| medium |
CVE-2026-113355 — Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account admi… |
vulnerability |
nvd |
CVE-2026-113355 |
|
2026-10-20 |
| medium |
CVE-2026-113354 — Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users wit… |
vulnerability |
nvd |
CVE-2026-113354 |
|
2026-10-20 |
| medium |
CVE-2026-113353 — LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor,… |
vulnerability |
nvd |
CVE-2026-113353 |
|
2026-10-20 |
| high |
CVE-2026-113352 — uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitra… |
vulnerability |
nvd |
CVE-2026-113352 |
|
2026-10-20 |
| medium |
CVE-2026-113351 — libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zero… |
vulnerability |
nvd |
CVE-2026-113351 |
|
2026-10-20 |
| medium |
CVE-2026-113350 — react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers… |
vulnerability |
nvd |
CVE-2026-113350 |
|
2026-10-20 |
| medium |
CVE-2026-113349 — OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() a… |
vulnerability |
nvd |
CVE-2026-113349 |
|
2026-10-20 |
| medium |
CVE-2026-112787 — OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest()… |
vulnerability |
nvd |
CVE-2026-112787 |
|
2026-10-20 |
| medium |
CVE-2026-112786 — OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() t… |
vulnerability |
nvd |
CVE-2026-112786 |
|
2026-10-20 |
| medium |
CVE-2026-112785 — OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users t… |
vulnerability |
nvd |
CVE-2026-112785 |
|
2026-10-20 |
| medium |
CVE-2026-112784 — OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php… |
vulnerability |
nvd |
CVE-2026-112784 |
|
2026-10-20 |
| medium |
CVE-2026-112783 — OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and… |
vulnerability |
nvd |
CVE-2026-112783 |
|
2026-10-20 |
| high |
CVE-2026-108089 — ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control… |
vulnerability |
nvd |
CVE-2026-108089 |
|
2026-10-20 |
| unknown |
CVE-2026-108088 — ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apach… |
vulnerability |
nvd |
CVE-2026-108088 |
|
2026-10-20 |
| unknown |
CVE-2026-108087 — ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command (… |
vulnerability |
nvd |
CVE-2026-108087 |
|
2026-10-20 |
| unknown |
CVE-2026-108086 — ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML en… |
vulnerability |
nvd |
CVE-2026-108086 |
|
2026-10-20 |
| unknown |
CVE-2026-108062 — Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so o… |
vulnerability |
nvd |
CVE-2026-108062 |
|
2026-10-20 |
| unknown |
CVE-2026-107597 — PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an… |
vulnerability |
nvd |
CVE-2026-107597 |
|
2026-10-20 |
| critical |
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader |
news |
general-news |
|
apt |
2026-10-20 |
| unknown |
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident |
news |
general-news |
|
|
2026-10-20 |
| unknown |
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw |
news |
general-news |
|
|
2026-10-20 |
| unknown |
CVE-2026-85267 — A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Pl… |
vulnerability |
nvd |
CVE-2026-85267 |
|
2026-10-20 |
| unknown |
CVE-2026-43858 — A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve a… |
vulnerability |
nvd |
CVE-2026-43858 |
|
2026-10-20 |
| unknown |
CVE-2026-43857 — A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with… |
vulnerability |
nvd |
CVE-2026-43857 |
|
2026-10-20 |
| unknown |
CVE-2026-43856 — A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remo… |
vulnerability |
nvd |
CVE-2026-43856 |
|
2026-10-20 |
| unknown |
CVE-2026-43855 — A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve ar… |
vulnerability |
nvd |
CVE-2026-43855 |
|
2026-10-20 |
| unknown |
CVE-2026-43854 — A vulnerability could allow an attacker with access to an encrypted project file to retrieve adminis… |
vulnerability |
nvd |
CVE-2026-43854 |
|
2026-10-20 |
| unknown |
CVE-2026-43853 — A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, cau… |
vulnerability |
nvd |
CVE-2026-43853 |
|
2026-10-20 |
| unknown |
CVE-2026-43852 — A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the s… |
vulnerability |
nvd |
CVE-2026-43852 |
|
2026-10-20 |
| unknown |
CVE-2026-43851 — A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the… |
vulnerability |
nvd |
CVE-2026-43851 |
|
2026-10-20 |
| unknown |
CVE-2026-43850 — A command injection vulnerability could allow an authenticated attacker to achieve root-level code e… |
vulnerability |
nvd |
CVE-2026-43850 |
|
2026-10-20 |
| unknown |
CVE-2026-43849 — A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. |
vulnerability |
nvd |
CVE-2026-43849 |
|
2026-10-20 |
| unknown |
CVE-2026-113468 — The payment notification endpoint for PayPal accepts incoming data without verifying that it comes f… |
vulnerability |
nvd |
CVE-2026-113468 |
|
2026-10-20 |
| unknown |
CVE-2026-113459 — In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend p… |
vulnerability |
nvd |
CVE-2026-113459 |
|
2026-10-20 |
| unknown |
CVE-2026-113442 — Values entered by visitors were placed into the HTML summary email without being escaped. An unauthe… |
vulnerability |
nvd |
CVE-2026-113442 |
|
2026-10-20 |
| high |
CVE-2026-113381 — A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the functio… |
vulnerability |
nvd |
CVE-2026-113381 |
|
2026-10-20 |
| medium |
CVE-2026-113378 — A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown func… |
vulnerability |
nvd |
CVE-2026-113378 |
|
2026-10-20 |
| unknown |
CVE-2026-112240 — The download link for files uploaded through a form relied on a token that could be predicted. The f… |
vulnerability |
nvd |
CVE-2026-112240 |
|
2026-10-20 |
| unknown |
CVE-2026-112239 — The extension provides a backend endpoint that writes a submitted value into a submitted field of a… |
vulnerability |
nvd |
CVE-2026-112239 |
|
2026-10-20 |
| unknown |
CVE-2026-112238 — The file search of the extension builds its database conditions by wrapping the search term in quote… |
vulnerability |
nvd |
CVE-2026-112238 |
|
2026-10-20 |
| unknown |
CVE-2026-112237 — The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one… |
vulnerability |
nvd |
CVE-2026-112237 |
|
2026-10-20 |
| unknown |
CVE-2026-112071 — The order cancellation function accepts an order identifier from the request and acts on that order… |
vulnerability |
nvd |
CVE-2026-112071 |
|
2026-10-20 |
| unknown |
CVE-2026-112070 — The AJAX routes of the extension do not check whether a backend user has access to the related modul… |
vulnerability |
nvd |
CVE-2026-112070 |
|
2026-10-20 |
| unknown |
CVE-2026-112069 — The extension no longer applied its access protection to files in file storages that use a non-defau… |
vulnerability |
nvd |
CVE-2026-112069 |
|
2026-10-20 |
| unknown |
CVE-2026-112068 — The backend module does not check whether a backend user has access to the requested site. Users wit… |
vulnerability |
nvd |
CVE-2026-112068 |
|
2026-10-20 |
| unknown |
CVE-2026-112067 — The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself.… |
vulnerability |
nvd |
CVE-2026-112067 |
|
2026-10-20 |
| unknown |
CVE-2026-112066 — The JSON import of the cookie consent configuration did not respect the backend user's permissions.… |
vulnerability |
nvd |
CVE-2026-112066 |
|
2026-10-20 |
| unknown |
CVE-2026-112065 — The routes that provide consent history and statistics data did not check whether the backend user h… |
vulnerability |
nvd |
CVE-2026-112065 |
|
2026-10-20 |
| unknown |
CVE-2026-112064 — The backend module for reviewing the consent history accepted sorting, grouping and index options fr… |
vulnerability |
nvd |
CVE-2026-112064 |
|
2026-10-20 |
| unknown |
970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach |
news |
general-news |
|
|
2026-10-20 |