-news | zeroday | 2026-10-16 | | critical | ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More | news | general-news | rce | 2026-10-15 | | critical | NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks | news | general-news | rce | 2026-10-15 | | critical | Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing | news | general-news | rce | 2026-10-15 | | critical | Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules | news | general-news | rce | 2026-10-15 | | critical | Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation | news | general-news | rce | 2026-10-15 | | critical | Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts | news | general-news | rce | 2026-10-15 | | critical | BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs | news | general-news | zeroday | 2026-10-16 | | critical | When Your Ransomware Negotiator Works for the Other Side | news | general-news | ransomware | 2026-10-16 | | critical | Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles | news | general-news | zeroday, ics, rce | 2026-10-14 | | critical | Ransomware Gangs Embrace Physical Threats, Family Stalking? | news | general-news | ransomware | 2026-10-14 | | critical | Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday | news | general-news | zeroday | 2026-10-13 | | critical | Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw | news | general-news | rce | 2026-10-19 | | critical | Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments | news | general-news | ransomware | 2026-10-16 | | critical | Ransomware pressure now reaches employees’ homes and families | news | general-news | ransomware | 2026-10-19 | | critical | Prolific Chinese espionage group exploits BeyondTrust zero-day | news | general-news | zeroday | 2026-10-16 | | high | CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability | vulnerability | cisa-kev, otx | fortigate, privilege escalation, network intrusion, cve-2024-47575, telecommunications, memory-resident implant, fortimanager, vpn, cve-2025-61624, peerstitch | 2026-10-16 | | high | CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | vulnerability | cisa-kev | | 2026-10-15 | | high | CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability | vulnerability | cisa-kev | | 2026-10-14 | | high | CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability | vulnerability | cisa-kev | | 2026-10-14 | | high | CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability | vulnerability | cisa-kev, nvd | | 2026-10-14 | | high | Thermo Fisher Torrent Suite Software | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-15 | | high | J4Care dcm4che | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-15 | | high | Guangzhou Juan IoT Technology EseeCloud | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-15 | | high | Eclipse Foundation Eclipse Milo | advisory | cisa-advisories, vendor-blogs | ics | 2026-10-15 | | high | CISA Malcolm | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-15 | | high | Inductive Automation Ignition Software | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-13 | | high | Swann Communications SWIFI-SE2KIC | advisory | cisa-advisories, vendor-blogs | phishing, ics | 2026-10-13 | | high | CVE-2026-93886 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-58249 — SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted re… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-89113 — SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorpora… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-89120 — A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorizat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105458 — GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 bef… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108956 — A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-14814 — GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-16301 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-35001 — OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-78335 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-81839 — GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 bef… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108964 — A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknow… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108965 — A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerabilit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108966 — A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affect… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108967 — A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108968 — A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected elem… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108969 — A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e6… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108970 — A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbf… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108972 — A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this v… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-54867 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103316 — The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108973 — A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108974 — A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function sa… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108975 — A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerabil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102007 — The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin f… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102562 — The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103418 — Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106597 — Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109114 — A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109115 — A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109116 — A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-13138 — Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce In… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102073 — A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-59241 — A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All ve… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-72895 — A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW… | vulnerability | nvd | botnet | 2026-10-13 | | high | CVE-2026-78556 — A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85114 — A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All version… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-89196 — A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109832 — A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109403 — A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerabili… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109405 — A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the f… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109704 — Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109709 — Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vul… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109712 — Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109715 — Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Fi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109720 — JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109722 — JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109730 — Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109734 — Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firef… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109736 — Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 15… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109737 — Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109739 — Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109743 — Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 1… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109744 — Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109746 — Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Th… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109747 — Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbir… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109753 — Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109754 — Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109756 — Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109757 — Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Fi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109759 — Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firef… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109760 — Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Fi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109762 — Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Fir… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109778 — Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Fi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65101 — NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65103 — NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename ha… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65104 — NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65110 — NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-65141 — NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A success… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65147 — NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds rea… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65148 — NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65149 — NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds wri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65161 — NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65164 — NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction com… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65170 — NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenti… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65172 — NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL ma… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65180 — NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-103499 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109519 — A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109520 — A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the functi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109676 — FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109956 — NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109960 — Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authent… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109961 — Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated cu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109965 — Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to acce… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109967 — yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-74034 — Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrol… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-74035 — Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where securit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-74036 — Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-74037 — Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles,… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-74045 — Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-93907 — IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95680 — IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass author… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108184 — Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated use… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108185 — Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthe… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109521 — A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca25… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109522 — A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109523 — A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d3… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-11731 — An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthentic… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-11732 — An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-53418 — Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-53420 — Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65198 — Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95114 — libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/mis… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95115 — Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a den… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95121 — An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiTyp… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95122 — mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95124 — Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a d… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-104935 — Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated att… | vulnerability | nvd, otx | vpn appliances, ivanti connect secure, root access, race condition, cgi exploitation, privilege escalation, authentication bypass, cve-2026-104935, zero-day vulnerabilities, zeroday, ics | 2026-10-13 | | high | CVE-2026-109525 — A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109605 — A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This af… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110025 — A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown proce… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-55376 — Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure.… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103030 — Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follow… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106043 — A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106047 — A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before versi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109606 — A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the f… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109607 — A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109620 — A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulner… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110097 — Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers wit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110102 — Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install sc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110108 — MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110115 — Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110119 — Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member add… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110123 — Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows aut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110124 — FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110128 — fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthentic… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-54640 — OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAsse… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-54641 — OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRol… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-61642 — Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-82416 — FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retai… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85990 — Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2025-46773 — An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-104085 — odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows aut… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-108375 — dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Re… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100200 — Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100201 — Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100203 — Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100205 — Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100207 — Improper neutralization of special elements used in an os command ('os command injection') in Azure… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100209 — Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a netw… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100210 — Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100214 — Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to exec… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100215 — Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100216 — Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100217 — Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100218 — Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code ove… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100220 — Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100225 — Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102192 — Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102193 — Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102194 — Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locall… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102201 — Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102202 — Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102203 — Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102204 — Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint al… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102205 — Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102207 — Concurrent execution using shared resource with improper synchronization ('race condition') in Windo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102208 — Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102209 — Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102211 — Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102214 — Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102216 — Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102217 — Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102220 — Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102225 — Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a ne… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102226 — Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102227 — Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102231 — Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to byp… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102232 — Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security f… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102233 — Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security fea… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102599 — Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102849 — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute cod… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102856 — Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102858 — Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102859 — Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102860 — Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102861 — Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102862 — Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102863 — Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102866 — Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102869 — Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an un… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102870 — Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103553 — Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103555 — Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103558 — Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103569 — Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103572 — Improper control of generation of code ('code injection') in Visual Studio Tools for Applications an… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103575 — Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a netwo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103577 — Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103578 — Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103966 — Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103967 — Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-104342 — Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-104875 — Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105003 — Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105004 — Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105005 — Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a netwo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105007 — An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS)… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105009 — Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105013 — Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105595 — Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105599 — Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105715 — Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105718 — Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105723 — Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105725 — Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105728 — Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105732 — Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges loca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105733 — Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108130 — Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108131 — No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108132 — Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108133 — Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108134 — Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108135 — Improper link resolution before file access ('link following') in Windows Backup Engine allows an au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108136 — Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108396 — Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108398 — Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108399 — Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108400 — Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108457 — Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108460 — Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a net… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108463 — Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to by… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108464 — Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108465 — Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108467 — Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108468 — Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-108471 — Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an autho… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109428 — Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-109429 — Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110111 — Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authent… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-110112 — Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110202 — Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() tha… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110203 — Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110204 — Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to ru… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110205 — Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110207 — Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authent… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110208 — Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110211 — iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authe… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110215 — youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110216 — youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authentica… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110220 — Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that all… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110233 — Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110236 — KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110237 — Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory with… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110238 — Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110255 — Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerabili… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-49785 — Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a secu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-58280 — Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-61931 — Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-68836 — Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69326 — Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69354 — Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69370 — Improper neutralization of special elements used in a command ('command injection') in Visual Studio… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69387 — Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locall… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69452 — Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69454 — Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69471 — Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69521 — Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69596 — Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69633 — Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69650 — Improper verification of cryptographic signature in Windows Key Distribution Center allows an author… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69651 — Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69673 — Improper link resolution before file access ('link following') in Windows Update allows an authorize… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69718 — Improper neutralization of special elements used in a command ('command injection') in Windows Updat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69733 — Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69763 — Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69765 — Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code o… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69783 — External control of file name or path in Windows Update allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69789 — Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69795 — Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69798 — Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69802 — Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69840 — Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69850 — Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69867 — Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69880 — Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69884 — Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69898 — Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69909 — Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69913 — Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69915 — Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69916 — Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69918 — Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69923 — Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69934 — Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69942 — Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69943 — Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69945 — Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69949 — Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69950 — Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69957 — Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69959 — Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69963 — Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69964 — Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69966 — Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69969 — Improper link resolution before file access ('link following') in Windows AppX Deployment Service al… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69977 — Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69982 — Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-69992 — Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code ov… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70007 — Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70008 — Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70010 — Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70014 — Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70015 — Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70021 — Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70023 — Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70026 — Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70027 — Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70031 — Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70033 — Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unaut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70035 — Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70045 — Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70049 — Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70051 — Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an autho… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70052 — Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70054 — Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70058 — Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a ne… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70059 — Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locall… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70060 — Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70062 — Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70064 — Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70066 — Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70068 — Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70069 — Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code ove… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70079 — Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny s… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70082 — Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70089 — Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a net… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70093 — Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70102 — Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70104 — Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70110 — Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70112 — Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70113 — Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70118 — Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70123 — Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70126 — Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70127 — Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70132 — Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70133 — Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70134 — Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70142 — Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70143 — Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70149 — Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (cs… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70155 — Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70159 — Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70160 — Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70161 — Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an aut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70163 — Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70164 — Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70165 — Improper link resolution before file access ('link following') in .NET allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70167 — Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70168 — Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70172 — Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70174 — Improperly implemented security check for standard in .NET allows an unauthorized attacker to execut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70175 — Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70177 — Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70179 — Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70183 — Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.N… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70184 — Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70185 — Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a securit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70186 — Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70197 — Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70198 — Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70202 — Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70205 — Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver f… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70207 — Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70210 — Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges o… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70212 — Improper restriction of communication channel to intended endpoints in Windows Security Center allow… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70213 — Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70218 — Insufficient granularity of access control in Windows StateRepository API allows an authorized attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70220 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70222 — Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70223 — Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70228 — Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70229 — Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70233 — Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70238 — Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70241 — Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70247 — Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70250 — Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjace… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70252 — Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70255 — Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70262 — Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a ne… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70266 — Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Of… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70267 — Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70274 — Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70275 — Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70276 — Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70278 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70281 — Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose informati… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70286 — Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70297 — Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70299 — Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70303 — Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70343 — Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70566 — Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70571 — Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70580 — Missing authentication for critical function in Windows Credential Guard allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-72955 — Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-73027 — External control of system or configuration setting in Windows Setup Files Cleanup allows an authori… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-77910 — Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-78459 — Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-81969 — Insufficient granularity of access control in Windows Server Update Service allows an authorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83505 — Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorize… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83506 — Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83507 — Improper link resolution before file access ('link following') in Windows Update Orchestrator Servic… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83508 — Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83509 — Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83513 — Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83514 — Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83516 — Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthori… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83518 — Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locall… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83520 — Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a net… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83522 — Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83523 — Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83566 — Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83568 — Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83569 — Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83579 — Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83580 — Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83583 — Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83584 — Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83585 — Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83586 — Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83587 — Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83588 — Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83634 — Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83635 — Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83637 — Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83639 — Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83640 — Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83641 — Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges loca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83642 — Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83643 — Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83645 — Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS)… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83647 — Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny servi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83654 — Missing authentication for critical function in Windows Modern Device Management (MDM) allows an aut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83655 — Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service ov… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83659 — Improper link resolution before file access ('link following') in Windows User Profile Service allow… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83665 — Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83666 — Concurrent execution using shared resource with improper synchronization ('race condition') in Activ… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83669 — Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83670 — Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83676 — Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83677 — Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83678 — Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83679 — Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83687 — Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83688 — Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83691 — Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83692 — Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83694 — Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83696 — Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83699 — Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83700 — Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privi… | vulnerability | nvd | ransomware | 2026-10-13 | | high | CVE-2026-83704 — Improper link resolution before file access ('link following') in Microsoft Windows Search Component… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83708 — Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83709 — Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83710 — Use after free in Windows Device Association Service allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83712 — Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83715 — Missing authentication for critical function in Windows Error Reporting allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83716 — Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83721 — Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83722 — Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83724 — Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83725 — Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83726 — Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83728 — Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83735 — Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83739 — Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83740 — Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83741 — Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83746 — Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83749 — Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83750 — Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83751 — Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83753 — Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83754 — Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code ov… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83757 — Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83758 — Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83759 — Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) al… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83763 — Access of resource using incompatible type ('type confusion') in Windows Input System allows an auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83769 — Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83771 — Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83777 — Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83778 — Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83781 — Improper null termination in Windows Program Compatibility Assistant Service allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83784 — Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83785 — Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83789 — Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83791 — Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83792 — Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83795 — Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83826 — Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83827 — Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83828 — Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83829 — Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83830 — Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83832 — Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges loca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83834 — Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83836 — Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83838 — Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83839 — Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83840 — Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83842 — Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83843 — Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83844 — Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83845 — Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to per… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83846 — Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83847 — Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83848 — Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83851 — Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83855 — Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to de… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83856 — Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83860 — Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a ne… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83861 — Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83863 — Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83867 — Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83868 — Concurrent execution using shared resource with improper synchronization ('race condition') in Micro… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83871 — Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83872 — Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83876 — Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83877 — Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83881 — Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83886 — Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83889 — Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83891 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83896 — Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83899 — Improper privilege management in Windows Installer allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83908 — Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83914 — Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83915 — Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83916 — Double free in Windows Error Reporting allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83917 — Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83918 — Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83919 — Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to exec… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83923 — Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83927 — Improper link resolution before file access ('link following') in Windows Registry allows an authori… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83929 — Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83932 — Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83934 — Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84012 — Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84013 — Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84014 — Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84016 — Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84017 — Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84018 — Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84019 — Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-84020 — Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85322 — Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85324 — Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85327 — Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85328 — Weak authentication in Windows Projected File System allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85334 — Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to discl… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85338 — Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85341 — Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85343 — Improper link resolution before file access ('link following') in Windows Hyper-V allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85353 — Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85355 — Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver al… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85359 — Improper control of generation of code ('code injection') in Windows Performance Monitor allows an a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85362 — Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85363 — Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85367 — Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85369 — Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85370 — Use after free in WebDAV allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85371 — Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85373 — Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorize… | vulnerability | nvd | ransomware | 2026-10-13 | | high | CVE-2026-85375 — Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker t… | vulnerability | nvd | ransomware | 2026-10-13 | | high | CVE-2026-85376 — Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85377 — Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an aut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85791 — Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85795 — Use after free in Windows Text Services Framework allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85796 — Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85798 — Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85803 — Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85807 — Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85808 — Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85817 — Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85823 — Use after free in Windows Composite Image File System allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85826 — Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85827 — Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85829 — Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85832 — Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an autho… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85833 — Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85837 — Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85842 — Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85843 — Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85846 — Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85851 — Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85853 — Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges l… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85856 — Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacke… | vulnerability | nvd | ics | 2026-10-13 | | high | CVE-2026-85858 — Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85860 — Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85861 — Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85864 — Improper privilege management in Python allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85867 — Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85868 — Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85871 — Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85872 — Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85874 — Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute cod… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85879 — Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorize… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85881 — Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85884 — Missing authentication for critical function in Windows Health and Optimized Experiences Service all… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85891 — Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85903 — Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85905 — Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate p… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85911 — Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85914 — Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85915 — Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85920 — Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85922 — Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85925 — Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an aut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85926 — Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85930 — Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges loca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85934 — Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85936 — Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85943 — Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) al… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87691 — Use after free in Windows Management Services allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87692 — Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87695 — Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87696 — Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87699 — Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87702 — Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87705 — Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87707 — Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87710 — Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87712 — Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87713 — Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-87716 — Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to d… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88070 — Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88071 — Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88072 — Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88074 — Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an auth… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88076 — Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88079 — Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate pri… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88091 — Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88094 — Improper neutralization of special elements in output used by a downstream component ('injection') i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88098 — Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88099 — Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88100 — Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privile… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88101 — Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88110 — Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88115 — Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88118 — Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88121 — Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized atta… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88126 — Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88127 — Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88128 — Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88133 — Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88135 — Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88136 — Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88147 — Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88149 — Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88150 — Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88152 — Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88155 — Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88161 — Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88163 — Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88165 — Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute cod… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88171 — Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88193 — Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate pr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88196 — Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88200 — Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to el… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88210 — Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88219 — Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-92908 — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Securi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95943 — Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96044 — No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96071 — Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96108 — Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96118 — Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96186 — Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96188 — External control of system or configuration setting in Microsoft PowerToys allows an authorized atta… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96202 — Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96209 — Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96220 — Improper control of generation of code ('code injection') in Windows Assigned Access allows an autho… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96222 — Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96230 — Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96232 — Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96233 — Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96237 — Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96243 — Improper link resolution before file access ('link following') in Windows WalletService allows an au… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96244 — Use after free in Windows Internal System User Profile allows an authorized attacker to elevate priv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96246 — Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose inform… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96248 — Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96250 — Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96251 — Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96306 — Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96309 — Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96313 — Missing authentication for critical function in Windows Push Notifications allows an authorized atta… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96318 — Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96322 — Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privilege… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96323 — Use after free in Windows Update allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96325 — Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96844 — Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96861 — Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to de… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96867 — Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96912 — Use after free in Windows Client License Service allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96915 — Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to eleva… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96918 — Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96920 — Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96923 — Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges lo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96939 — Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96943 — Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to exe… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96951 — Improper neutralization of special elements used in a command ('command injection') in Windows Shell… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96953 — Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an author… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96957 — Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96959 — Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96960 — Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny serv… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96995 — Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privil… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96997 — Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges local… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97008 — Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97011 — Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute c… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97739 — Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97742 — Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute cod… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97762 — Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97767 — Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97774 — Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authori… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97778 — Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97781 — Improper neutralization of special elements used in a command ('command injection') in Microsoft Off… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97788 — Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attack… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97793 — Missing authentication for critical function in Windows Setup and Deployment allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97794 — Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97798 — Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97799 — Improper verification of cryptographic signature in Windows Audio Service allows an authorized attac… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97800 — Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97801 — Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97811 — Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97812 — Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-97830 — Double free in Windows Internet Information Services allows an unauthorized attacker to deny service… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102234 — Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102235 — Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to exe… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103830 — Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103832 — Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitr… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103840 — Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file,… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103843 — Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary co… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103844 — Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103845 — Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103846 — Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerabilit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103847 — Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103854 — Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106634 — Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110083 — Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQ… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110084 — Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability t… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-55601 — MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earli… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63149 — Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows att… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63152 — Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allo… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63153 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectat… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63154 — Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63158 — Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows a… | vulnerability | nvd | ransomware | 2026-10-13 | | high | CVE-2026-63159 — Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability tha… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63160 — Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me tok… | vulnerability | nvd | ransomware | 2026-10-13 | | high | CVE-2026-63161 — Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63162 — Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-63163 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileF… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63165 — Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-63172 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-70098 — Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a n… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-86016 — VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_me… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-86022 — VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100111 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100127 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-103821 — Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-104348 — Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arb… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105442 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105443 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation bet… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-105900 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in an applica… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106616 — ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-106623 — ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-62840 — Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to e… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-65674 — Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-67625 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-67628 — Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-68883 — Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-75996 — ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to appl… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83661 — Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83965 — Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result i… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-83966 — Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85876 — Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-85919 — Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88083 — Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a net… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-88088 — Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges loc… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-93905 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95635 — Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code exe… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95639 — Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbit… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-95695 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-96956 — Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100113 — CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100114 — CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100116 — CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could r… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100136 — CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could re… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-100137 — CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-102502 — CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerabi… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110137 — Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execut… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110138 — Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker w… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110139 — Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110140 — Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute ar… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110144 — Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a loca… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110145 — Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who ha… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110148 — Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110154 — Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potent… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110155 — Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110156 — Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allow… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110162 — Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execu… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110163 — Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute a… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110164 — Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potential… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110166 — Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ex… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-110168 — Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute ar… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-77206 — Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for auth… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-77207 — Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authent… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-94453 — Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over… | vulnerability | nvd | rce | 2026-10-13 | | high | CVE-2026-95634 — CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could… | vulnerability | nvd | | 2026-10-13 | | high | CVE-2026-92817 — The Ignition Perspective module does not properly validate session privileges when determining Desig… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110359 — Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is c… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103423 — The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104767 — The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnera… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104995 — The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to,… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-17092 — The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vu… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-82715 — Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Dr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102251 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection v… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103422 — The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' par… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110444 — TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthentica… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-14765 — Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configurat… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-100153 — The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_ST… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110449 — Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write w… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-77114 — The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumb… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-78193 — The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-83592 — The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-93885 — The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to S… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-94377 — The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-95808 — The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-95816 — The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-96661 — The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gme… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-97398 — The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | vulnerability | nvd | ransomware | 2026-10-14 | | high | CVE-2026-101924 — The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-105429 — Improper neutralization of special elements in the NetBird client SSH configuration manager (client/… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110450 — Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110454 — A malicious actor with access to the network could exploit an Improper Access Control vulnerability… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110455 — A malicious actor with access to the network and under certain conditions could exploit an Improper… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-50218 — Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103307 — The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly saniti… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107126 — The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controll… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107508 — The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86787 — The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supp… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86799 — The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor esca… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89288 — The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103367 — The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Incl… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104761 — The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' p… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104764 — The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104909 — The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-105106 — Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-105107 — Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107631 — The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Sit… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107751 — The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name'… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110284 — The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-92392 — During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73790 — A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73793 — HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86476 — A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-88829 — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward r… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-90954 — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred s… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103358 — Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103905 — The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104795 — The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107431 — Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting In… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73798 — A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-76655 — A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-106599 — Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107421 — Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107426 — Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-82026 — Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSoc… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-97278 — Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injecti… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110690 — Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-98391 — In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker… | vulnerability | nvd | botnet | 2026-10-14 | | high | CVE-2025-71433 — Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104939 — Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy fo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110599 — L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_s… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110615 — jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus e… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110616 — NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticate… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110618 — SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP ser… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110621 — Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addPr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110622 — Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticat… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110623 — Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110628 — Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110632 — Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110633 — MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-p… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110637 — buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110641 — @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110642 — xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that al… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110646 — Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110647 — Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to exec… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110648 — @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows at… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-15176 — A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-53612 — util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 thr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-53613 — util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 thr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-66877 — Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and di… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-71184 — Gitea's pull request review notifier does not attach the pull request to the Actions notification, s… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73535 — Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73539 — Gitea substitutes a URL derived from the markup Context field into external renderer command templat… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73800 — Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch wo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73802 — Gitea Runner passes workflow-controlled container options into Docker job container configuration wh… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73804 — Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-91184 — Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-93479 — A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-94197 — An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Contr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-97205 — NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When async… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102695 — OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103929 — mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default n… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110719 — Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that a… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-53614 — util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 t… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-53615 — util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended(… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-87093 — Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. Thi… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89067 — Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89068 — Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). Thi… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89070 — Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). Thi… | vulnerability | nvd | ransomware | 2026-10-14 | | high | CVE-2026-89071 — Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability i… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89072 — Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89073 — Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89074 — Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89075 — Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affe… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-89077 — Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-91156 — Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-91882 — Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive In… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-100236 — A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, i… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101927 — A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolv… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101939 — A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Ju… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101940 — A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101942 — An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101943 — An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101944 — An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Netw… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101945 — An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101951 — An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101955 — A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101957 — An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101960 — An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101965 — An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks J… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101966 — A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks J… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101967 — An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networ… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101973 — A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows a… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101984 — A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos O… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101994 — An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102012 — A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved all… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102014 — A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102015 — A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102016 — An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Ne… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102020 — A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102023 — A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authe… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102024 — An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Juno… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102025 — A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process o… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102026 — An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102027 — An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Junipe… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102030 — An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102036 — An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS an… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102037 — An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Ju… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102043 — A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos O… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102046 — A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Netw… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102049 — A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Ju… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102050 — A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Jun… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102052 — A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and J… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102055 — A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX S… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102056 — An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Ev… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102057 — A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allow… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102059 — An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulner… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102061 — A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Juno… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102062 — An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks J… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102065 — An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102068 — A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allow… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102069 — A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102070 — A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Jun… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102079 — An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low pr… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102081 — A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102084 — An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-102174 — A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Network… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102176 — A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK se… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102185 — A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103946 — An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Ne… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103994 — A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Jun… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-15102 — ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. E… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-19673 — ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a rece… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-33798 — A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86562 — A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86563 — A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86565 — A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descripto… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-92151 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedde… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101961 — A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Netwo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101963 — An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Juno… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-101979 — A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evol… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102077 — An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engin… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-103081 — Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boo… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-104103 — Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107349 — An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cau… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-107350 — Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the pa… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-108395 — The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-108480 — Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Conf… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-109527 — The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-54554 — FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-79957 — ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endp… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86461 — The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload i… | vulnerability | nvd | ransomware, rce | 2026-10-14 | | high | CVE-2026-86567 — A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IO… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-86848 — A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a g… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102944 — cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() remov… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110667 — A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an u… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110761 — ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authent… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110767 — Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110769 — holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connecto… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110770 — Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthent… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-53999 — Radius is a cloud-native, portable application platform that makes app development easier for teams… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-54525 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, M… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55786 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4,… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55787 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-63626 — Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73252 — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack select… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73260 — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-73261 — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack ena… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-102986 — Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the pu… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110668 — A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function inde… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55381 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55498 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55681 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with acces… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-55682 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/segu… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-100232 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command I… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-110670 — A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110679 — A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function r… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-71854 — OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber advers… | vulnerability | nvd | ransomware | 2026-10-14 | | high | CVE-2026-96540 — An improper access control vulnerability has been identified in the SonicWall Network Security Manag… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110696 — A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999b… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110837 — FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110838 — FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110839 — FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-boun… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110856 — GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_acto… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110857 — GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run c… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-110858 — GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() w… | vulnerability | nvd | rce | 2026-10-14 | | high | CVE-2026-110859 — GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows r… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110863 — Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerab… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110864 — Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the O… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110865 — Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to e… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110867 — Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set r… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110868 — Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to ma… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110869 — Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._action… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-110873 — Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared col… | vulnerability | nvd | | 2026-10-14 | | high | CVE-2026-0993 — SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allow… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109430 — Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerabilit… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-73799 — A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-76066 — IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates… | vulnerability | nvd | ransomware | 2026-10-15 | | high | CVE-2026-76659 — A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-76660 — A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data. | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-76661 — A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-77931 — MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute… | vulnerability | nvd | rce | 2026-10-15 | | high | CVE-2026-110907 — Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a smal… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110908 — Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS comm… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-76663 — A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-14572 — The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-3712 — The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-76665 — A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buff… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-15090 — The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' p… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-17031 — The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-18548 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to St… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-18586 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthen… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-88043 — The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_ty… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101303 — The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101304 — When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descript… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101305 — renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could re… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-58098 — When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upo… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-58099 — When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-58100 — kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descrip… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-74920 — The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79821 — A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system d… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79822 — A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and pot… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-81534 — The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Executi… | vulnerability | nvd | rce | 2026-10-15 | | high | CVE-2026-96537 — The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that re… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101309 — The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. Th… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101310 — The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when s… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101311 — The framebuffer device model's maximum resolution constants were duplicated between the framebuffer… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-101290 — A remote attacker may send a specially crafted network packet that causes the affected application t… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109855 — undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSoc… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-26244 — A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-44084 — An authorization bypass through user-controlled key vulnerability has been reported to affect Video… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79824 — A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arb… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79825 — A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potenti… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79826 — A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79827 — A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and m… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79828 — A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79829 — A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109695 — Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-c… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79832 — A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in infor… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79833 — A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an aff… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110726 — In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`,… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79834 — A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform u… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-107416 — Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79837 — A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termin… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-93649 — In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-108116 — In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotG… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110746 — A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-53574 — EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an a… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79838 — A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulti… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79839 — A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-79840 — A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in ap… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-95179 — An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-9703 — Grafana's data source proxy did not apply role-based access control to write requests forwarded to L… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-100351 — kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.V… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-100352 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111091 — In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP serv… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111093 — In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint al… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111094 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypas… | vulnerability | nvd | rce | 2026-10-15 | | high | CVE-2026-111095 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-45449 — : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-45450 — : Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronic… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-45451 — : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-45452 — Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniL… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-53582 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust modul… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-58390 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN con… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-63442 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthentic… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-71490 — OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasP… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-92982 — A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-95155 — FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-97394 — kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter a… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-100353 — kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3fi… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-100354 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response,… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-100409 — OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-61611 — Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-85634 — A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core libra… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-103936 — libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/w… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-55103 — Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-55246 — bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-104827 — react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-104828 — HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-108334 — A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generat… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109383 — undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109829 — undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.1… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-109869 — undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111160 — LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attack… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111214 — Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows au… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111215 — Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111220 — pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111223 — Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111224 — pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.conne… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111226 — pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authentica… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111229 — pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111231 — Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-onl… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-36436 — An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the ad… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-55587 — AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the Al… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-55871 — GYM One is open-source gym management software for fitness centers, personal trainers, and sports cl… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-87018 — undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-97370 — Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/jav… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-106700 — ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management en… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-106708 — XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-105033 — The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabl… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-105034 — The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers wi… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-105035 — The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-cod… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-105036 — EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the En… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-105040 — The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update reques… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-108442 — Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a netwo… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-108443 — Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a net… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-108451 — Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code ov… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111357 — Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache co… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110913 — Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execut… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110914 — Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to po… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110915 — Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to e… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110919 — Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute ar… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110920 — Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-110922 — Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to exe… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111277 — NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of ac… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111279 — Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenti… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111280 — snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea()… | vulnerability | nvd | ics | 2026-10-15 | | high | CVE-2026-111282 — Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111312 — OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /a… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111352 — ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111356 — MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, a… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111359 — CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows aut… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111366 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows departmen… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111369 — ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:… | vulnerability | nvd | | 2026-10-15 | | high | CVE-2026-111210 — A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection o… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-75941 — A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusivel… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-84823 — A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-92629 — A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distribut… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111378 — FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in pars… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111379 — FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111380 — FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_ma… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111382 — FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaT… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111389 — Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injecti… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-103518 — The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnera… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-104745 — The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Esca… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107758 — The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109207 — The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plu… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109990 — The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vul… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111445 — Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condit… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111446 — Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111447 — Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111451 — Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and packag… | vulnerability | nvd | ransomware | 2026-10-16 | | high | CVE-2026-93953 — The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injectio… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-97339 — The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Sit… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-103895 — The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to A… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107659 — The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitiv… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107746 — The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to author… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109221 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to ar… | vulnerability | nvd | rce | 2026-10-16 | | high | CVE-2026-109400 — The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-110590 — The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all version… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111114 — The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is v… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-100186 — The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-103999 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-104000 — The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… | vulnerability | nvd | ransomware | 2026-10-16 | | high | CVE-2026-104932 — The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deser… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107764 — The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via t… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109232 — The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress i… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109513 — The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Anno… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-85659 — The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in al… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-89051 — The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored C… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-95686 — The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-96570 — The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Sc… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-104715 — A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege esc… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107768 — The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109193 — The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnera… | vulnerability | nvd | ransomware | 2026-10-16 | | high | CVE-2026-110015 — The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-110135 — The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-tim… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-110701 — The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-18551 — Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-92115 — The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all… | vulnerability | nvd | rce | 2026-10-16 | | high | CVE-2026-92553 — The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to… | vulnerability | nvd | rce | 2026-10-16 | | high | CVE-2026-97296 — Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allo… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-97640 — The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance C… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-75903 — The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-87111 — The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109224 — The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions,… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111311 — The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Au… | vulnerability | nvd | rce | 2026-10-16 | | high | CVE-2026-14177 — Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-92766 — The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-96768 — The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109119 — Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in R… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-105959 — A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocat… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107648 — The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Si… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111391 — SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allo… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-105958 — A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107564 — An unauthenticated remote attacker may use an allocation of resources without limits or throttling w… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111396 — Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-ma… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-63618 — Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnera… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-68571 — Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special par… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111413 — Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-101021 — MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-105273 — MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no f… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-105667 — In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authen… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-106705 — ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role managem… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-107621 — JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-88755 — Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers decla… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-95183 — An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attacker… | vulnerability | nvd | botnet | 2026-10-16 | | high | CVE-2026-102923 — SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0,… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-102941 — The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering a… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-46471 — An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-48503 — libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS,… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-57486 — pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlN… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-57487 — pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Trans… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-57488 — pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_t… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-77630 — pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, pars… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-96424 — Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary u… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-59962 — Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-77474 — destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-86008 — Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf0366… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-102551 — Improper verification of the source of a communication channel in the IPv6 Router Advertisement hand… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109587 — Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-109588 — Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111605 — Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111606 — Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authent… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111607 — Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111612 — netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows una… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111613 — AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote at… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111627 — HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER admi… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111633 — ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated atta… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111634 — Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated view… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111636 — OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthen… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111638 — sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111639 — bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_ta… | vulnerability | nvd | ransomware | 2026-10-16 | | high | CVE-2026-111642 — FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py t… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111644 — Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauth… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111650 — ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111662 — Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticat… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111671 — Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allow… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111675 — Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulne… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111680 — APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111681 — EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-priv… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111684 — Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated wo… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111685 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote atta… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111691 — WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111695 — Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulner… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111700 — WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated use… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111701 — OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthent… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111702 — ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that al… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111706 — 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportEx… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111710 — Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111722 — LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111723 — LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-81452 — Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violati… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-102917 — IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-102607 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, t… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-102834 — JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14,… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-30971 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-108374 — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0,… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111044 — Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-49410 — OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versi… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-62439 — A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-68498 — StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-96626 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-96627 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0… | vulnerability | nvd | | 2026-10-16 | | high | CVE-2026-111853 — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vul… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111854 — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerabil… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-109208 — The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vul… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-103899 — The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-108123 — The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-92798 — The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Executi… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-92978 — The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, Us… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-100316 — The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored C… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111110 — The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerabl… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-110889 — Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framew… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111880 — FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-call… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111881 — FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mis… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111882 — phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypas… | vulnerability | nvd | phishing | 2026-10-17 | | high | CVE-2026-111884 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when c… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111897 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows ca… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111898 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows K… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111901 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability i… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111907 — phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/a… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111908 — phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authori… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111909 — phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that al… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111923 — Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property l… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111924 — Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers… | vulnerability | nvd | | 2026-10-17 | | high | CVE-2026-111927 — Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains… | vulnerability | nvd | ransomware | 2026-10-17 | | high | CVE-2026-111866 — A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4.… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-110031 — The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-110981 — The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navig… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-96534 — The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-107436 — Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-110373 — Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phon… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-110383 — Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signatur… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-111999 — Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticate… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112000 — Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112001 — ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restric… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112005 — WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112015 — Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112018 — cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112021 — snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-111990 — A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-98455 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dere… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98467 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr der… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98483 — In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc_g… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98508 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer der… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98510 — In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after u… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98511 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin coun… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98515 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98519 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98588 — In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98596 — In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98624 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98717 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow w… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98761 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98762 — In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup time… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98775 — In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-fr… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98776 — In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binde… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98780 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memo… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98800 — In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98815 — In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-98838 — In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC a… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-109553 — Gitea resolved the principals of an SSH certificate by searching the content of all stored public ke… | vulnerability | nvd | | 2026-10-18 | | high | CVE-2026-112025 — A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601… | vulnerability | nvd | botnet | 2026-10-18 | | high | CVE-2026-111441 — 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提… | vulnerability | nvd | botnet | 2026-10-19 | | high | CVE-2026-112044 — A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f371… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-111440 — 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据… | vulnerability | nvd | botnet | 2026-10-19 | | high | CVE-2026-112082 — A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Schedul… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-16487 — A flaw was found in bootc when operating with the default containers signature policy. Automatic or… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-16460 — A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-76740 — A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112093 — A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a144… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-104679 — VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-111398 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT N… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-111408 — Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112104 — A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknow… | vulnerability | nvd | ransomware | 2026-10-19 | | high | CVE-2026-78164 — Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Info… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-78165 — Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue a… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-79983 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-80312 — Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Cam… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-80343 — Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-80344 — Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects A… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-83531 — Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elemen… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-85250 — Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-85251 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP compon… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-88901 — Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affe… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-88900 — Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-103314 — A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authe… | vulnerability | nvd | ransomware | 2026-10-19 | | high | CVE-2026-112141 — A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f4… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112142 — A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f4… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112143 — A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112145 — A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerabil… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112146 — A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown proces… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112262 — RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQ… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112263 — Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows att… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112264 — BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attacke… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112287 — Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailControlle… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112149 — A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a4873… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112150 — A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112151 — A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a4873… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-107567 — Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-107569 — Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a r… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-107571 — Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 throug… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-109431 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulne… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-111045 — CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink po… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112152 — A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112153 — A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112304 — docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() tha… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112305 — Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with t… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-112306 — NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112307 — sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject P… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112308 — crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapin… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112309 — @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauth… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112366 — Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows at… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112368 — An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2025-10149 — The SCIM endpoint does not sufficiently validate authorization for federated users when performing o… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-107186 — An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the n… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-107187 — A user can access any database details, such as usernames and passwords by sending a DWR request wit… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-10572 — IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-10743 — IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to i… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-12148 — IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially ex… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-12665 — IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when p… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-6930 — IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2025-52290 — A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-11… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-111759 — markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, spe… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112377 — CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence… | vulnerability | nvd | ransomware | 2026-10-19 | | high | CVE-2026-3295 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑su… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112252 — A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112260 — A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a hea… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112770 — Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-112772 — Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authen… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-112774 — Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authen… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-112775 — Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attac… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112777 — Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() f… | vulnerability | nvd | rce | 2026-10-19 | | high | CVE-2026-112780 — Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112782 — Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-71169 — Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-71170 — Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerabi… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-82166 — Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical F… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112301 — A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-76788 — The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes r… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-105814 — TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafte… | vulnerability | nvd | botnet | 2026-10-19 | | high | CVE-2026-105815 — TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through una… | vulnerability | nvd | botnet | 2026-10-19 | | high | CVE-2026-112257 — A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112258 — A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list wh… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112261 — A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-112360 — A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the f… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-53995 — MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend… | vulnerability | nvd | | 2026-10-19 | | high | CVE-2026-105453 — IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-107366 — IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership ver… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-107400 — IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-109126 — IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-105297 — Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-109440 — LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-109443 — JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated us… | vulnerability | nvd | rce | 2026-10-20 | | high | CVE-2026-109444 — OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-77926 — Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin user… | vulnerability | nvd | rce | 2026-10-20 | | high | CVE-2026-77930 — EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to r… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-77934 — Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-77935 — Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-77937 — Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impe… | vulnerability | nvd | | 2026-10-20 | | high | CVE-2026-105299 — Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream reques… | vulnerability | nvd | | 2026-10-20 | | high | Price Request List #GSGPRO202600197.exe | malware | malware-bazaar | exe | 2026-10-20 | | high | 80330f59bad607ce.js | malware | malware-bazaar | js | 2026-10-20 | | high | export.php | malware | malware-bazaar | ClickFix, Efimer, exe | 2026-10-20 | | high | file | malware | malware-bazaar | dropped-by-Vidar, exe, f7e0bdc53604a00d861131d2693a943c, infostealer | 2026-10-20 | | high | SecuriteInfo.com.Heur.10656.3336 | malware | malware-bazaar | msi | 2026-10-20 | | high | 570e354d.ps1 | malware | malware-bazaar | etherhiding, freight-lure, miner, powershell, telegram | 2026-10-20 | | high | vnc_bootstrap.ps1 | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | main_v4.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | main_v3.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | main_v2.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | main_v1.js | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | hello.hta | malware | malware-bazaar | etherhiding, freight-lure, nodejs, rat, vnc | 2026-10-20 | | high | 0e814f4d934e4a57.bin | malware | malware-bazaar | macho, snowlight | 2026-10-20 | | high | 884c70bde746092d.bin | malware | malware-bazaar | macho | 2026-10-20 | | high | 48e9eab9bb48d75b.bin | malware | malware-bazaar | elf, gafgyt, mirai, botnet | 2026-10-20 | | high | 05ca064a34061e79.bin | malware | malware-bazaar | macho | 2026-10-20 | | high | 92e1930e6de81598.bin | malware | malware-bazaar | elf, Mirai, vshell, botnet | 2026-10-20 | | high | 085dc35f07a9b087.bin | malware | malware-bazaar | elf, Snowlight, vshell | 2026-10-20 | | high | file | malware | malware-bazaar | B, dropped-by-GCleaner, exe, MIX8.file | 2026-10-20 | | high | SecuriteInfo.com.Heur.9029.26114 | malware | malware-bazaar | msi | 2026-10-20 | | high | Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection | threat-intel | otx | tds infrastructure, ultraviewer, cloudflare pages abuse, tech support scams, roi777, hotejka, help tds, ransomware | 2026-10-16 | | high | BREAK THE SILENCE: Tracking Silent Lynx Through Exposed Infrastructure | threat-intel | otx | silent lynx, chvost, laplas, cobalt strike, github staging, pickleshell, ssdpshell, cve-2025-25257, meterpreter, water infrastructure, ligolo-ng, phishing | 2026-10-16 | | high | skynox7: Proxyjacking Edge Devices Into Residential Proxies | threat-intel | otx | bandwidth monetization, proxyjacking, dvr exploitation, cve-2024-3272, cve-2021-44228, cve-2024-3273, edge devices, iproyal, cve-2025-31324, residential proxies, network compromise, pawns.app, ransomware | 2026-10-15 | | high | AI-Powered Espionage Campaign Targets Government Linux Infrastructure | threat-intel | otx | database exfiltration, sysgorat, web shells, linux, cve-2025-55182, ai-generated payloads, cve-2021-4034, espionage, defense evasion, government targeting, rat, proxy backdoor, cve-2025-34035, cve-2022-36553, iot exploitation, edge device targeting, botnet, cve-2024-23625, clingstun, stun abuse, mirai, device persistence, nat traversal | 2026-10-16 | | high | Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus | threat-intel | otx | financial fraud, cofish_ws, iron man, coacev, domain seizure, credential phishing, japanese targets, cogui, chinese-speaking cybercriminals, phishing | 2026-10-14 | | high | Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client | threat-intel | otx | watchguard impersonation, signed installer abuse, fake download site, seo poisoning, credential phishing, browser pop-up, vpn targeting, phishing | 2026-10-13 | | high | WordPress SEO plugin Rank Math compromised to backdoor websites | news | general-news | supply-chain | 2026-10-19 | | high | Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack | news | general-news | supply-chain | 2026-10-17 | | high | GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories | news | general-news | phishing, supply-chain, infostealer | 2026-10-19 | | high | MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon | news | general-news | supply-chain | 2026-10-17 | | high | CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts | news | general-news | ics | 2026-10-14 | | high | Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets | news | general-news | botnet | 2026-10-13 | | high | Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack | news | general-news | supply-chain | 2026-10-19 | | high | MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks | news | general-news | ics | 2026-10-19 | | high | ConnectWise suspends Cloud Backup service after supply chain attack | news | general-news | supply-chain | 2026-10-19 | | medium | Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials | advisory | cisa-advisories | phishing | 2026-10-16 | | medium | CVE-2026-108939 — A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_g… | vulnerability | nvd | botnet | 2026-10-13 | | medium | CVE-2026-108940 — A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the functi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108941 — A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_c… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-17484 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improp… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-17487 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the ret… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-18318 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-18343 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19936 — The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c sha… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19937 — The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19938 — The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_se… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-81858 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of servic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108943 — A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokeniz… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108944 — A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108945 — A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Aff… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-76972 — Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence,… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-76975 — Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could gener… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-76976 — Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89105 — The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accept… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89106 — SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89112 — The admin API endpoint used to retrieve CLA signature records does not consistently enforce the requ… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89116 — The affected code used child_process.execSync with a shell string for generator installation and uni… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89117 — SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89118 — SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources an… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89121 — SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89122 — SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component.… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89124 — Display Product Catalog Based on Customs Declaration application does not perform sufficient authori… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-100755 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-101168 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104661 — GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 bef… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108947 — A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108948 — A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affec… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108954 — A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function Offlin… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108955 — A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-14210 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-14552 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-16275 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-5954 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-6567 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-7767 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-84284 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-92528 — GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 be… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108957 — A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b5… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108958 — A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108959 — A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This imp… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108960 — A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4.… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109786 — In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108961 — A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the fun… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108962 — A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89269 — The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89271 — The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109106 — A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulner… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-103417 — Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109107 — A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109703 — Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-14308 — Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-15399 — The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'co… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-67165 — HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89097 — The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Informati… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103076 — Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration al… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106598 — Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retriev… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108174 — Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploit… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108489 — Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tabl… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108492 — Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108493 — Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocomme… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108496 — Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109143 — A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109684 — Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Config… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109696 — Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiti… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109144 — A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109149 — A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109152 — A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-44414 — A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device K… | vulnerability | nvd | botnet | 2026-10-13 | | medium | CVE-2026-63351 — Affected devices do not properly validate and sanitize visual properties of calculated signals conta… | vulnerability | nvd | phishing, ics | 2026-10-13 | | medium | CVE-2026-63352 — Affected devices do not properly sanitize calculated signal data contained in imported CSV trace fil… | vulnerability | nvd | phishing, ics | 2026-10-13 | | medium | CVE-2026-63355 — Affected devices do not properly sanitize signal names contained in imported CSV trace files before… | vulnerability | nvd | phishing | 2026-10-13 | | medium | CVE-2026-63356 — Affected devices do not properly sanitize calculated signal names contained in imported CSV trace fi… | vulnerability | nvd | ransomware, phishing | 2026-10-13 | | medium | CVE-2026-63357 — Affected devices do not properly sanitize calculated signal data contained in imported calculated si… | vulnerability | nvd | phishing, ics | 2026-10-13 | | medium | CVE-2026-89208 — A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital E… | vulnerability | nvd | botnet | 2026-10-13 | | medium | CVE-2026-109153 — A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.ex… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109155 — A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Mo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109156 — A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_e… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109160 — A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109189 — A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the f… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109190 — A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiT… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109402 — A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.lis… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-89279 — Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encrypti… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-94410 — A low privileged remote attacker is able to view a list of roles that should only be accessible to a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109404 — A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109406 — A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the functi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109706 — Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Fir… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109710 — Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109711 — Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Fir… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109713 — Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109714 — Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158 a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109717 — Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109718 — Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109719 — Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109721 — Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109723 — Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 15… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109724 — Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firef… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109726 — Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109727 — Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ES… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109728 — Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109729 — Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109731 — Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in F… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109732 — Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox E… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109735 — Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thun… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109738 — Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158,… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-109741 — Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109742 — Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Fir… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109748 — Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109751 — Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Fir… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109752 — Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox E… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109765 — Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Fire… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109768 — Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thu… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109769 — Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 1… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109770 — Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109771 — Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109773 — Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109775 — Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109776 — Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109777 — Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109779 — Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thu… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109781 — Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Fi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109833 — A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109976 — A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes wh… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-65131 — NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-67456 — NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A s… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109409 — A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function chi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109677 — FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_Loc… | vulnerability | nvd | rce | 2026-10-13 | | medium | CVE-2026-109678 — FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emul… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109679 — FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109680 — FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line,… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109938 — Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109939 — FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_orde… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109940 — FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109941 — FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109942 — FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/cor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109943 — FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, whic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109944 — FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109945 — FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109946 — FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even befor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109947 — FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that al… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109948 — FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109949 — FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109950 — FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a mali… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109951 — FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCre… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109952 — The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109953 — FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109954 — Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state ac… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109955 — Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109957 — EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authent… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109958 — EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authentica… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109959 — EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109962 — Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller acc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109963 — Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email templa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109964 — ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeI… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109966 — yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-74030 — Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2j… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-74031 — Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-74032 — Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privil… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-74033 — Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-74047 — Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-priv… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-77361 — obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-93346 — Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthe… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-93347 — Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102342 — ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103028 — SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authentica… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107917 — Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107918 — Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-11730 — Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-53711 — MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, t… | vulnerability | nvd | phishing | 2026-10-13 | | medium | CVE-2026-65199 — openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authentic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-77375 — SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-9218 — Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR model… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102672 — Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102734 — asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in astev… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102832 — JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102981 — Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102988 — Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103965 — An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104004 — MongoDB Server's collection validation feature may not properly handle certain expressions stored in… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104005 — A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticate… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105460 — A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109524 — A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-49264 — OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-49265 — OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-79607 — During Xenstore live update the state record for a Xenstore watch with specified watch depth is writ… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-81507 — ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96297 — Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data f… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104126 — JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104250 — The unstructured library provides open-source components for ingesting and pre-processing images and… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106034 — A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106035 — An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before versio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109827 — A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2t… | vulnerability | nvd | botnet | 2026-10-13 | | medium | CVE-2026-109828 — A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchun… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109890 — Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elem… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109896 — Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce downloa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-109898 — Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiti… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-10759 — A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that con… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110098 — Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authentic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110099 — Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeav… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110100 — Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110101 — Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authentic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110103 — bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110104 — Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110105 — B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthentica… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110106 — RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110107 — RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110109 — JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users w… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110113 — PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the Trad… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110114 — FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110117 — SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110118 — WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authentica… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110120 — Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sale… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110121 — PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110125 — Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110126 — waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressCon… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110127 — waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110129 — fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110131 — ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article an… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19939 — The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whene… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19940 — The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/class… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69226 — A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85733 — FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88833 — A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client repla… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88838 — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106170 — An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106171 — A improper neutralization of special elements used in an os command ('os command injection') vulnera… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106172 — A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, Fo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-15577 — A user or service account with read-only access to Git Sync (provisioning) connections can modify a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-33374 — The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing aut… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-93294 — A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Re… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-95502 — A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102186 — Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102187 — Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102188 — Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102198 — Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose info… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102199 — Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102206 — Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102221 — No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102851 — Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a secur… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102865 — Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-102867 — Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103560 — Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103567 — Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103576 — Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS)… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103856 — Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104343 — Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an app… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105006 — Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a phys… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105713 — Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to p… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105719 — Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105726 — Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information local… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-105731 — Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to discl… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107605 — SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Criti… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108127 — Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a networ… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108462 — Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-108466 — Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110209 — Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows au… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110210 — Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110212 — Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authentic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110213 — Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability th… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110217 — Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any au… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110219 — QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote att… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110221 — QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeatu… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110222 — Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110224 — QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfCont… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110226 — QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted ba… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110228 — wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows auth… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110229 — QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110230 — XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated use… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110231 — muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110234 — Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to ove… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110235 — MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write file… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110239 — Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-te… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110240 — Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that m… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110254 — Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-54086 — SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the IS… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-59116 — Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized at… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-62879 — Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-66822 — Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclos… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69506 — Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose informa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69640 — Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69644 — Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69675 — Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69721 — Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69877 — Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69902 — Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69905 — Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform ta… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69914 — Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose info… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69919 — Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose infor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69922 — Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69940 — Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69947 — Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69954 — Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information loc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69967 — Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69968 — Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering o… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69971 — Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69973 — Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69974 — Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69978 — Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69979 — Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-69999 — Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70011 — Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70017 — Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70025 — Use after free in Windows Netlogon allows an authorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70041 — Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information loca… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70044 — Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70055 — Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70057 — Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized att… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70063 — Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70071 — Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70072 — Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70074 — Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70075 — Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70077 — Use after free in Windows Kernel allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70083 — Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70084 — Improper access control in Windows Projected File System allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70085 — Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70087 — Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature loc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70090 — Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70116 — Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70119 — Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70122 — Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an au… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70128 — Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information local… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70135 — Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70137 — Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70141 — Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70148 — Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70162 — A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly han… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70166 — Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70170 — Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70194 — Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a securi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70195 — Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to dis… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70196 — Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service o… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70201 — Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70208 — Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70211 — Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose infor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70216 — Insufficient granularity of access control in Windows Mobile Device Management allows an authorized… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70217 — Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70227 — Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70234 — Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information loc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70235 — Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70244 — Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose information over a netw… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70248 — Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70259 — Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70260 — Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70264 — Improper link resolution before file access ('link following') in Microsoft Defender allows an autho… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70270 — Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70277 — Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70280 — Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70284 — Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to dis… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70288 — Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an author… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-81964 — Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83500 — Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized atta… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83504 — Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83515 — Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83521 — Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information ov… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83565 — Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83571 — Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83573 — Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83582 — Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information loca… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83648 — Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83649 — Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorize… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83651 — Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a net… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83657 — Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perfo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83658 — Improper access control in Windows Error Reporting allows an authorized attacker to disclose informa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83664 — Access of resource using incompatible type ('type confusion') in Windows Portable Device File System… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83667 — Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83668 — Out-of-bounds read in Windows WLAN Service allows an authorized attacker to disclose information loc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83671 — Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83672 — Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83681 — Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locall… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83683 — Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to dis… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83685 — Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a netwo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83695 — Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83703 — Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to deny service over an a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83705 — Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allow… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83713 — Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83714 — Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83719 — Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information lo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83733 — Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83737 — Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83747 — Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83755 — Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83760 — Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose informati… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83764 — Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83765 — Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83766 — Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security featur… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83773 — Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service M… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83774 — Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel S… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83776 — Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileg… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83786 — Generation of error message containing sensitive information in Windows NTFS allows an authorized at… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83787 — Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83788 — Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a phy… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83794 — Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83798 — Improper verification of cryptographic signature in Windows Update Stack allows an authorized attack… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83835 — Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83849 — Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83854 — Improper access control in Windows Notification allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83864 — Improper access control in Windows NTFS allows an authorized attacker to disclose information locall… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83865 — Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform t… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83870 — Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83885 — Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an auth… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83888 — Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83893 — Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83895 — Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elev… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83905 — Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83906 — Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacke… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83907 — Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-83926 — Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-84007 — Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose infor… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-84009 — Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authori… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-84011 — Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security fea… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85320 — Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85323 — Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to per… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85337 — Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85374 — Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locall… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85747 — Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, regis… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85790 — Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85793 — Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Servic… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85794 — Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85805 — Improperly implemented security check for standard in Windows PowerShell allows an unauthorized atta… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85812 — Files or directories accessible to external parties in Windows Bind Filter Driver allows an authoriz… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85816 — Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information ove… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85831 — Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose in… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85840 — Files or directories accessible to external parties in Windows Event Viewer allows an authorized att… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85841 — Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85852 — Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose i… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85857 — Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85859 — Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85865 — Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security fe… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85866 — Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85873 — Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to ele… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85910 — Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85916 — Exposure of private personal information to an unauthorized actor in Azure Active Directory allows a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85935 — Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85938 — Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to discl… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85939 — Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature ove… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-87698 — Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-87709 — Improper access control in Windows Host Guardian Service allows an authorized attacker to perform ta… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-87714 — Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a ne… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88122 — Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88132 — Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information o… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88137 — Files or directories accessible to external parties in WebDAV allows an authorized attacker to discl… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88158 — Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose info… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88162 — Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88167 — Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information ov… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88183 — Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose inform… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88195 — Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information o… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88203 — Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88226 — Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose inform… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-94506 — Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-95630 — Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Secu… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-95904 — Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96204 — Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96206 — Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96218 — Improper access control in Windows Update Stack allows an authorized attacker to perform tampering l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96229 — Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information ov… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96234 — Origin validation error in .NET allows an unauthorized attacker to disclose information over a netwo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96238 — Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96247 — Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96300 — Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96303 — Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized at… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96311 — Improper authorization in Windows Network List Service allows an authorized attacker to perform tamp… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96314 — Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information lo… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96315 — Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96316 — Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized att… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96321 — Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose inform… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-96846 — Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96848 — Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informa… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96850 — Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacke… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96851 — Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96854 — Access of resource using incompatible type ('type confusion') in Windows Device Association Service… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96855 — Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to p… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96857 — Files or directories accessible to external parties in Windows Projected File System allows an autho… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96858 — Missing authentication for critical function in Windows Security Account Manager allows an authorize… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96859 — Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose informatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96860 — Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96863 — Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96865 — Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96910 — Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96921 — Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manag… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96925 — Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose inf… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96935 — Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-96944 — Insertion of sensitive information into externally-accessible file or directory in Windows Storage a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97740 — Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97743 — Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information ove… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97782 — Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampe… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97790 — Improper link resolution before file access ('link following') in Windows Container Isolation FS Fil… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97813 — Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97817 — Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-97828 — Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103850 — Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosur… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103852 — Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103853 — Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensit… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103855 — Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an applicatio… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-106628 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An att… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110082 — Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a l… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-56826 — Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-63147 — Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-100126 — Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-100130 — Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosu… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103822 — Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclos… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103823 — Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103824 — Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-104587 — blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The… | vulnerability | nvd | ransomware | 2026-10-13 | | medium | CVE-2026-105896 — Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an ap… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107369 — The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107370 — When a username for an Active Directory connection is a domain without a local part, the auth0-lock… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-107371 — When the authorize() method is called with a maxAge parameter, the auth0.js library does not validat… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-11713 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege esca… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-14532 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attac… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-14909 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information d… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-19810 — Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cros… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-63156 — Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-67626 — Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-70189 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-77816 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could all… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-78628 — The Okta Credential Provider for Windows does not validate a serialized credential buffer before int… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-78632 — The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-78633 — The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attr… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-79715 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-85473 — The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp,… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88084 — Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-88086 — Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adj… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-94520 — Use of externally-controlled format string in SQL Server allows an authorized attacker to deny servi… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103820 — CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110143 — Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110146 — Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leve… | vulnerability | nvd | phishing | 2026-10-13 | | medium | CVE-2026-110150 — Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a loc… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-110160 — Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attack… | vulnerability | nvd | phishing | 2026-10-13 | | medium | CVE-2026-110170 — Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read… | vulnerability | nvd | | 2026-10-13 | | medium | CVE-2026-103425 — The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' p… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107652 — The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File D… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86573 — Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86607 — Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This is… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-100193 — The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-16495 — The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scrip… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-95807 — The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Sho… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-97020 — The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata'… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-97471 — The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in a… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101926 — The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via t… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-103369 — The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Sto… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110451 — Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110452 — The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110453 — Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by buil… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-46449 — The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege esc… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-50215 — A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Plat… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-50216 — An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extensio… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-50217 — A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-104644 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-104751 — The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check befor… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-105261 — The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-105969 — The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict acce… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-105975 — The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-106098 — The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of i… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-106099 — The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-106166 — The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-106469 — The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its f… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-106646 — The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107158 — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or va… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107160 — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or in… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107178 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery ligh… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107319 — The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verific… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107320 — The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity l… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-108064 — The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on on… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-108069 — The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-110465 — Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authentica… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110466 — Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remot… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-85000 — The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an un… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-85345 — The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-86797 — The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-87843 — The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authent… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-87968 — The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchan… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-87974 — The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its p… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-88927 — The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify tha… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-90989 — The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users wit… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-91076 — The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the auth… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-92409 — The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a s… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-92426 — The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the reque… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-94254 — The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when tot… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-94260 — The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-94261 — The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier b… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-94360 — The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticit… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-96900 — The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownershi… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-96904 — The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to vi… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2025-9373 — The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all v… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-103907 — The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-107650 — The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107756 — The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-107757 — The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-110227 — Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exp… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-100231 — A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing str… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-109969 — A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-109970 — A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-109971 — A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 toke… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73794 — HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG) | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-100229 — A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds wr… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101301 — The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for t… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-103308 — The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of paym… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73795 — A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service. | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73796 — A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query. | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-82844 — The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was comp… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-88998 — The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming paym… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-97315 — The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values s… | vulnerability | nvd | phishing | 2026-10-14 | | medium | CVE-2026-73797 — A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific A… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107417 — Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPre… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107425 — Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107433 — Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-109968 — A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101215 — Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Speci… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101217 — Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathnam… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-104086 — 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 arch… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110652 — ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vuln… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-35161 — Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lock… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-94348 — Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Spec… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101019 — Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backe… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-101025 — Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107381 — svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/Eleme… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110257 — OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBoo… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110258 — OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutine… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110259 — OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmIn… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110260 — OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.compute… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110261 — OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110263 — OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseTyp… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110270 — OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110591 — OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analy… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110593 — BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email C… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110594 — BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that all… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110595 — BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_uplo… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110596 — quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/i… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110597 — Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFro… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110598 — Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value(… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110600 — xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110601 — libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110602 — libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110603 — LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows atta… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110605 — libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash app… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110607 — BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110608 — BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerabilit… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110609 — Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authe… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110610 — ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-modu… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110611 — REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 end… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110613 — youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authen… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110614 — Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110617 — we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/expor… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110619 — frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticate… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110620 — Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetS… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110625 — ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_ar… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110629 — VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows aut… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110630 — VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user mana… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-25946 — When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requ… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-59766 — Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permiss… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-60010 — Gitea's repository-side team-link API allows a repository administrator who is not an organization o… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-60018 — Gitea's OneDev migration downloader reads the entire remote version response into memory without a s… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-60021 — Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not at… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-62925 — Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the deco… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-63021 — Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manife… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-63792 — Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-66849 — Gitea's package registry grants authenticated users read access to packages owned by Limited-visibil… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-66853 — Gitea's user organization-list API includes Limited-visibility organizations for authenticated restr… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-66874 — For pull request events, Gitea reads workflow definitions from the pull request head and posts a syn… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-67577 — Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility chec… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-68957 — Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when ev… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-68964 — Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their w… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-70396 — Gitea's organization repository-creation API requires write:organization but omits the write:reposit… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-70400 — Gitea's repository migration API accepts a public-only token when the request specifies creation of… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-70402 — Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-70406 — Gitea's shared comparison helper omits the token repository-access check used when updating pull req… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-70407 — Gitea's organization-list API does not enforce the read:organization token scope. A token limited to… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-71301 — Gitea's repository markup endpoint resolves same-repository pull request references without enforcin… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73126 — Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73130 — Gitea does not limit the length of the gitignores field accepted by repository-creation forms and th… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73135 — Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73273 — Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcin… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-73814 — Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repos… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-78231 — When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HT… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-78433 — Gitea's web attachment handler skips its cross-repository ownership check for attachments created be… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-95101 — Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module.… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-96615 — Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resou… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-97629 — Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:si… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-100394 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-100404 — Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-109438 — 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory dis… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110654 — libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that al… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110658 — Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse()… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110659 — ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110712 — libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info th… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110713 — libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_i… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110714 — libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110715 — MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototyp… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110716 — unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table()… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110717 — Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-110718 — TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allo… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-62858 — YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_requ… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-76113 — Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86561 — A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-93683 — A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the ho… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101934 — An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved all… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101936 — A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101937 — A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on th… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101938 — An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS a… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101968 — An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101969 — An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101970 — A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101971 — An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol d… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101974 — An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101985 — A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (r… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101987 — An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of J… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101992 — An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper N… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101995 — An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101996 — A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Ev… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101999 — A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO al… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102013 — A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Ju… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102017 — An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Ev… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102018 — A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos O… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102032 — A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper N… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102033 — An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Jun… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102035 — A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS E… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102041 — A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102045 — An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolv… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102047 — An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Net… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102048 — An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Junipe… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102051 — An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of J… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102053 — An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of J… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102054 — An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Ju… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102058 — A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evo… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102060 — A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Serie… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102072 — An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102078 — A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102080 — An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102082 — An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102083 — An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102085 — An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Netw… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102086 — A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Serie… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102087 — An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Junipe… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-75083 — The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-75084 — The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-75085 — The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet le… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-93635 — LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated at… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-101959 — A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protoc… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-103975 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDr… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-107348 — Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.2… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-108151 — Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110777 — A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86566 — A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length i… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86845 — A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session po… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86846 — A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index t… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86847 — A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialize… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86849 — A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missin… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-86856 — A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair c… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102354 — BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloud… | vulnerability | nvd | transport | 2026-10-14 | | medium | CVE-2026-102682 — Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-103974 — lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110248 — Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMake… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110666 — A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the fi… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110763 — lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerabi… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110764 — AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-s… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110765 — FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-110766 — Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated user… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110768 — holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Tele… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110771 — Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated cust… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110772 — Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::Bul… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110773 — GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler th… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110774 — Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allo… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110775 — Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-55167 — LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-82402 — Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can… | vulnerability | nvd | phishing | 2026-10-14 | | medium | CVE-2026-102980 — Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/pla… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-102985 — Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110310 — A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by alter… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110669 — A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function delet… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-55679 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instala… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110689 — A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shou… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110694 — A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110695 — A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110698 — A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_m… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110816 — ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to p… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110807 — A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110829 — FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel w… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110830 — FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a m… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110831 — FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create,… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110832 — FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110833 — FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reas… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110834 — FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malic… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110835 — FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the targe… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110836 — FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() tha… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110855 — GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious reposi… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110860 — GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which chec… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110866 — Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumRele… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110870 — Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its addr… | vulnerability | nvd | ransomware | 2026-10-14 | | medium | CVE-2026-110871 — Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.par… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110872 — Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability… | vulnerability | nvd | | 2026-10-14 | | medium | CVE-2026-110809 — A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issu… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110904 — ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-76656 — A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to ca… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110909 — Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP reques… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-76662 — A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS. | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-76664 — A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operati… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-76666 — A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read. | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110923 — A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a sla… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110925 — A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a n… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110926 — A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share o… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-15180 — The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-17001 — The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Sc… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-18557 — The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Ref… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-78001 — The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerab… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-78087 — The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'lin… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-86803 — The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2025-66272 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-101302 — TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-101308 — When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is no… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-103304 — The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-103324 — The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-104643 — The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106031 — The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a leg… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110933 — Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110934 — Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Mani… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-11905 — The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-24721 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote att… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-76668 — A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-92428 — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a pa… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-108092 — The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2025-23390 — A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-104617 — There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak th… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-104618 — On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. Th… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79823 — HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirabl… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-96614 — "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom… | vulnerability | nvd | phishing | 2026-10-15 | | medium | CVE-2026-17525 — Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79830 — A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which c… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79831 — A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution. | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79836 — A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corrupt… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-8145 — The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-102389 — Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Chec… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106147 — In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListB… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106148 — In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106157 — In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the Pa… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106158 — In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106159 — In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolB… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106160 — In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106161 — In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the B… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106162 — In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the F… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106163 — In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110924 — A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave d… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110927 — A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past t… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106149 — In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attribut… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106150 — In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106151 — In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Va… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106153 — In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar m… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110936 — A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affect… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-46694 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal use… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-46708 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privil… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-55154 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-59994 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthent… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-63130 — EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenti… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-77460 — EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79841 — A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory writ… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-79843 — A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, po… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-95180 — An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sens… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-100347 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationH… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-100348 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can derefe… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-100350 — kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter r… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111092 — In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111096 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was pos… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-58391 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-58392 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS pag… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-58393 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Cli… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-58394 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-58395 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-78850 — An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteCon… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-78851 — Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-102740 — The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously pro… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-103350 — Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rent… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-104266 — tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file con… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106706 — XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code e… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106707 — XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log l… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110367 — Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110371 — Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Explo… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110381 — Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointme… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110888 — Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly C… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110891 — Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-54683 — NL Portal Backend Libraries provide backend components for Dutch government portals that interact wi… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-55453 — OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems.… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-55875 — Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-103083 — Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Adva… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-106701 — ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServe… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-108499 — Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Inc… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-109131 — The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (buil… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-109689 — Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Ex… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-109841 — undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-109924 — undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-109932 — undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110360 — Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110361 — Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110362 — Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payme… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110364 — Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110374 — Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110378 — Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-si… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110874 — Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in funct… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110875 — AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-110876 — AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-110877 — AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110878 — Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authentica… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111123 — FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corr… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-111124 — CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unq… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111125 — CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile d… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111126 — catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of proc… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111127 — catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xls… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111128 — Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111129 — Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111130 — OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that al… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111131 — libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111132 — GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111133 — libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data()… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111134 — libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111135 — libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_valu… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111136 — libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 load… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111137 — libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111138 — NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111139 — NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() tha… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111140 — libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data()… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111141 — zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory(… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111142 — Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111143 — Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111144 — libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin()… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111145 — ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111146 — ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows atta… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111147 — Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111148 — libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-111149 — FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack3… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111150 — ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PC… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111151 — OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass d… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111152 — Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loa… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111153 — Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111154 — libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111155 — libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111156 — libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111157 — SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i(… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111158 — EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111159 — libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attr… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111161 — libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in B… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-111162 — WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseN… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111163 — WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111164 — UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-111165 — libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker load… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111166 — libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader t… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111167 — GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decode… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111168 — LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authent… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111170 — kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111171 — Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulne… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111172 — @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() tha… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111219 — Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.p… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111221 — Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authen… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111222 — Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticate… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111225 — Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.lea… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111227 — Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.ph… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111228 — Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbo… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111230 — Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111232 — Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that all… | vulnerability | nvd | ransomware | 2026-10-15 | | medium | CVE-2026-111233 — Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in fi… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111234 — SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111252 — A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-55840 — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() meth… | vulnerability | nvd | phishing | 2026-10-15 | | medium | CVE-2026-55842 — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguratio… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-57183 — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/m… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-62322 — Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backe… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-92707 — MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing att… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-94621 — AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the Al… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-96449 — Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectl… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-104198 — ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-108435 — Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose i… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-108438 — Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-108454 — Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose informat… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110917 — Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read m… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-110918 — Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111269 — libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111270 — libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111271 — libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::Rea… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111272 — LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111273 — unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111274 — unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/pars… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111275 — nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111278 — NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111284 — Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php t… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111313 — JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-j… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111320 — ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111321 — TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticat… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111323 — RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111324 — rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111330 — JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin c… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111331 — Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router th… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111343 — pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allo… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111344 — APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticate… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111345 — Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111346 — ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111347 — go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository,… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111348 — Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111349 — Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111350 — Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer grou… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111351 — metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestCon… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111353 — Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticate… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111355 — zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authent… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111358 — SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111363 — BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows a… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111364 — MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentCont… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111365 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-super… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111367 — BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenti… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-111368 — ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-92228 — The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-94135 — The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClien… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-96806 — The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked… | vulnerability | nvd | | 2026-10-15 | | medium | CVE-2026-16754 — A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, d… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-16755 — A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Ch… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89057 — A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89062 — A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver th… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-92777 — A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-100159 — The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111212 — A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111237 — A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52… | vulnerability | nvd | botnet | 2026-10-16 | | medium | CVE-2026-111373 — FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111374 — FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111375 — FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL cl… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111376 — FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows cl… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111377 — FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannel… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111383 — Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticat… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111384 — Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager W… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111385 — Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool th… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-111386 — Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111387 — Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111388 — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip a… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-104769 — The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Travers… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111443 — Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test appl… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111449 — Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disab… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-111450 — Wheels through 4.1.1 derives its default production error-email address from the Host header of the… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-77829 — The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89280 — The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Et… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-93535 — The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-101335 — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-103481 — The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-103911 — The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109191 — The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress i… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110019 — The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110721 — The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary c… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111106 — The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-96562 — The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in a… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-100158 — The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-a… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-103480 — The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerab… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-104001 — The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109414 — The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL In… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110017 — The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-12272 — The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-88963 — The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-93767 — The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-103696 — The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before us… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-104755 — The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Pri… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-105973 — The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-105974 — The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-107646 — The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensi… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-107770 — The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization b… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109382 — The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosu… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109982 — The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capab… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110012 — The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking RE… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110013 — The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access to… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110014 — The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization befor… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110179 — The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value aga… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110252 — The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110290 — The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Script… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110366 — Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incor… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110664 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored C… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111178 — The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-15222 — The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-19541 — Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-19798 — The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-19867 — Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-74923 — The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership che… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-91830 — The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-91833 — The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter be… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-92427 — The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the sec… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-100106 — The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-100108 — The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-96870 — The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cr… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-104003 — The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Executio… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-104726 — The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Short… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-15219 — Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Cos… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-15575 — Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Produ… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-93681 — The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cr… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-107649 — The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'even… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109118 — Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-109930 — The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, tre… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110029 — The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX act… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111390 — Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypas… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110896 — Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorre… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110900 — Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorr… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110901 — Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111397 — Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-v… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111409 — Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111555 — A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capa… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-105664 — The endpoint exposes an observable response discrepancy when processing ID values. A request submitt… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110287 — Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allow… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110804 — Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-110806 — Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-90821 — An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller a… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-97858 — An attacker can cause the server to unbind the target device from its current owner and rebind it to… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-107777 — Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authent… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111728 — Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper au… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-54657 — Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 unti… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-55836 — Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 unt… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-55862 — pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multi… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-57447 — Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-96425 — Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-62362 — PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customiza… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-102552 — Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTO… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109461 — Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorize… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-109838 — IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111392 — SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, al… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111603 — PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allo… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-111610 — B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allow… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111611 — roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111614 — DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseControlle… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111615 — Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authen… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111616 — Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111617 — WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111618 — CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the genera… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111619 — FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privil… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111620 — O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111621 — TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authent… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111622 — smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows un… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111623 — Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111625 — 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that all… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111628 — 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111629 — IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any au… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111630 — abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111631 — Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-leve… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111632 — Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated AP… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111635 — Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated view… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111637 — NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated at… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111640 — DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111645 — MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111646 — SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111647 — PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111649 — Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability i… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111651 — Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111652 — Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachm… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111653 — 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated at… | vulnerability | nvd | ransomware, phishing | 2026-10-16 | | medium | CVE-2026-111654 — FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authent… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111656 — ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authen… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111657 — BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsS… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111659 — Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthentica… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111664 — Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileg… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111665 — Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager Langu… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111666 — Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows a… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111667 — REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commen… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111668 — AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py t… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111669 — ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attacke… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111670 — ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports hand… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111672 — Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pi… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111674 — Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated u… | vulnerability | nvd | ransomware | 2026-10-16 | | medium | CVE-2026-111676 — Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticate… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111677 — Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c ca… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111679 — Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authentica… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111682 — EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated lo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111683 — Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111688 — Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111694 — qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remo… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111696 — data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPas… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111697 — HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in th… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111698 — HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp Pay… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111699 — Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticat… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111703 — yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authe… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111705 — Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111707 — 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenti… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111709 — WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerabilit… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111712 — Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unaut… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111713 — tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr res… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111715 — Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111716 — Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employe… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111717 — Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allow… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111718 — AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inj… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111719 — Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111720 — fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery v… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111721 — Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated user… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-80092 — Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attac… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89098 — A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local dom… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-107674 — IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DC… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111793 — Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to re… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-17068 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-17073 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to mis… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-17488 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrict… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-17491 — IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restr… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-85231 — A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by s… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-85977 — A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-108373 — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0,… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-55796 — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1,… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-64862 — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3,… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-96542 — Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (vers… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-62438 — A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose se… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-96628 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-111802 — A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89085 — A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially craft… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89088 — A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-89096 — A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (D… | vulnerability | nvd | | 2026-10-16 | | medium | CVE-2026-107763 — The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111601 — The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scr… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-107752 — The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-109368 — The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-109985 — The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnera… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-109989 — The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_w… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-110268 — The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all v… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111726 — The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible'… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-92715 — The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-103376 — The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authori… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-104122 — The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-104246 — The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature fiel… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-106470 — The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-110527 — The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creat… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-81343 — The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-81344 — The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP cl… | vulnerability | nvd | rce | 2026-10-17 | | medium | CVE-2026-91074 — The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-92432 — The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination be… | vulnerability | nvd | phishing | 2026-10-17 | | medium | CVE-2026-92433 — The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Pat… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-97314 — The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-109983 — The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-110253 — The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable… | vulnerability | nvd | phishing | 2026-10-17 | | medium | CVE-2025-71435 — Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated use… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-110882 — Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notificati… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111885 — phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupC… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111886 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111887 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerabilit… | vulnerability | nvd | ransomware, phishing | 2026-10-17 | | medium | CVE-2026-111889 — phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111890 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserC… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111891 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the g… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111892 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/pas… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111893 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupControl… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111894 — phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting… | vulnerability | nvd | phishing | 2026-10-17 | | medium | CVE-2026-111895 — phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Mic… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111896 — phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111900 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerabi… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111902 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccess… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111903 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSa… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111904 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111905 — phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object ref… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111906 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulner… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111910 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerabili… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111912 — Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in Forum… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111913 — Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenti… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111914 — Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventor… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111916 — Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated a… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111917 — Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attacke… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111918 — Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateT… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111919 — Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111920 — Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_a… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111921 — Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project me… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111922 — Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111928 — Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow ru… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111929 — Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner da… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111930 — Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspac… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111931 — Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that… | vulnerability | nvd | phishing | 2026-10-17 | | medium | CVE-2026-111865 — A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b.… | vulnerability | nvd | | 2026-10-17 | | medium | CVE-2026-111868 — A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function d… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111869 — A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of th… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111870 — A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b1465… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111875 — A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerabilit… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111876 — A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the f… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-109937 — The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL bel… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110026 — The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities whe… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110032 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its s… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110033 — The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image UR… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110035 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endp… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110069 — The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, o… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110070 — The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is author… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110976 — The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111041 — The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI medi… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111877 — A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111942 — A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an un… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-87844 — The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform an… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110365 — Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110880 — Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting In… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110883 — Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Rand… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111984 — A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects th… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111985 — A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the fun… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112002 — ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordContr… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112003 — ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112006 — OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certif… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112007 — Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_so… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112008 — libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that all… | vulnerability | nvd | ransomware | 2026-10-18 | | medium | CVE-2026-112009 — smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() tha… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112010 — smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112011 — libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that al… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112012 — libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_proces… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112013 — libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allow… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112014 — LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to dec… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112016 — Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-d… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112017 — JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers t… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112019 — cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats(… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112020 — LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypes… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111986 — A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112046 — OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-b… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112047 — OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authen… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112048 — libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing at… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112049 — Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_conte… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112051 — Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthentica… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112052 — libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex c… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112053 — Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112054 — Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows atta… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112055 — wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112056 — wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in style… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112057 — libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_cha… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112058 — VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows… | vulnerability | nvd | ransomware | 2026-10-18 | | medium | CVE-2026-112059 — libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader ca… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112060 — librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerab… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112061 — librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode th… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112062 — lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that a… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112063 — libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allo… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111987 — A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by thi… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110024 — @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign an… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111988 — A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unk… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-111991 — A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-104627 — The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assert… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-105661 — Requesting `/{username}/-/repositories` for an individual user instead of an organization made the o… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-105964 — The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a siz… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-107686 — The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locke… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-109844 — `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching witho… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110311 — Creating a draft release through the API returned an `assets` list that was built from a release wit… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110324 — The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-110494 — Adding attachments to a release checked the repository and release of an attachment but not whether… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-97859 — Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, s… | vulnerability | nvd | | 2026-10-18 | | medium | CVE-2026-112027 — A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601ef… | vulnerability | nvd | botnet | 2026-10-18 | | medium | CVE-2026-112028 — A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618… | vulnerability | nvd | botnet | 2026-10-18 | | medium | CVE-2026-112030 — A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112032 — A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util:… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112033 — A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is t… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112034 — A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the fu… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112035 — A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the f… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112036 — A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112040 — A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112043 — A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function c… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112045 — A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDelet… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112073 — A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affec… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112074 — A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6.… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112075 — A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function Fa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112076 — A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability a… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112077 — A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_cor… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112078 — A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impact… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112079 — A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the func… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112080 — A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-106014 — The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-106028 — The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization ch… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-106933 — The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and regi… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112081 — A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112083 — A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function Wei… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112086 — A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-76739 — A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superd… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-89286 — The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-91046 — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-91047 — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict acc… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94273 — The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's respons… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-103311 — The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-106010 — The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on i… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112087 — A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects s… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112088 — A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112089 — A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a4… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-74921 — The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shor… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-74922 — The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unau… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-86791 — The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a pa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94228 — The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its set… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94229 — The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking befor… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94230 — The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94231 — The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94272 — The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommer… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-94294 — The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation befor… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111439 — 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112090 — A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c6… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112091 — A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112092 — A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07e… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112094 — A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the funct… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111438 — 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/… | vulnerability | nvd | botnet | 2026-10-19 | | medium | CVE-2026-112098 — A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of t… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-110898 — Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112100 — A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelin… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112101 — A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected e… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112102 — A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFun… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-78163 — Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Pa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-84176 — Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Ve… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-84178 — Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-84180 — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative c… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-84181 — Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Cam… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85243 — Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. Thi… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85245 — Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85246 — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina comp… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85247 — Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85248 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerab… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85249 — Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Ca… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85254 — Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This is… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85257 — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF compo… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85260 — Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85296 — Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue af… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85300 — Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85301 — Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85312 — Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Ca… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85313 — Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85314 — Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Ca… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85315 — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC comp… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85316 — Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. Th… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-85317 — Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This iss… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-91858 — FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.Transforme… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112107 — A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTens… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112108 — A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112138 — A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::j… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112140 — A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40de… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112210 — A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-110363 — Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111831 — Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting In… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111836 — Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Ex… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111839 — Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-strea… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111845 — Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-produc… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112214 — A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index objec… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-38671 — Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegi… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-110008 — @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the st… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-110902 — Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Ticke… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111828 — Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listin… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111829 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111883 — Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attacke… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111899 — KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111915 — Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote a… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111925 — Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to a… | vulnerability | nvd | ransomware | 2026-10-19 | | medium | CVE-2026-111936 — Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because valida… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111937 — Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111938 — Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111939 — Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticat… | vulnerability | nvd | phishing | 2026-10-19 | | medium | CVE-2026-112144 — A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f4… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112222 — Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configu… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112265 — LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauth… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112266 — SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort ot… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112267 — SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery v… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112268 — sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112269 — SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode regist… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112270 — SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory alloc… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112271 — libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 s… | vulnerability | nvd | ransomware | 2026-10-19 | | medium | CVE-2026-112272 — Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section p… | vulnerability | nvd | ransomware | 2026-10-19 | | medium | CVE-2026-112273 — libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112275 — Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun raste… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112276 — Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows at… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112277 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112278 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112279 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in or… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112280 — libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112281 — libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_h… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112282 — VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point()… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112283 — VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112285 — Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authe… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112286 — Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112289 — Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff user… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112290 — Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 con… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112291 — Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on t… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112293 — BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112294 — FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.count… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112295 — FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated us… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112147 — A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112328 — The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-86375 — Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive D… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-107566 — Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-107568 — Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply a… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-109433 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerabili… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112158 — A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the functi… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112303 — GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112310 — docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attacke… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112363 — Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-13173 — Tokens associated with user sessions are not revoked when the corresponding user session is terminat… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-13591 — The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response wh… | vulnerability | nvd | phishing | 2026-10-19 | | medium | CVE-2025-6623 — The carbon console accepts user-supplied XML input without sufficiently encoding potentially executa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-7043 — The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be t… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-7203 — The Management Console and product files expose sensitive data, including remote log server credenti… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111061 — russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Pr… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112159 — A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an u… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112190 — A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112195 — A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown funct… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-11828 — IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unenc… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-11829 — IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-11831 — IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very li… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-12155 — IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially craft… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-12350 — IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially cra… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-12670 — IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafte… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-12727 — IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-14511 — IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sen… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-15661 — IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-55667 — A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-111757 — Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 un… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112247 — A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Manage… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112248 — A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the fun… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-11319 — TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in… | vulnerability | nvd | ransomware | 2026-10-19 | | medium | CVE-2026-1510 — IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-3161 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that co… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-3628 — IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-4405 — IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by anothe… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-4413 — IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an un… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-4418 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-109434 — Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows re… | vulnerability | nvd | ransomware, phishing | 2026-10-19 | | medium | CVE-2026-112251 — A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRe… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112259 — A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112254 — A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is t… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112297 — A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the func… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112771 — Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass becau… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112781 — Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page edito… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112299 — A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affec… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112300 — A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is th… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112302 — A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function Archiv… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112395 — Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read pa… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-76787 — The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112358 — A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. T… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112361 — A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112396 — Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-36061 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-36069 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2025-36252 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112372 — A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile o… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-19178 — IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to g… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-19595 — The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c v… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-77684 — The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not… | vulnerability | nvd | | 2026-10-19 | | medium | CVE-2026-112373 — A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function… | vulnerability | nvd | | 2026-10-20 | | medium | CVE-2026-109441 — LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' s… | vulnerability | nvd | | 2026-10-20 | | medium | CVE-2026-77938 — Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tool… | vulnerability | nvd | | 2026-10-20 | | medium | payload: undefined | threat-intel | threatfox | Loader, macho, SNOWLIGHT, elf, Vshell, Mirai, cowrie, honeypot, upx, x86, Gafgyt, etherhiding, freight-lure, NodeJS, RAT, VNC, Amos, ClickFix, Foxveil, frame97, macOS, frame, nova, haven, chant, willow, quill, exe, remcos, RemcosRAT, AgentTesla, ps1, Sh, IoT, AUR, CHAOS, DirtyBlanket, linux, systemd-fontd, 0xf00dbeef, CorePayloadManager, Coruna, ios, analystic, DarkSword, GHOSTBLADE, P7, salted-hash, Bashlite, Ngioweb, xorddos, ACR, ACRStealer, fake game, ROM, setup.exe, setup.py, fake game setup, js, QuasarRAT, masslogger, Formbook, asyncrat, cloaked, Dropper, MacSync, dll, Flame, SalatStealer, stealer, cve-2026-96656, miner, plex, Android, GhostBat, ghostx-panel, mParivahan, veltrix, caira, CLOUDHAZE, PageStone, QuartzLine, fake-git, Discord, encrypted, iraenc, gitlab, RUST, IRC, k4_irc_bot, onlycn, ROOTKIT, jar, minecraft, mod, Shell, doc8, python, wraith, RevStealer, HTA, codec-cache, Keylogger, VIPKeylogger, Alien, powershell, UNC7072, auditpolcore, DLL-sideloading, OVH, Python39.rar, DvnX, unpacked, WARDENStealer, YapStealer, rozena, GravityRAT, armv5, DDoS, go, legea, x86_64, MIPS, armv7, mips64, arm64, mipsle, sideloading, Qt5Widgets, TeamSpeak, bingads, Expiro, fba, pdf-suite, UnifyInstaller, dropped-by-OffLoader, acrobat, ppc_free_pdfsuite, puwaders, store-decoy, ChatGPT, CoinMiner, Amadey, FlyLegitBot, Vidar, DDoSAgent, Remus, P2PInfect, appk, sshdkit, SSHDoor, Bobik, clipbanker, 54e64e, dropped-by-amadey, LummaStealer, ZigClipper, dropped-by-RemusStealer, zeus, xmrig, MillenuimRAT, runelure, file-size-evasion, masquerading, terminalfix, token-impersonation, dll-sideloading-adjacent, njrat, arc, 317106, cred.dll, plugin, backdoor, x86-64, ssh-honeypot, shem, mipsel, RustyStealer, BlankGrabber, BlankStealer, Electron-ASAR, ExFiles, flomo-abuse, HijackLoader, infostealer, fake-ai-tool, jcef, crypto-targeting, persistence, token-theft, encrypted-payload, ARM, hajime, Downloader, botnet | 2026-10-20 | | medium | AOMEI Backupper update servers hijacked to push malware: Check your PC | threat-intel | otx | aomei backupper, remote access backdoor, supply chain attack, upgrade-now.exe, update infrastructure compromise, software distribution hijacking, supply-chain | 2026-10-19 | | medium | Plex vulnerabilities being exploited in the wild to drop a cryptominer | threat-intel | otx | cve-2026-96656, cve-2026-96654, proxy, exploitation, myawesomeproxy, xmrig, cve-2026-96652, cve-2026-96655, remote code execution, honeypot, cryptominer, plex, residential ip, rce | 2026-10-19 | | medium | QuartzLine: A working PDF viewer with a backdoor inside | threat-intel | otx | backdoor, ironbark, quartzline, chrome stealer, pdf viewer, cloudhaze, caira, malvertising, botnet | 2026-10-16 | | medium | ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks | threat-intel | otx | m365, service principal, cloud backup, skykick, msp, connectwise | 2026-10-19 | | medium | CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability | threat-intel | otx | rce vulnerability, netscaler, freebsd implant, zero-day exploitation, web shells, cve-2026-88771, zeroday, rce | 2026-10-17 | | medium | YuanKong RAT: the Android remote-control service that stamps its operators' names into every build | threat-intel | otx | overlay-attack, android, adb-escalation, yuankong, botnet | 2026-10-16 | | medium | An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies | threat-intel | otx | iis exploitation, suo5, https tunneling | 2026-10-16 | | medium | The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents | threat-intel | otx | solana, uac bypass, moviereaper, itorrents compromise, blockchain c2, botnet | 2026-09-17 | | medium | Inside a PaperCut Attacker's AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries | threat-intel | otx | pentagi framework, ai-orchestrated exploitation, cve-2026-81578, xml-rpc abuse, reverse socks5, credential harvesting, chisel persistence, active directory compromise, cve-2026-82078, papercut, phishing, rce | 2026-10-15 | | medium | KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | threat-intel | otx | credential theft, hvnc, telegram c2, psychological harassment, bladabindi, remote access trojan, kgb rat, windows, cryptoclipper, lime-worm, maas, njrat, ransomware, botnet, infostealer | 2026-10-15 | | medium | Variola: From ClickFix to a Modular Implant | threat-intel | otx | banking trojan, credential theft, variola, chromium, modular implant, github payload, browser injection, powershell, clickfix, aura stealer, botnet | 2026-10-16 | | medium | Aoki: Infostealer Targets AI Coding Assistant Credentials | threat-intel | otx | api keys, aoki, aokigahara, cryptocurrency wallets, infostealer, ai coding assistant, credential theft, browser data, session tokens, botnet | 2026-10-15 | | medium | Hirudo: From Fake Updates to Patched Banking Apps | threat-intel | otx | device takeover, indonesia targeting, android banking trojan, app patching, hirudo, rat, fake updates, credential theft | 2026-10-14 | | medium | Fake Calendly "Meta Careers" pages steal Facebook and Google logins | threat-intel | otx | calendly spoofing, job scam, 2fa bypass, social engineering, phishing, account takeover, meta impersonation, credential theft, ransomware | 2026-10-14 | | medium | How AI Agents Turned One Exposed Endpoint into a Server Takeover | threat-intel | otx | privilege escalation, ai agents, llm-driven attacks, automated attack execution, cairn orchestration, agentic ai threats, spring batch exploitation, zeroday | 2026-10-15 | | medium | Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | threat-intel | otx | banking fraud, global infrastructure, chinese threat actors, phishing templates, postal impersonation, licensing backend, iron man system, phishing-as-a-service, phaas, phishing | 2026-10-15 | | medium | Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email | threat-intel | otx | phishing email, ftp exfiltration, social engineering, obfuscation, multi-stage loader, infostealer, credential theft, agenttesla, phishing | 2026-10-14 | | medium | 2026 Q3 Linux SSH Server Targeted Malware Statistics Report | threat-intel | otx | libssl2.3.0.so, xhide, fisieredoor, cryptocurrency-mining, rootkit, dictionary-attack, honeypot, xmrig, brute-force, ddos-bot, tsm, shellbot, goauto, ssh, brute force, linux, prometei, mirai, ssh servers, cryptomining, ddos bot, p2pinfect, perlbot, gafgyt, phishing, botnet | 2026-10-14 | | medium | Q3 2026 Statistical Report on Malware Targeting Windows Database Servers | threat-intel | otx | credential theft, ringq, ms-sql, brute-force attacks, fscan, hackbrowserdata, cloudflared, cryptocurrency mining, xmrig, vshell, suo5, web shells, softether, database servers, sharp4webcmd, gotohttp, mysql, botnet | 2026-10-14 | | medium | Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages | news | general-news | phishing | 2026-10-14 | | medium | Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave | news | general-news | phishing | 2026-10-14 | | medium | Yam Store: The Phishing Network Behind a Billion Messages | news | general-news | phishing | 2026-10-14 | | medium | North Korea Phishes Ukrainians for War Intel | news | general-news | phishing | 2026-10-13 | | medium | New Aoki Infostealer Targets AI Coding Assistant Credentials | news | general-news | infostealer | 2026-10-15 | | medium | Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages | news | general-news | phishing | 2026-10-15 | | medium | Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks | news | general-news | phishing | 2026-10-19 | | low | CVE-2026-108942 — A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-58242 — SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-priv… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-100104 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3… | vulnerability | nvd | transport | 2026-10-13 | | low | CVE-2026-103549 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-82632 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-9268 — GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 bef… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-109854 — A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing IS… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-109407 — A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some u… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-107832 — fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-109410 — A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the functio… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-65197 — H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from t… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-65200 — The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bu… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-109526 — A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown functio… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-88834 — A flaw was found in BusyBox's httpd web server. When configured with system password authentication,… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-106175 — A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-106176 — A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unau… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110036 — A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (D… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110214 — Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to fo… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110218 — Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110223 — Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authen… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110225 — Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticate… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110232 — Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP a… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110256 — Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-108388 — Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the a… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110141 — Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-77205 — Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, bu… | vulnerability | nvd | | 2026-10-13 | | low | CVE-2026-110457 — A malicious actor with access to the network and under certain conditions could exploit a Path Trave… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-108066 — The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before re… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-73791 — A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-73792 — A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflo… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-88842 — A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor bet… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110262 — OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons Adv… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110592 — BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template()… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110604 — Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110606 — LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds re… | vulnerability | nvd | botnet | 2026-10-14 | | low | CVE-2026-60008 — Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS clas… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110655 — miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml par… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110657 — Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulner… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110660 — vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 dec… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110661 — CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that a… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110734 — Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110735 — Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/res… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110736 — Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/strin… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-49206 — rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRo… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-77572 — VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier,… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-101946 — An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evo… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-77564 — Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, ta… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-93637 — An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unau… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-103930 — cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream i… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110762 — bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated v… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-82153 — Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Informatio… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110861 — Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/… | vulnerability | nvd | | 2026-10-14 | | low | CVE-2026-110810 — A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-79835 — A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-53575 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authentic… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-55184 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-55876 — Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, t… | vulnerability | nvd | phishing | 2026-10-15 | | low | CVE-2026-111169 — La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-111332 — OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-111354 — crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated memb… | vulnerability | nvd | | 2026-10-15 | | low | CVE-2026-111448 — Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sens… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-109401 — The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-110039 — The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting t… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-110191 — The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capabilit… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-110805 — Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111581 — A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pas… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-109839 — IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions d… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111604 — eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped use… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111609 — PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111624 — Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unau… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111648 — BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows auth… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111655 — ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerabili… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111658 — SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111678 — Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8Chr… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-111714 — tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that al… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-17275 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of d… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-17591 — A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential informa… | vulnerability | nvd | | 2026-10-16 | | low | CVE-2026-92431 — The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its fu… | vulnerability | nvd | | 2026-10-17 | | low | CVE-2026-111888 — phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows deleg… | vulnerability | nvd | | 2026-10-17 | | low | CVE-2026-111926 — Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 who… | vulnerability | nvd | | 2026-10-17 | | low | CVE-2026-111932 — Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains… | vulnerability | nvd | | 2026-10-17 | | low | CVE-2026-111934 — Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware tha… | vulnerability | nvd | | 2026-10-17 | | low | CVE-2026-111874 — A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/… | vulnerability | nvd | botnet | 2026-10-18 | | low | CVE-2026-112004 — Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows a… | vulnerability | nvd | | 2026-10-18 | | low | CVE-2026-112050 — Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote at… | vulnerability | nvd | ransomware | 2026-10-18 | | low | CVE-2026-111993 — A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. I… | vulnerability | nvd | | 2026-10-18 | | low | CVE-2026-97204 — Deleting a label compared the ID of the repository in the request against the organization ID of org… | vulnerability | nvd | | 2026-10-18 | | low | CVE-2026-112026 — A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d… | vulnerability | nvd | botnet | 2026-10-18 | | low | CVE-2026-112029 — A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the… | vulnerability | nvd | | 2026-10-18 | | low | CVE-2026-112031 — A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the func… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112037 — A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112038 — A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112039 — A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affec… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112041 — A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112042 — A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb48… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-110034 — The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when su… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-91831 — The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112095 — A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the fi… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112096 — A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects un… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112097 — A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown pr… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112103 — A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects th… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112105 — A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the functi… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112106 — A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497b… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-111935 — NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysi… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112274 — libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allow… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112284 — libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR()… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112288 — Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112157 — A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted elemen… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112193 — A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of th… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-12660 — IBM MQ Web Console could allow an authenticated administrator to write files outside the intended di… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-12669 — IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malf… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-1501 — IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-3303 — IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacke… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-112249 — A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw… | vulnerability | nvd | | 2026-10-19 | | low | CVE-2026-111766 — markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark pre… | vulnerability | nvd | | 2026-10-19 | | unknown | Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation | advisory | cisa-advisories | | 2026-10-16 | | unknown | CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support | advisory | cisa-advisories | | 2026-10-16 | | unknown | CISA Adds Two Known Exploited Vulnerabilities to Catalog | advisory | cisa-advisories | | 2026-10-16 | | unknown | CISA Adds One Known Exploited Vulnerability to Catalog | advisory | cisa-advisories | | 2026-10-15 | | unknown | CISA Adds Four Known Exploited Vulnerabilities to Catalog | advisory | cisa-advisories | | 2026-10-14 | | unknown | CVE-2026-109758 — Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-75826 — Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 bef… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-101020 — An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD,… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-96535 — Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109162 — Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploa… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-63316 — A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input p… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109763 — Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firef… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109772 — Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109774 — Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixe… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109780 — Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-109782 — Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2025-58771 — AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” b… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2025-58772 — AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2025-58773 — AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local acc… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2025-58774 — AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Leng… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-0893 — AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Infor… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-102250 — CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modifi… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-102603 — Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prio… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-106108 — Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 unt… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-107460 — Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (In… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-12655 — A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change t… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-12656 — A denial-of-service security issue exists in the affected product and version. The security issue st… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-18228 — HyperScale contained a path traversal issue affecting information disclosure. Software customers upg… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-4869 — A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier w… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77090 — CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosur… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77093 — CvFWD contained an integer overflow affecting service availability. Software customers upgrade to re… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77094 — CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77095 — CvFWD contained a null pointer dereference affecting service availability. Software customers upgrad… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77096 — CVFS contained a missing authentication condition affecting command execution. Software customers up… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77099 — CVFS contained an input validation issue affecting command execution. Software customers upgrade to… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-77100 — MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software cus… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-95117 — Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a d… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-95127 — An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outlin… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-97333 — QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgr… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-97334 — The network messaging layer contained improper handling of highly compressed data affecting service… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-101899 — Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios sh… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-102699 — [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-102700 — With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-1… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-102982 — Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-103928 — Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16,… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-54697 — ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-69150 — KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-79608 — The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with o… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-79609 — XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XS… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-79610 — XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operati… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-79611 — For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state w… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-88836 — Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox i… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-53562 — Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. Thi… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-55823 — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in report… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-66057 — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flo… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-104011 — Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-94257. Reason:… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-105445 — An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion f… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-103937 — Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-104817 — Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauth… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-104937 — Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/htm… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-110247 — Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow ch… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-110249 — A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP re… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-75120 — The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-84994 — Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/c… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-86063 — Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin i… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-92088 — Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-110005 — The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS co… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-16753 — Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and inclu… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-84419 — Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-84420 — Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citr… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-84790 — OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a craft… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-104922 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-105390 — Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-15468 — Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allow… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-53563 — Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-53564 — Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconO… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-88964 — An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remot… | vulnerability | nvd | | 2026-10-13 | | unknown | CVE-2026-108473 — Multiple Kasa devices contain an improper authentication vulnerability in the local device-managemen… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-106931 — SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-107153 — Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verif… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-94370 — A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-107171 — An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-103671 — External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 se… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-14851 — A vulnerability relating to the exposure of confidential information in the customer invoicing web a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-101337 — When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-101338 — When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may o… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-101339 — A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-101341 — Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-107913 — Rejected reason: This CVE ID is a duplicate of CVE-2026-39749 and was never published. Both IDs were… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108070 — A vulnerability involving improper access control in the TSplus Remote Access web server that allows… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108071 — Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA)… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108072 — Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autosta… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-85298 — An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runt… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98386 — In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memset_io() t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98387 — In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk r… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98388 — In the Linux kernel, the following vulnerability has been resolved: exec: do_close_on_exec() before… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98389 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip gfx switch_powe… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98390 — In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by ze… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98392 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix tx_… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98393 — In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overfl… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98394 — In the Linux kernel, the following vulnerability has been resolved: af_unix: Return immediately when… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98397 — In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablet… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98398 — In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stal… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98399 — In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dump… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98400 — In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdum… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98401 — In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transpo… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98402 — In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transpo… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98403 — In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98404 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PT… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98405 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bou… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98406 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in se… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98407 — In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98408 — In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98409 — In the Linux kernel, the following vulnerability has been resolved: watchdog: rtd119x: Avoid divisio… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98410 — In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/re… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98411 — In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-poin… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98413 — In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decisio… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98414 — In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root m… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98415 — In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix us… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98416 — In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98417 — In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentabl… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98418 — In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migratio… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98419 — In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98420 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expir… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98421 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer s… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98422 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the AP_VLA… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98423 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: don't hand… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98424 — In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switc… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98425 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98426 — In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak usin… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98427 — In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the drop… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98428 — In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98429 — In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources aliv… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98430 — In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues aliv… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-98431 — In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmap_lock/disas… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-101895 — Angular is a development platform for building mobile and desktop web applications using TypeScript/… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-84471 — The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-100169 — Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102893 — Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenI… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-67414 — RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, de… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-67416 — RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, th… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-105236 — Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-105659 — Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-59951 — The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-94200 — Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3,… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-96596 — Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar m… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-100413 — SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Hel… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102476 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-103414 — The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-103415 — When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second C… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-106464 — `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length -… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-106465 — The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but neve… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-42093 — Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-76083 — Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data sour… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-77371 — Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query r… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-100406 — dbt enables data analysts and engineers to transform their data using the same practices that softwa… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102460 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a s… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102479 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x de… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102748 — Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers admini… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102755 — DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated use… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102899 — Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-104141 — DataEase is an open source data visualization and analysis tool. Authenticated users with datasource… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-109506 — Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0321 — Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated at… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-54566 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, M… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-54701 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, M… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-54702 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0311 — A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0312 — Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthentica… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0313 — A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query conte… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0314 — A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local u… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0315 — A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a lo… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0316 — A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a m… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0317 — A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated use… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0318 — A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Network… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0319 — An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-0320 — A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-102298 — In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permissio… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108335 — When the password reset functionality is enabled, and email is configured, an attacker could take ov… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108336 — When the default self-signed certificate is used, an attacker could gain administrative access to th… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-108337 — An administrator could retrieve the password reset code for any user and take over the account. The… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-107795 — Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce a… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110840 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of t… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110841 — n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, whi… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110842 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP w… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110843 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerabili… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110844 — n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow edito… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110845 — n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerabi… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110846 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoi… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110847 — n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site script… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110848 — n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vuln… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110849 — n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110850 — n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node par… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110851 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create end… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110852 — n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass b… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110853 — n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110854 — Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sendi… | vulnerability | nvd | | 2026-10-14 | | unknown | CVE-2026-110912 — In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (s… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-93483 — In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthori… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-93484 — Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplie… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2025-29895 — A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote atta… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2025-29897 — A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2025-68403 — An external control of system or configuration setting vulnerability has been reported to affect QuR… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2025-68404 — A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRout… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-19377 — Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle at… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-22896 — A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-24715 — An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, t… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-24718 — A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-39993 — A relative path traversal vulnerability has been reported to affect Download Station. If a remote at… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-41544 — A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a u… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-102475 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provide… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-101287 — Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie n… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-102477 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a g… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-105271 — "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive informatio… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-16436 — Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-16438 — Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and p… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-18661 — In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the J… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-35088 — Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcode… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-63314 — WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_js… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-63315 — WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-75559 — The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-76182 — In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to te… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-76184 — In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attac… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-77711 — When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply w… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-18659 — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-18660 — In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/b… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-18662 — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-19863 — An unauthenticated client may access certain protected resources when using EthereumAuthenticator if… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-19864 — Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-34006 — A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-34007 — An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-34008 — An incorrect permission assignment for critical resource vulnerability has been reported to affect N… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-34009 — An improper isolation or compartmentalization vulnerability has been reported to affect Notes Statio… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-34014 — An incorrect permission assignment for critical resource vulnerability has been reported to affect D… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-39989 — A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-39991 — A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-39997 — A missing authentication for critical function vulnerability has been reported to affect HybridDesk… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-41541 — An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. I… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-41545 — A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker ga… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-47786 — An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited,… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-47790 — A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote at… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-50612 — An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a re… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-50619 — A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability c… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-53882 — An improper link resolution before file access ('link following') vulnerability has been reported to… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-88794 — Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger featu… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-98432 — In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-104024 — Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archiv… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-103508 — P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-103509 — P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-104586 — AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-108082 — Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-109413 — In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-100349 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateRes… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-105474 — A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote au… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-109449 — In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of th… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-52167 — A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-75505 — EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenti… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-88753 — A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/ma… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-97665 — A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an acc… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-97666 — Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-97667 — Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repos… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-97712 — Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to gr… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-102527 — Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-102631 — In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-57568 — Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-57569 — Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-61610 — Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-61838 — Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes albu… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-62679 — Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which ser… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-77466 — Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-77467 — Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-77468 — Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scram… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-77470 — Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop PO… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-104150 — AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-105660 — Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unau… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-108126 — temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encry… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-45165 — An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privi… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-47218 — runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, container… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-63430 — ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.… | vulnerability | nvd | | 2026-10-15 | | unknown | CVE-2026-105227 — This vulnerability allows remote attackers to disclose sensitive information on affected installatio… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-109812 — A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa'… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-109813 — A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's indus… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-111442 — Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploa… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-111458 — The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting F… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-101300 — Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of We… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-111472 — An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-106030 — NordVPN for Windows allows local attackers to stop unprotected Windows system services and change th… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-14452 — Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-63619 — Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough a… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-64610 — Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could h… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-64959 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authen… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-111593 — Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips f… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2025-52097 — Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-26846 — Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attac… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-55543 — TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set g… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-95859 — libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-86009 — Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61b… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2025-55640 — A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allo… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2025-55653 — GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2025-66969 — Integer overflow in OpenModSim (<=1.11.0), leading to denial of service | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-108709 — Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services tha… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-68572 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-68573 — Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cle… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-69076 — Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the k… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-69077 — Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most t… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-69080 — Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affect… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-96620 — Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to t… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-108372 — Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loo… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110752 — Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110753 — Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110754 — Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110755 — Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110756 — Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110757 — Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110758 — Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_w… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-110759 — Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty… | vulnerability | nvd | | 2026-10-16 | | unknown | CVE-2026-111997 — ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-78497 — JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98433 — In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98434 — In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in proc_doin… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98435 — In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98436 — In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device bu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98437 — In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime P… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98438 — In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98439 — In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async request… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98440 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98441 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifyi… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98442 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UA… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98443 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer hand… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98444 — In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98445 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures l… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98446 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go n… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98447 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98448 — In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98449 — In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mid… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98450 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed cre… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98451 — In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open(… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98452 — In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cac… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98453 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98454 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98456 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in rea… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98457 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98458 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused C… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98459 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the pare… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98460 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98461 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate ev… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98462 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hol… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98463 — In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKE… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98464 — In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98465 — In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC att… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98466 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp sta… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98468 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98469 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR<… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98470 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unk… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98471 — In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98472 — In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have_run_cpus dur… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98473 — In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and p… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98474 — In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device loc… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98475 — In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physica… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98476 — In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer deref… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98477 — In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx pass… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98478 — In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal c… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98479 — In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the da… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98480 — In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on sta… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98481 — In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whos… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98482 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/R… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98484 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expir… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98485 — In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: fix zero-add… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98486 — In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer l… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98487 — In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port g… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98488 — In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98489 — In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98490 — In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98491 — In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98492 — In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coheren… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98493 — In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98494 — In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on ou… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98495 — In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98496 — In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_wor… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98497 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPse… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98498 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry referenc… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98499 — In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in waco… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98500 — In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98501 — In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98502 — In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98503 — In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98504 — In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus prope… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98505 — In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98506 — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve giga… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98507 — In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier bet… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98509 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98512 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the schedu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98513 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98514 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference l… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98516 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge referenc… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98517 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nou… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98518 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for t… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98520 — In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free a… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98521 — In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU tear… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98522 — In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98523 — In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of parti… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98524 — In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98525 — In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98526 — In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98527 — In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98528 — In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack lea… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98529 — In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM le… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98530 — In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98531 — In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribut… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98532 — In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr()… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98533 — In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98534 — In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when aud… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98535 — In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98536 — In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU qu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98537 — In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98538 — In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98539 — In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use d_instantiate_new(… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98540 — In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph_dat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98541 — In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU_ATTR_IPP… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98542 — In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR_NOCPU… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98543 — In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98544 — In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm dur… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98545 — In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98546 — In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98547 — In the Linux kernel, the following vulnerability has been resolved: af_packet: fix integer overflow… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98548 — In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the pa… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98549 — In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs acr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98550 — In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpec… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98551 — In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries w… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98552 — In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98553 — In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file refer… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98554 — In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98555 — In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on ll… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98556 — In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets wit… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98557 — In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98558 — In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in de… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98559 — In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list tra… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98560 — In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's pat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98561 — In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under t… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98562 — In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx time… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98563 — In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY onl… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98564 — In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98565 — In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL deref… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98566 — In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98567 — In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98568 — In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98569 — In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98570 — In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98571 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->pa… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98572 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98573 — In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound unde… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98574 — In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI befo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98575 — In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn53… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98576 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bound… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98577 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98578 — In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98579 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list le… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98580 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98581 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption /… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98582 — In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98583 — In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper co… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98584 — In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98585 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98586 — In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport bef… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98587 — In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transit… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98589 — In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mut… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98590 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code g… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98591 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-ba… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98592 — In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descript… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98593 — In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer der… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98594 — In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98595 — In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socke… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98597 — In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receiv… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98598 — In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6_insert_excepti… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98599 — In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98600 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98601 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98602 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-boun… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98603 — In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98604 — In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98605 — In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98606 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM obje… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98607 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98608 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in v… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98609 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98610 — In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: bound the c… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98611 — In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before re… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98612 — In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX pac… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98613 — In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth throu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98614 — In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98615 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE al… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98616 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num_napi when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98617 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue nap… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98618 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum stand… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98619 — In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98620 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unre… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98621 — In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98622 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98623 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98625 — In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98626 — In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98627 — In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer cla… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98628 — In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification inst… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98629 — In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix manual h… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98630 — In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page poo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98631 — In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98632 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98633 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb le… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98634 — In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98635 — In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98636 — In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size ra… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98637 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98638 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vec… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98639 — In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98640 — In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR s… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98641 — In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame poi… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98642 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent c… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98643 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of r… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98644 — In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98646 — In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98647 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_s… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98648 — In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98649 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in _destroy_… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98650 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98651 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98652 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in k… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98653 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98655 — In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98656 — In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_wo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98657 — In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98658 — In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98659 — In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Retu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98660 — In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98661 — In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix in… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98662 — In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98663 — In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprote… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98664 — In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprote… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98665 — In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98666 — In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprot… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98667 — In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98668 — In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffe… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98669 — In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer te… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98670 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98671 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98672 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possibl… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98673 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: pac1934: check ACPI la… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98674 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Initializ… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98675 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98676 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL poin… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98677 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix us… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98678 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid ov… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98679 — In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject d… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98680 — In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Preve… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98681 — In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98682 — In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98683 — In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data be… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98684 — In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit da… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98685 — In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pa… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98687 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XD… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98688 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereferenc… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98689 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP t… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98690 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain referenc… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98692 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98693 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router refer… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98694 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98695 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup ra… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98696 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregist… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98697 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driv… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98698 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FIL… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98699 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xm… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98700 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info->band f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98701 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh pat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98702 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 3… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98703 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: val… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98704 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback as… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98705 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy pa… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98706 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS deliver… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98707 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98708 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98709 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only match… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98710 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPRO… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98711 — In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98712 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcoun… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98713 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grain… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98714 — In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98715 — In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98716 — In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98719 — In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98720 — In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98721 — In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initializ… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98722 — In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98723 — In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98724 — In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98725 — In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds wr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98726 — In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98727 — In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZON… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98728 — In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds chec… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98729 — In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va_align to… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98730 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98731 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix ple… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98732 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98733 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98734 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize S… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98735 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize A… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98736 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98737 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98738 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98739 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial p… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98740 — In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from EC… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98742 — In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98743 — In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98744 — In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix unin… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98745 — In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98746 — In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock refere… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98747 — In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer d… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98748 — In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-af… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98749 — In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98750 — In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset rac… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98751 — In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on h… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98752 — In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhan… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98753 — In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ER… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98754 — In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when cl… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98755 — In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize contro… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98756 — In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer der… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98757 — In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98758 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98759 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitiali… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98763 — In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98764 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL poin… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98765 — In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98766 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98767 — In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98768 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the I… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98769 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: vali… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98770 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98771 — In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98772 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98773 — In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98774 — In the Linux kernel, the following vulnerability has been resolved: rust_binder: cancel deferred wor… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98777 — In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98778 — In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98779 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device l… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98781 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98783 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing IS_ERR… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98784 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware le… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98787 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration prote… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98788 — In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-afte… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98789 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free_b… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98790 — In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf_even… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98791 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF_XDP TX timesta… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98792 — In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98793 — In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid N… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98794 — In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98795 — In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98796 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: allo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98797 — In the Linux kernel, the following vulnerability has been resolved: net: cap skb->queue_mapping when… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98798 — In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL derefere… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98799 — In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in tram… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98801 — In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_RESERVE_MEM to… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98802 — In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writ… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98803 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gath… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98804 — In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-fr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98805 — In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98806 — In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assi… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98807 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98808 — In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer over… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98809 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98810 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98811 — In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an e… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98812 — In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev o… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98813 — In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98814 — In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log li… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98816 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98817 — In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pm_runtim… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98818 — In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd i… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98819 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98820 — In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF_USE_SCHED when t… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98821 — In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with us… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98822 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98823 — In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98824 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX stat… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98825 — In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_cl… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98826 — In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider u… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98827 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggreg… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98828 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI co… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98829 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized f… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98830 — In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read len… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98831 — In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98832 — In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in bl… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98833 — In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() wi… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98834 — In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98835 — In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix a… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98837 — In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the inpu… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98839 — In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned unde… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98840 — In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer bef… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98841 — In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver_data b… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98842 — In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98843 — In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps fo… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98844 — In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98845 — In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key nam… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98846 — In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after t… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98847 — In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98848 — In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before a… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98849 — In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on net… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98850 — In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98851 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: dro… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98852 — In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detectio… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98853 — In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98854 — In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positiv… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98855 — In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on dead… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98856 — In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes wh… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98857 — In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98858 — In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98859 — In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the releas… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98860 — In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t w… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98861 — In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guard(rcu_sched_notr… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98862 — In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98863 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STA… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98864 — In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DIS… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98865 — In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't run ops.dequeue… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-98866 — In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_stru… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-107618 — `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-112111 — The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id at… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-112112 — An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established… | vulnerability | nvd | | 2026-10-18 | | unknown | CVE-2026-102503 — Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /l… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-103091 — Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188)… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108120 — Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs f… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108121 — Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functional… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112161 — MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first veri… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112178 — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The author… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112179 — In MISP, the event synchronization process contained a logic error in the preparation of event repor… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112180 — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, sever… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-13695 — SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec applic… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108762 — Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin se… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108764 — Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job servi… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108766 — Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin service… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108771 — Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apach… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108780 — Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, u… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108823 — Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin.… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108833 — Default startup profile miss security settings in Apache Kylin. Any deployment has security setting… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-108837 — Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacke… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112183 — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user preview… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112184 — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface.… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112188 — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated u… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112192 — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds mo… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-64945 — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question oper… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-67249 — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification co… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-68482 — Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-76994 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issu… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-79613 — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated att… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-79620 — Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue af… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-79624 — Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: th… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-79633 — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorizati… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-86589 — Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affe… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-71253 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-8168 — Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt al… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-107081 — SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJA… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111046 — FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasMan… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111053 — FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the un… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-12254 — Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Clie… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-103038 — PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-107082 — Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perf… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111063 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111064 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, kee… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111065 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111066 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.1… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111748 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111749 — AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Hos… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2025-55654 — A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2025-60480 — A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-105810 — Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-107084 — Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) a… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111755 — follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. Fr… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-55644 — Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2025-60482 — A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110672 — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a dupl… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110673 — Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110674 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowin… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110675 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys un… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110676 — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110677 — Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key val… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110678 — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental inpu… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110680 — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared h… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110681 — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser ob… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110682 — Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110684 — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110685 — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110686 — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itse… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110687 — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-110688 — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112768 — Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target accou… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112769 — Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112778 — Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Servi… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-111946 — Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the d… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112390 — Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112391 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recu… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112393 — Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and s… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112394 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read pa… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112392 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference inv… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112397 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112398 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write d… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112399 — Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal ba… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112400 — Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112401 — Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112402 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when Imagin… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112403 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width sc… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112404 — Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode path… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112405 — Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112406 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112891 — Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112892 — Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a s… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112893 — Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph point… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112894 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112895 — Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while pars… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112896 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMa… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112897 — Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112898 — Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112900 — Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument inject… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112901 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to reg… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-112991 — The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF)… | vulnerability | nvd | | 2026-10-19 | | unknown | CVE-2026-8355 — IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSR… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-105298 — Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-28850 — An authorization issue was addressed with improved state management. This issue is fixed in visionOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-28853 — The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-28854 — The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Go… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-65356 — An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gat… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-65372 — A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-65379 — The issue was addressed with improved handling of secure input state. This issue is fixed in macOS G… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-65396 — A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden G… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84490 — This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84508 — This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84547 — A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84579 — A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84582 — A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and i… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-84613 — An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86868 — An authentication issue was addressed with improved state management. This issue is fixed in macOS G… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86871 — An integer underflow was addressed with improved input validation. This issue is fixed in macOS Gold… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86872 — A logic issue was addressed with improved state management. This issue is fixed in Safari 27, vision… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86874 — An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27.… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86875 — An input validation issue was addressed with improved input validation. This issue is fixed in Xcode… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86907 — An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86913 — A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86914 — An information disclosure issue was addressed with improved state management. This issue is fixed in… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86915 — A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. A… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86919 — A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and i… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86921 — A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPad… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86922 — A type confusion issue was addressed with improved state management. This issue is fixed in Safari 2… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86928 — A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Ga… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86932 — An authorization issue was addressed with improved state management. This issue is fixed in macOS Go… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86933 — A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86935 — This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Ga… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86940 — This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 2… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86948 — This issue was addressed by enforcing library validation on the affected binaries. This issue is fix… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86955 — An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86957 — An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 a… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86959 — An input validation issue was addressed with improved input validation. This issue is fixed in iOS 2… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86961 — A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86962 — A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 a… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86963 — A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 2… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86975 — An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86977 — An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86979 — A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-86981 — An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in mac… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-102438 — An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execut… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-17518 — Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenti… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-75753 — Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby… | vulnerability | nvd | | 2026-10-20 | | unknown | CVE-2026-80092 Microsoft Identity Web Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-19 | | unknown | Chromium CVE-2026-106258: Uninitialized resource | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106263: Improper input validation | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106264: Missing authorization | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106268: Use after free | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106270: Incorrect authorization | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106274: Incorrect reference resolution | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106276: UI misrepresentation | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106287: Information loss | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106292: Buffer overflow | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106412: Race condition | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106293: Type confusion | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106294: Incomplete cleanup | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106415: Information leak | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106416: Code injection | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106417: Integer overflow | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106420: Incorrect calculation | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106301: Confused deputy | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106303: Observable discrepancy | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106304: Out of bounds read | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106310: Use of released resource | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106311: Clickjacking | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106322: Open redirect | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-110143: Use of uninitialized variable | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106343: Improper state validation | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-110150: Privilege elevation | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106354: Improper resource exposure | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106390: Incorrect provision of specified functionality | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106401: Out of bounds write | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106186: Uncontrolled search path element | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106216: Cross-site request forgery | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-109468 ASP.NET Core Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-70056 Windows Update Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-83518 RPC Runtime Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-83654 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-83708 Windows Installer Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-85377 Windows CD-ROM Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-85790 Microsoft QUIC Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-85822 Windows exFAT File System Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-70170 Windows Kernel Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-87716 Windows Storage Spaces Controller Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-70031 Windows iSCSI Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-96222 Active Directory Federation Services (AD FS) Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-96044 Microsoft Office SharePoint Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-105008 Windows Schannel Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-70162 .NET Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | Chromium CVE-2026-106252: Incorrect comparison | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-109461 Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-70583 Windows Core Messaging Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-65775 Windows Win32k Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-16 | | unknown | CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-108434 Microsoft Office Word Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-108453 Microsoft Office PowerPoint Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-66822 .NET Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-70161 .NET Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-70179 ASP.NET Core Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-70188 ASP.NET Core Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-88175 Microsoft Office Excel Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-96995 Microsoft Office Word Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-96997 Microsoft Office OneNote Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-70281 Microsoft Office Outlook Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-85363 .NET Framework Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-96238 .NET Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-92707 MessagePack-CSharp Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-69366 Windows Kernel Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-68825 Windows Bind Filter Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-77499 Windows DHCP Server Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-72937 Windows Storage Port Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-62697 Windows Push Notifications Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-105723 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-70245 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-85868 Windows Common Log File System Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-102188 Windows Storage Port Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-83943 Azure API Center Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-62688 Windows MIDI Service Module Elevation of Privileges Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-62755 Windows DHCP Client Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-14 | | unknown | ADV260001 ADV260001 Hardening changes for ReFS volumes on removable media | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105725 Windows Security App Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105727 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102229 Visual Studio Code Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102231 Visual Studio Code Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102859 Microsoft Office SharePoint Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102865 Microsoft Office SharePoint Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96183 Windows Health and Optimized Experiences Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-94506 Microsoft Office Access Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97800 Windows Mobile Broadband Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105719 Microsoft SharePoint Server Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105722 Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105726 Microsoft Defender Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70235 Windows Event Tracing Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105731 Microsoft Office Graphics Component Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105732 SysInternals Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-108399 Windows Hyper-V Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-108462 Windows Kernel Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-108464 Software Protection Platform (SPP) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-49785 UEFI Secure Boot Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-72968 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69363 Windows Error Reporting Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70566 Windows Schannel Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-61931 Windows Perception Simulation Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69763 Windows Storage Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69795 Windows Clipboard Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69867 SQLite Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69914 Windows AppX Deployment Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69840 Windows Certificates Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69905 Windows AppX Deployment Service Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69909 Microsoft COM for Windows Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69945 Windows AppX Deployment Extensions Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69950 Windows Overlay Filter Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69954 Windows Overlay Filter Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69963 Kernel Streaming Service Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69968 Windows libarchive Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69971 Windows Kernel-Mode Drivers Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69974 Desktop Window Manager Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69978 Microsoft Windows VMSwitch Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69979 Windows AppX Deployment Service Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70010 Windows NTFS Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70015 Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70017 Windows Secure Kernel Mode Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70021 Windows Direct Composition Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70025 Windows Netlogon Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70026 Windows Secure Kernel Mode Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70027 Windows Subsystem for Linux Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70033 Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70057 Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70059 Windows OLE Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70064 Windows Kerberos Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70079 Windows DNS Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70085 Role: DNS Server Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70087 Role: DNS Server Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70090 Windows Netlogon Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70097 Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70093 Windows Rich Text Edit Control Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70123 Microsoft Graphics Component Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70140 Windows Audio Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70115 Microsoft Windows Search Component Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70132 Windows Portable Device File System Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70135 Windows Remote POS Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70133 Windows SMB Server Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70141 Microsoft Windows Search Component Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70169 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70195 Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70218 Windows StateRepository API Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70223 Windows Console Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70252 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70278 Microsoft Windows Media Foundation Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70280 Windows Hello Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70284 Win32k Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-68836 Windows kernel32.dll Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69644 Windows iSCSI Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-72955 Windows Application Compatibility Cache Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70580 Windows Credential Guard Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69650 Windows Key Distribution Center Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69633 Windows Update Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-81964 Windows Update Orchestrator Service Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-81969 Windows Server Update Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83504 Windows SmartScreen Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83500 Windows BitLocker Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83510 Windows Setup Files Cleanup Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83516 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83515 RPC Runtime Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83521 Windows IKE Extension Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83571 Windows Audio Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83575 Windows Search Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83580 Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83583 Windows Geotag Broker Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83584 Windows Smart Card Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83635 Role: DNS Server Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83641 Windows Media Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83648 Windows Active Directory Domain Services Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83655 Network Policy Server (NPS) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83657 Windows Modern Device Management (MDM) Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83658 Windows Error Reporting Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83666 Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83671 Windows Hyper-V Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83678 Windows TCP/IP Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83681 Microsoft PowerToys Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83687 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83691 Windows DHCP Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83694 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83705 HTTP.sys Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83707 Windows Event Tracing Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83713 Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83715 Windows Error Reporting Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83719 Servicing Stack Updates Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83722 Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83723 Windows Event Logging Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83726 Windows DWM Core Library Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83733 Windows Print Spooler Components Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83740 Windows Hello Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83753 Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83761 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83760 Microsoft Bluetooth Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83776 Windows Bluetooth Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83784 Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83787 Windows DHCP Server Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83793 Windows Update Orchestrator Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83798 Windows Update Stack Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83827 Windows Bluetooth Port Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83832 Windows Spaceport.sys Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83834 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83838 Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83843 Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83849 Windows Hello Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83847 Microsoft Account Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83846 Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83848 Windows COM+ Event System Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83851 Windows Partition Management Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83854 Windows Notification Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83855 Windows WLAN Service Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83864 Windows NTFS Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83865 Windows Internet (wininet.dll) Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83872 Windows TCP/IP Local Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83875 Windows Human Interface Device Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83876 Windows Shell Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83868 Microsoft Bluetooth Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83893 Windows Clipboard User Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70128 HID Parser Library Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70163 Microsoft OpenSSH for Windows Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83909 Windows Win32 Kernel Subsystem Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70248 Windows Hyper-V Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70286 Windows Graphics Component Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83569 HID Parser Library Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83586 Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83741 Internet Explorer Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83769 Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83906 Windows Shell Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83917 Windows ALPC Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83927 Windows Registry Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83932 Windows Group Policy Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84009 Windows Projected File System Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84007 Remote Desktop Gateway Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84011 Windows SMB Client Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84013 Windows Telephony Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84014 Windows Device Association Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84016 Windows EAPHost Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84017 Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84018 Windows Print Spooler Components Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-84020 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85318 Servicing Stack Updates Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85319 Active Directory Federation Services (AD FS) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85322 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85323 Network Device Enrollment Service (NDES) Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85331 Windows Device Association Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85328 Windows Projected File System Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85333 Windows Performance Monitor Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85334 Windows Message Queuing Queue Manager Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85337 Windows Remote Desktop Client Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85341 Windows USB Video Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85357 Windows Phone Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85362 Windows Management Instrumentation Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85367 Windows Cash Drawer Protocol Provider Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85370 WebDAV Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85374 Windows Installer Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85793 Windows Sysmain Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85795 Windows Text Services Framework Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85797 Windows GDI Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85805 Microsoft PowerShell Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85812 Windows Bind Filter Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85816 Windows Wi-Fi Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85820 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85823 Windows Composite Image File System Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85826 Windows Fast FAT Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85829 Windows Wired AutoConfig Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85831 Windows Biometric Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85832 Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85840 Windows Event Viewer Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85842 Windows Image Acquisition Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85846 Web Account Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85849 Windows AppX Deployment Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85851 Windows SmartScreen Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85852 Windows Management Instrumentation Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85860 Windows Message Queuing Queue Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85859 Windows Message Queuing Queue Manager Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85861 Clipboard User Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85864 Python Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-71347 Windows Security Center Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85881 Microsoft Office Graphics Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85891 Azure HDInsight Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85915 Windows PCI Bus Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85920 Windows BitLocker Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88096 Windows DCOM Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88101 Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88158 Microsoft Digest Authentication Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88161 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88162 Windows Encrypting File System (EFS) Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69877 Azure DevOps Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70041 Windows CD-ROM Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70048 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70210 Windows OLE DB Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70216 Windows Mobile Device Management Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70238 Windows Storage Spaces Controller Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70244 Windows DNS Server Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70270 Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70277 Windows Fast FAT File System Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85867 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85914 Windows Embedded Mode Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85916 Azure Active Directory Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85935 Windows USB Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85938 Windows Broadcast DVR User Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85939 Windows Kernel Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87691 Windows Management Services Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87707 Windows Fax and Scan Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87712 Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87714 WebDAV Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88073 Windows Graphics Kernel Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-68883 Microsoft SQL Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88098 Windows Security Support Provider Interface Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88099 Windows Failover Cluster Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88106 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88132 Azure Key Vault Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88137 WebDAV Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88140 Windows Key Storage Provider Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69940 Windows Client for NFS Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69949 Windows Client for NFS Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69977 Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69982 Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70008 Windows IP Over USB Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70011 Windows IP Over USB Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70045 Windows Work Folders Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70137 Windows Remote Access Connection Manager Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70044 Microsoft Windows Media Foundation Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70110 Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70116 Windows Resilient File System (ReFS) Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70149 Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70276 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70049 Microsoft Configuration Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96204 Azure Arc Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96215 Windows Autopilot Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96218 Windows Update Stack Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96220 Windows Assigned Access Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96244 Windows Internal System User Profile Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96246 Network Policy Server (NPS) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96248 Windows Host Guardian Service Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96306 Windows Sysmain Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96311 Windows Network List Service Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96315 Windows Overlay Filter Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96316 Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96319 Windows USB Print Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96318 Windows Resume Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96866 Network Device Enrollment Service (NDES) Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96857 Windows Projected File System Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96859 Windows Imaging Component Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96860 Windows USB Print Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69452 Windows Enterprise App Management Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97782 Microsoft Office SharePoint Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97794 Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-59116 Windows Remote Desktop Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-62879 Windows SmartScreen Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-62687 Windows Backup Engine Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69999 Windows Update Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70055 Windows Cryptographic Services Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70074 Windows DNS Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70075 Windows Virtualization-Based Security (VBS) Enclave Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69736 Windows Credential Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-67626 Microsoft SQL Server Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-67628 Microsoft SQL Server Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69640 Windows Key Distribution Center Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69577 Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-78459 Microsoft Internet Information Services Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83507 Windows Update Orchestrator Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83522 Windows IKE Extension Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83565 Windows Encrypting File System (EFS) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83573 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83582 Windows Graphics Kernel Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83588 Windows USB Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83639 Windows Sensor Data Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83659 Windows User Profile Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83664 Windows Portable Device File System Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83668 Windows WLAN Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83670 Function Discovery Service (fdwsd.dll) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83677 Windows DHCP Client Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83679 Windows Defender Firewall Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83703 Windows Wi-Fi Driver Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83721 Win32k Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83728 Windows Hyper-V Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83765 Windows DWM Core Library Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83763 Windows Input System Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83766 Windows Hyper-V Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83773 Windows MIDI Service Module Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83777 Windows Bluetooth Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83788 Windows rndismp6.sys Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83789 Windows SMB Client Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83791 Windows Virtual Input Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83792 Windows Device Install Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83794 Windows Portable Device MTP Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83835 Windows Common Log File System Driver Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83845 Windows Internet (wininet.dll) Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83860 Windows GDI Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83861 Windows Remote Desktop Protocol Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83870 Windows Aggregated Data Platform Service Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83877 Windows Devices Human Interface Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85872 Windows Storage VSP Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83905 Windows Shell Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85905 Windows UI Immersive Server API Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85910 Windows StateRepository API Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83915 Windows Diagnostic Policy Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-62840 Linux Kernel Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85884 Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85943 Reliable Multicast Transport Driver (RMCAST) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87699 Winlogon Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87709 Windows Host Guardian Service Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87698 Windows Remote Access Service Infrastructure Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88072 Windows Host Guardian Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-87702 Windows Resource Management (MRM) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88127 Windows SMB Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88147 Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88133 Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88193 Microsoft Scripting Engine Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69884 Windows GDI Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85922 Azure Key Vault Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85925 Azure Key Vault Client SDK Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70184 Windows Backup Engine Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70260 Microsoft Trace Data Helper Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-70279 Microsoft Exchange Server Spoofing Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-77910 Microsoft Exchange Server Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-83746 Skype for Business Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88075 Configuration Manager Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88092 ASP.NET Core Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96188 Microsoft PowerToys Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96206 Windows Subsystem for Linux Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96243 Windows WalletService Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96300 RPC Endpoint Mapper Service Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96850 Windows Modern Device Management (MDM) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96858 Windows Security Account Manager Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96912 Windows Client License Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96923 Windows Workstation Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-69675 Windows Network File System Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-85866 Windows ALPC Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-88094 Azure Storage Library Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96944 Windows Storage Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96948 Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97788 Active Directory Federation Services (AD FS) Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97790 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97793 Windows Setup and Deployment Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-96209 Windows Network File System Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102198 Windows Remote Desktop Protocol Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102199 Microsoft Windows Codecs Library Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102204 Microsoft Microsoft Defender for Endpoint Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102206 Windows Portable Device MTP Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102221 Secure Boot Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102220 Windows VHD miniport driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102226 Dynamics Business Central Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-102869 .NET and Visual Studio Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-109453 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-103568 Windows Credential Providers Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-103577 Microsoft QUIC Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105003 HID Class Driver Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-105007 Windows NDIS Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97798 Windows Error Reporting Service Elevation of Privilege Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | ADV990001 Latest Servicing Stack Updates | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97817 Role: DNS Server Information Disclosure Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97830 Windows Internet Information Services Denial of Service Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-108463 Windows SmartScreen Security Feature Bypass Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-97801 .NET Framework Tampering Vulnerability | advisory | vendor-blogs | | 2026-10-13 | | unknown | SSA-580366 V1.2 (Last Update: 2026-10-19): DLL Sideloading Vulnerability in Siemens Software Center | advisory | vendor-blogs | | 2026-10-19 | | unknown | SSA-580366 V1.1 (Last Update: 2026-10-17): DLL Sideloading Vulnerability in Siemens Software Center | advisory | vendor-blogs | | 2026-10-17 | | unknown | SSA-580366 V1.0: DLL Sideloading Vulnerability in Siemens Software Center | advisory | vendor-blogs | | 2026-10-15 | | unknown | The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | advisory | vendor-blogs | | 2026-10-15 | | unknown | Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations | advisory | vendor-blogs | | 2026-10-14 | | unknown | Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities | advisory | vendor-blogs | | 2026-10-13 | | unknown | Arbitrary file write in grpc phQueryMaster | advisory | vendor-blogs | | 2026-10-13 | | unknown | Broken authorization | advisory | vendor-blogs | | 2026-10-13 | | unknown | Double free in signal handler | advisory | vendor-blogs | | 2026-10-13 | | unknown | Fabric API Authentication bypass | advisory | vendor-blogs | | 2026-10-13 | | unknown | GUI Denial of Service | advisory | vendor-blogs | | 2026-10-13 | | unknown | Improper access control and session management in the web management interface | advisory | vendor-blogs | | 2026-10-13 | | unknown | Multiple Arbitrary File Read/Write via SQL Injection | advisory | vendor-blogs | | 2026-10-13 | | unknown | Persistent Denial of Service in Admin Profile | advisory | vendor-blogs | | 2026-10-13 | | unknown | SQL command injection in webmail | advisory | vendor-blogs | | 2026-10-13 | | unknown | arbitrary command execution in fgfmsd daemon | advisory | vendor-blogs | | 2026-10-13 | | unknown | CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-17 | | unknown | CVE-2026-0317 PAN-OS: Denial of Service Vulnerability (Severity: LOW) | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-0320 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-0321 PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-15 | | unknown | CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0314 GlobalProtect App: Local Denial of Service (DoS) on Windows (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (Severity: LOW) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0315 GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0318 PAN-OS: Denial of Service (DoS) on Panorama (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW) | advisory | vendor-blogs | | 2026-10-14 | | unknown | CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability (Severity: MEDIUM) | advisory | vendor-blogs | | 2026-10-14 | | unknown | SD1801 | 1732E ArmorBlock® - Multiple Vulnerabilities | advisory | vendor-blogs | | 2026-10-13 | | unknown | OT Visibility Without the Trade-Off: How Waterfall & Siemens Energy are Securing Critical Infrastructure together | advisory | vendor-blogs | | 2026-10-13 | | unknown | Dispel Zero Trust Engine for OEMs to secure remote industrial service, standardize access, strengthen compliance | advisory | vendor-blogs | | 2026-10-19 | | unknown | Need for enforceable AI accountability, zero-trust security as AI-driven cyber risks threaten critical infrastructure | advisory | vendor-blogs | | 2026-10-19 | | unknown | Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes, putting Internet-facing OT at risk | advisory | vendor-blogs | | 2026-10-19 | | unknown | Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise | advisory | vendor-blogs | | 2026-10-19 | | unknown | Nozomi outlines IT and OT security priorities ahead of India’s April 2027 CEA power sector cybersecurity deadline | advisory | vendor-blogs | | 2026-10-19 | | unknown | Singapore prioritizes critical infrastructure in quantum-safe push, funds cryptographic discovery, legacy OT migration | advisory | vendor-blogs | | 2026-10-16 | | unknown | MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques | advisory | vendor-blogs | | 2026-10-16 | | unknown | French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems | advisory | vendor-blogs | | 2026-10-16 | | unknown | Ampyx Cyber examines FERC 2026 CIP audit findings on generator registration, shared control and AI access risks | advisory | vendor-blogs | | 2026-10-16 | | unknown | Nikkei discloses third data breach in a month, 1.8M records exposed | news | general-news | | 2026-10-19 | | unknown | Hackers hijack AOMEI update servers to secretly spread malware | news | general-news | | 2026-10-19 | | unknown | Bullhorn takes staffing platform offline to contain cyberattack | news | general-news | | 2026-10-19 | | unknown | OpenCode hack exposes API keys amid AI distillation attacks | news | general-news | | 2026-10-19 | | unknown | Microsoft fixes game, app crashes caused by recent Windows update | news | general-news | | 2026-10-19 | | unknown | F5 releases out-of-band patches for critical NGINX vulnerabilities | news | general-news | | 2026-10-19 | | unknown | Microsoft: October Windows Server updates break Exchange sign-in, mail flow | news | general-news | | 2026-10-19 | | unknown | Hackers exploit SiteGuard WAF flaw to run commands as admins | news | general-news | | 2026-10-18 | | unknown | Critical BlockStrap flaw lets hackers run code on Magento servers | news | general-news | | 2026-10-16 | | unknown | Targeted ads installed Candiru spyware in zero-click attacks | news | general-news | | 2026-10-16 | | unknown | Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor | news | general-news | | 2026-10-19 | | unknown | Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor | news | general-news | | 2026-10-19 | | unknown | From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software | news | general-news | | 2026-10-19 | | unknown | Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic | news | general-news | | 2026-10-19 | | unknown | Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers | news | general-news | | 2026-10-19 | | unknown | OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys | news | general-news | | 2026-10-19 | | unknown | ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants | news | general-news | | 2026-10-18 | | unknown | Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants | news | general-news | | 2026-10-17 | | unknown | Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug | news | general-news | | 2026-10-16 | | unknown | Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor | news | general-news | | 2026-10-16 | | unknown | OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract | news | general-news | | 2026-10-16 | | unknown | CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing | news | general-news | | 2026-10-16 | | unknown | PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions | news | general-news | | 2026-10-16 | | unknown | Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory | news | general-news | | 2026-10-15 | | unknown | Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads | news | general-news | | 2026-10-15 | | unknown | Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks | news | general-news | | 2026-10-15 | | unknown | Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early | news | general-news | | 2026-10-15 | | unknown | Why AI Confidence Is Not Validation | news | general-news | | 2026-10-15 | | unknown | GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories | news | general-news | | 2026-10-15 | | unknown | AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches | news | general-news | | 2026-10-15 | | unknown | Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability | news | general-news | | 2026-10-14 | | unknown | Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App | news | general-news | | 2026-10-14 | | unknown | curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution | news | general-news | | 2026-10-14 | | unknown | Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days | news | general-news | | 2026-10-14 | | unknown | Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks | news | general-news | | 2026-10-14 | | unknown | An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. | news | general-news | | 2026-10-14 | | unknown | AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host | news | general-news | | 2026-10-14 | | unknown | Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug | news | general-news | | 2026-10-14 | | unknown | Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another | news | general-news | | 2026-10-13 | | unknown | 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery | news | general-news | | 2026-10-19 | | unknown | ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs | news | general-news | | 2026-10-19 | | unknown | OnlyFans Copyright Takedowns Expose Compromised Websites | news | general-news | | 2026-10-19 | | unknown | The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience | news | general-news | | 2026-10-19 | | unknown | Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk | news | general-news | | 2026-10-16 | | unknown | When AI Agents Commit Breaches, Humans May Not Be Held Liable | news | general-news | | 2026-10-16 | | unknown | AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too | news | general-news | | 2026-10-15 | | unknown | Vulnerability Management Isn't About the Score — It's About How It Applies to You | news | general-news | | 2026-10-15 | | unknown | EU Grocers Pay a Steep Price for Unpatched Fridge Firmware | news | general-news | | 2026-10-15 | | unknown | Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat | news | general-news | | 2026-10-14 | | unknown | Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks | news | general-news | | 2026-10-19 | | unknown | ConnectWise Suspends Cloud Services in Response to Cyberattack | news | general-news | | 2026-10-19 | | unknown | Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure | news | general-news | | 2026-10-19 | | unknown | One Compromised Login Exposed Millions of California Students’ Records | news | general-news | | 2026-10-19 | | unknown | Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack | news | general-news | | 2026-10-19 | | unknown | Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds | news | general-news | | 2026-10-19 | | unknown | Conduent Agrees to Pay $80m to Settle Data Breach Class Action | news | general-news | | 2026-10-19 | | unknown | OpenCode Breach Could Affect OpenAI, Anthropic and Google | news | general-news | | 2026-10-19 | | unknown | ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants | news | general-news | | 2026-10-19 | | unknown | China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns | news | general-news | | 2026-10-16 | | unknown | Cyber Incident at BAE Systems Disrupts US Federal Bankruptcy Noticing | news | general-news | | 2026-10-16 | | unknown | France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack | news | general-news | | 2026-10-15 | | unknown | Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool | news | general-news | | 2026-10-15 | | unknown | ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads | news | general-news | | 2026-10-14 | | unknown | French Supermarket Cyber-Attack Impacts More Refrigeration Controllers | news | general-news | | 2026-10-14 | | unknown | Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs | news | general-news | | 2026-10-14 | | unknown | Billion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched | news | general-news | | 2026-10-14 | | unknown | European Retail Firms Confirm Cyber Incidents | news | general-news | | 2026-10-13 | | unknown | UK Government Announces Sweeping New AI Security Plans | news | general-news | | 2026-10-13 | | unknown | Fifth of CISOs Take Time Off to Avoid Patch Tuesday | news | general-news | | 2026-10-13 | | unknown | ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access | news | general-news | | 2026-10-19 | | unknown | Sweet Security adds one-click protection for vulnerable cloud workloads | news | general-news | | 2026-10-19 | | unknown | Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands | news | general-news | | 2026-10-19 | | unknown | DHS to ban DeepSeek from federal civilian agencies | news | general-news | | 2026-10-19 | | unknown | Cybersecurity incident at BAE Systems disrupts US bankruptcy court system | news | general-news | | 2026-10-16 | | unknown | AdFection: How mercenary spyware invades victims’ devices through targeted advertising | news | general-news | | 2026-10-15 |