| medium |
CVE-2026-28329 — SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF… |
vulnerability |
nvd |
CVE-2026-28329 |
|
2026-10-20 |
| high |
CVE-2026-28328 — SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that… |
vulnerability |
nvd |
CVE-2026-28328 |
|
2026-10-20 |
| high |
CVE-2026-113658 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthentica… |
vulnerability |
nvd |
CVE-2026-113658 |
|
2026-10-20 |
| medium |
CVE-2026-113656 — ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheC… |
vulnerability |
nvd |
CVE-2026-113656 |
|
2026-10-20 |
| medium |
CVE-2026-113655 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated… |
vulnerability |
nvd |
CVE-2026-113655 |
|
2026-10-20 |
| medium |
CVE-2026-113654 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp… |
vulnerability |
nvd |
CVE-2026-113654, CVE-2026-113657, CVE-2026-113661 |
|
2026-10-20 |
| unknown |
CVE-2026-113653 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not… |
vulnerability |
nvd |
CVE-2026-113653 |
|
2026-10-20 |
| medium |
CVE-2026-113652 — ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadf… |
vulnerability |
nvd |
CVE-2026-113652 |
|
2026-10-20 |
| low |
CVE-2026-113651 — ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage… |
vulnerability |
nvd |
CVE-2026-113651 |
|
2026-10-20 |
| medium |
CVE-2026-113650 — ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an… |
vulnerability |
nvd |
CVE-2026-113650 |
|
2026-10-20 |
| medium |
CVE-2026-113505 — A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPane… |
vulnerability |
nvd |
CVE-2026-113505 |
rce |
2026-10-20 |
| medium |
CVE-2026-112958 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-define… |
vulnerability |
nvd |
CVE-2026-112958 |
|
2026-10-20 |
| medium |
CVE-2026-112957 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST… |
vulnerability |
nvd |
CVE-2026-112957 |
|
2026-10-20 |
| medium |
Chrome flags malicious commands that scammers pass off as fixes |
news |
general-news |
|
phishing |
2026-10-20 |
| high |
ConnectWise customers hit by supply-chain attack linked to compromised API secret |
news |
general-news |
|
supply-chain |
2026-10-20 |
| unknown |
CVE-2026-95109 — The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — t… |
vulnerability |
nvd |
CVE-2026-95109 |
|
2026-10-20 |
| unknown |
CVE-2026-95108 — One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two a… |
vulnerability |
nvd |
CVE-2026-95108 |
|
2026-10-20 |
| unknown |
CVE-2026-95107 — A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manage… |
vulnerability |
nvd |
CVE-2026-95107 |
|
2026-10-20 |
| unknown |
CVE-2026-94202 — The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-pa… |
vulnerability |
nvd |
CVE-2026-94202 |
|
2026-10-20 |
| unknown |
CVE-2026-94192 — A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object… |
vulnerability |
nvd |
CVE-2026-94192 |
|
2026-10-20 |
| unknown |
CVE-2026-94024 — The Module Manager's object lookup validated one byte of a memory-protected module's search name and… |
vulnerability |
nvd |
CVE-2026-94024 |
|
2026-10-20 |
| unknown |
CVE-2026-94023 — A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch laye… |
vulnerability |
nvd |
CVE-2026-94023 |
|
2026-10-20 |
| unknown |
CVE-2026-94018 — The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `C… |
vulnerability |
nvd |
CVE-2026-94018 |
|
2026-10-20 |
| unknown |
CVE-2026-93475 — The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verificat… |
vulnerability |
nvd |
CVE-2026-93475 |
|
2026-10-20 |
| unknown |
CVE-2026-93003 — The Web add-on's HTTP server searches the entire request packet for header fields instead of stoppin… |
vulnerability |
nvd |
CVE-2026-93003 |
|
2026-10-20 |
| unknown |
CVE-2026-92853 — The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a contex… |
vulnerability |
nvd |
CVE-2026-92853 |
|
2026-10-20 |
| unknown |
CVE-2026-92843 — A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS… |
vulnerability |
nvd |
CVE-2026-92843 |
|
2026-10-20 |
| critical |
CVE-2026-91057 — `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text… |
vulnerability |
nvd |
CVE-2026-91057 |
ransomware |
2026-10-20 |
| unknown |
CVE-2026-90800 — Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any… |
vulnerability |
nvd |
CVE-2026-90800 |
|
2026-10-20 |
| unknown |
CVE-2026-90799 — Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an… |
vulnerability |
nvd |
CVE-2026-90799 |
|
2026-10-20 |
| unknown |
CVE-2026-90798 — A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allow… |
vulnerability |
nvd |
CVE-2026-90798 |
|
2026-10-20 |
| unknown |
CVE-2026-90797 — An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms… |
vulnerability |
nvd |
CVE-2026-90797 |
|
2026-10-20 |
| unknown |
CVE-2026-86471 — An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows… |
vulnerability |
nvd |
CVE-2026-86471 |
|
2026-10-20 |
| critical |
CVE-2026-113703 — SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authenti… |
vulnerability |
nvd |
CVE-2026-113703 |
|
2026-10-20 |
| medium |
CVE-2026-113683 — VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vuln… |
vulnerability |
nvd |
CVE-2026-113683 |
|
2026-10-20 |
| high |
CVE-2026-113682 — Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicA… |
vulnerability |
nvd |
CVE-2026-113682 |
|
2026-10-20 |
| medium |
CVE-2026-113681 — OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integ… |
vulnerability |
nvd |
CVE-2026-113681 |
|
2026-10-20 |
| medium |
CVE-2026-113680 — HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experime… |
vulnerability |
nvd |
CVE-2026-113680 |
|
2026-10-20 |
| high |
CVE-2026-113679 — HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebA… |
vulnerability |
nvd |
CVE-2026-113679 |
|
2026-10-20 |
| critical |
CVE-2026-113678 — Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStat… |
vulnerability |
nvd |
CVE-2026-113678 |
|
2026-10-20 |
| medium |
CVE-2026-113677 — Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.d… |
vulnerability |
nvd |
CVE-2026-113677 |
|
2026-10-20 |
| medium |
CVE-2026-113676 — Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get A… |
vulnerability |
nvd |
CVE-2026-113676 |
|
2026-10-20 |
| high |
CVE-2026-113613 — FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows r… |
vulnerability |
nvd |
CVE-2026-113613 |
|
2026-10-20 |
| medium |
CVE-2026-113612 — SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated… |
vulnerability |
nvd |
CVE-2026-113612 |
|
2026-10-20 |
| medium |
CVE-2026-113611 — Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted admini… |
vulnerability |
nvd |
CVE-2026-113611 |
|
2026-10-20 |
| medium |
CVE-2026-113610 — Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set… |
vulnerability |
nvd |
CVE-2026-113610 |
|
2026-10-20 |
| low |
CVE-2026-113609 — Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files,… |
vulnerability |
nvd |
CVE-2026-113609 |
|
2026-10-20 |
| medium |
CVE-2026-113608 — Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sq… |
vulnerability |
nvd |
CVE-2026-113608 |
|
2026-10-20 |
| medium |
CVE-2026-113607 — Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability th… |
vulnerability |
nvd |
CVE-2026-113607 |
|
2026-10-20 |
| high |
CVE-2026-113606 — Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenti… |
vulnerability |
nvd |
CVE-2026-113606 |
|
2026-10-20 |