[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-93861 | 8 Oct 2026 | CVSS 6.0 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow… | |
| CVE-2026-93858 | 8 Oct 2026 | CVSS 8.7 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand()… | |
| CVE-2026-93860 | 8 Oct 2026 | CVSS 7.1 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without… | |
| CVE-2026-107696 | 8 Oct 2026 | CVSS 6.5 | FFmpegFFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any… | Fix |
| CVE-2026-107697 | 8 Oct 2026 | CVSS 4.3 | FFmpegFFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions… | Fix |
| CVE-2026-107698 | 8 Oct 2026 | CVSS 5.4 | FFmpegFFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that… | Fix |
| CVE-2026-107702 | 8 Oct 2026 | CVSS 4.3 | Webkul QloAppsQloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted… | |
| CVE-2026-107695 | 8 Oct 2026 | CVSS 6.5 | FFmpegFFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because… | Fix |
| CVE-2026-107378 | 8 Oct 2026 | CVSS 8.7 | CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many… | Fix |
| CVE-2026-107379 | 8 Oct 2026 | CVSS 6.5 | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crashsavg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make… | Fix |
| CVE-2026-107380 | 8 Oct 2026 | CVSS 5.4 | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collisionsavg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion… | Fix |
| CVE-2026-107376 | 8 Oct 2026 | CVSS 8.2 | webonyx graphql-phpwebonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent… | |
| CVE-2026-107377 | 8 Oct 2026 | CVSS 7.5 | datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directorydatamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can… | Fix |
| CVE-2026-107361 | 8 Oct 2026 | CVSS 4.2 | CISA MalcolmThe Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces… | |
| CVE-2026-107362 | 8 Oct 2026 | CVSS 7.1 | CISA MalcolmMalcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream… | |
| CVE-2026-107375 | 8 Oct 2026 | CVSS 8.8 | JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) ApplicationssortJHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until… | Fix |
| CVE-2026-107336 | 8 Oct 2026 | CVSS 6.5 | CISA MalcolmMalcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive… | |
| CVE-2026-107337 | 8 Oct 2026 | CVSS 7.1 | CISA MalcolmThe Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker… | |
| CVE-2026-107302 | 8 Oct 2026 | CVSS 7.5 | msgpack5: Truncated map32 headers throw an unexpected errormsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before… | Fix |
| CVE-2026-107303 | 8 Oct 2026 | CVSS 7.6 | JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin BlobJHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to… | Fix |
| CVE-2026-107332 | 8 Oct 2026 | CVSS 5.5 | aws-toolkit-vscodeInsecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst… | |
| CVE-2026-107333 | 8 Oct 2026 | CVSS 8.1 | CISA MalcolmMalcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC)… | |
| CVE-2026-107334 | 8 Oct 2026 | CVSS 5.4 | CISA MalcolmMalcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin… | |
| CVE-2026-107335 | 8 Oct 2026 | CVSS 6.5 | CISA MalcolmMalcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when… | |
| CVE-2026-50054 | 8 Oct 2026 | CVSS 7.1 | Zimbra Collaboration SuiteAn authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another… | |
| CVE-2026-50055 | 8 Oct 2026 | CVSS 6.5 | Zimbra Collaboration SuiteA policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify… | |
| CVE-2026-61801 | 8 Oct 2026 | CVSS 5.5 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesThe `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions… | Fix |
| CVE-2026-88647 | 8 Oct 2026 | CVSS 6.5 | VulnerabilityA hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications… | |
| CVE-2026-107300 | 8 Oct 2026 | CVSS 7.5 | msgpack5: Many buffered values can exhaust the streaming decoder stackmsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each… | Fix |
| CVE-2026-107301 | 8 Oct 2026 | CVSS 6.5 | msgpack5: Partial options disable prototype protectionmsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object… | Fix |
| CVE-2026-107709 | 8 Oct 2026 | CVSS 7.8 | Bower Decompress-Zip decompress-zipA path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly… | |
| CVE-2026-10631 | 8 Oct 2026 | CVSS 6.5 | Zimbra Collaboration SuiteAn authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS… | |
| CVE-2026-107294 | 8 Oct 2026 | CVSS 6.5 | Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0… | Fix |
| CVE-2026-107295 | 8 Oct 2026 | CVSS 7.6 | Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the… | Fix |
| CVE-2026-107296 | 8 Oct 2026 | CVSS 3.7 | msgpack5: Decoding negative int64 values mutates the input buffermsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the… | Fix |
| CVE-2026-107297 | 8 Oct 2026 | CVSS 5.9 | msgpack5: Quadratic parsing in the streaming decodermsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from… | Fix |
| CVE-2026-107298 | 8 Oct 2026 | CVSS 5.3 | msgpack5: Deeply nested input can exhaust the decoder stackmsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit… | Fix |
| CVE-2026-107299 | 8 Oct 2026 | CVSS 5.9 | msgpack5: Reserved byte can cause unbounded stream bufferingmsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1… | Fix |
| CVE-2026-107290 | 8 Oct 2026 | CVSS 6.5 | Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local… | Fix |
| CVE-2026-107291 | 8 Oct 2026 | CVSS 4.3 | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0… | Fix |
| CVE-2026-107292 | 8 Oct 2026 | CVSS 6.4 | Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and… | Fix |
| CVE-2026-107293 | 8 Oct 2026 | CVSS 5.3 | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1… | Fix |
| CVE-2026-105436 | 8 Oct 2026 | CVSS 8.8 | MainWP ChildDeserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a… | |
| CVE-2026-104077 | 8 Oct 2026 | CVSS 7.8 | Obsidian DesktopObsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting… | |
| CVE-2026-104078 | 8 Oct 2026 | CVSS 7.8 | Obsidian DesktopObsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute… | |
| CVE-2026-95208 | 8 Oct 2026 | CVSS 7.5 | VulnerabilityAn issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service… | |
| CVE-2026-19585 | 8 Oct 2026 | CVSS 5.3 | HashiCorp Shared libraryHashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory… | |
| CVE-2026-107675 | 8 Oct 2026 | CVSS 5.9 | FFmpegFFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers… | Fix |
| CVE-2026-107676 | 8 Oct 2026 | CVSS 3.3 | FFmpegFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes… | Fix |
| CVE-2026-107677 | 8 Oct 2026 | CVSS 4.7 | FFmpegFFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an… | Fix |
| CVE-2026-107678 | 8 Oct 2026 | CVSS 4.7 | FFmpegFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively… | Fix |
| CVE-2026-107288 | 8 Oct 2026 | CVSS 3.7 | pydantic-aiPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local… | Fix |
| CVE-2026-107289 | 8 Oct 2026 | CVSS 6.8 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiersPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0… | Fix |
| CVE-2026-107660 | 8 Oct 2026 | CVSS 4.8 | FFmpegFFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which… | Fix |
| CVE-2026-107287 | 8 Oct 2026 | CVSS 6.5 | Pydantic AI: Excessive resource use when local web fetching converts nested HTMLPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local… | Fix |
| CVE-2026-106177 | 8 Oct 2026 | CVSS 6.4 | HP Inc HP Sure Click EnterpriseA kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP… | |
| CVE-2026-93034 | 8 Oct 2026 | CVSS 9.8 | SGLangSGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via… | |
| CVE-2026-95125 | 8 Oct 2026 | CVSS 6.5 | Vulnerabilitylibming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT… | |
| CVE-2026-9209 | 8 Oct 2026 | CVSS 9.8 | mJobTimemJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the… | |
| CVE-2026-93017 | 8 Oct 2026 | CVSS 7.7 | Red Hat OpenShift Container Platform 4.19The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or… | |
| CVE-2026-14992 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to… | |
| CVE-2026-14999 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14497 | 8 Oct 2026 | CVSS 8.1 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14502 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14507 | 8 Oct 2026 | CVSS 7.7 | IBM DataPower Gateway 11.0.0IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory… | |
| CVE-2026-14508 | 8 Oct 2026 | CVSS 9.1 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14509 | 8 Oct 2026 | CVSS 5.9 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14888 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14905 | 8 Oct 2026 | CVSS 8.2 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to… | |
| CVE-2026-14988 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to… | |
| CVE-2026-12859 | 8 Oct 2026 | CVSS 6.5 | Caz Informatics Services Trade Inc. Advancity ALMS CloudMissing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly… | |
| CVE-2026-13257 | 8 Oct 2026 | CVSS 6.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an… | |
| CVE-2026-13258 | 8 Oct 2026 | CVSS 5.4 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to… | |
| CVE-2026-14269 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a… | |
| CVE-2026-14273 | 8 Oct 2026 | CVSS 6.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14496 | 8 Oct 2026 | CVSS 8.2 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-107639 | 8 Oct 2026 | CVSS 8.8 | ILIAS-eLearning e.V. ILIASILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question… | |
| CVE-2026-107640 | 8 Oct 2026 | CVSS 9.1 | Integrics EnswitchIntegrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated… | |
| CVE-2026-107623 | 8 Oct 2026 | CVSS 4.3 | Red Hat Build of KeycloakA flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel… | |
| CVE-2026-107634 | 8 Oct 2026 | CVSS 6.1 | Aorimn dislockerDislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum… | |
| CVE-2026-107635 | 8 Oct 2026 | CVSS 6.1 | Aorimn dislockerDislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap… | |
| CVE-2026-107636 | 8 Oct 2026 | CVSS 6.5 | ph7software ph7builderpH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain… | |
| CVE-2026-107637 | 8 Oct 2026 | CVSS 4.3 | ph7software ph7builderpH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows… | |
| CVE-2026-107638 | 8 Oct 2026 | CVSS 6.8 | ph7software ph7builderpH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to… | |
| CVE-2026-107589 | 8 Oct 2026 | CVSS 7.5 | Jacamar CIInsufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names. | |
| CVE-2026-107604 | 8 Oct 2026 | CVSS 4.9 | Red Hat Build of KeycloakA flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator… | |
| CVE-2026-107585 | 8 Oct 2026 | CVSS 5.3 | Progressive Robot Ltd hMailServerUncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated… | |
| CVE-2026-107586 | 8 Oct 2026 | CVSS 4.3 | Progressive Robot Ltd hMailServerUncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote… | |
| CVE-2026-107565 | 8 Oct 2026 | CVSS 5.1 | Red Hat Enterprise Linux 10A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key… | |
| CVE-2026-107286 | 8 Oct 2026 | CVSS 7.5 | Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made… | Fix |
| CVE-2026-105829 | 8 Oct 2026 | CVSS 6.1 | thephpleague commonmarkLeague CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the… | |
| CVE-2026-105830 | 8 Oct 2026 | CVSS 7.5 | thephpleague commonmarkleague/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table… | |
| CVE-2026-105831 | 8 Oct 2026 | CVSS 4.3 | espocrmEspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead… | |
| CVE-2026-105832 | 8 Oct 2026 | CVSS 4.3 | espocrmEspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring… | |
| CVE-2026-105833 | 8 Oct 2026 | CVSS 7.7 | espocrmEspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account… | |
| CVE-2026-105828 | 8 Oct 2026 | CVSS 6.3 | parse-community parse-serverParse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error… | |
| CVE-2026-105331 | 8 Oct 2026 | CVSS 5.2 | Checkmk GmbH CheckmkLocal privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent… | |
| CVE-2026-89290 | 8 Oct 2026 | CVSS 3.5 | İzometri IT Services Domestic and Foreign Trade Co. Ltd. eimzamipImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co… | |
| CVE-2026-91844 | 8 Oct 2026 | CVSS 7.3 | İzometri IT Services Domestic and Foreign Trade Co. Ltd. eimzamipUnrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using… | |
| CVE-2026-88257 | 8 Oct 2026 | CVSS 5.3 | ScriptKittyOS beam_mcpImproper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with… |
Page 101 of 168