[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-27420 | 8 Oct 2026 | CVSS 6.5 | Katie Seaborn ZotpressImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored… | |
| CVE-2026-42698 | 8 Oct 2026 | CVSS 5.3 | Themeum Tutor LMSConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows… | |
| CVE-2026-16161 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16163 | 8 Oct 2026 | CVSS 8.6 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16164 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16165 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16167 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-15781 | 8 Oct 2026 | CVSS 8.0 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-15784 | 8 Oct 2026 | CVSS 8.1 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-15819 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-15822 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-15824 | 8 Oct 2026 | CVSS 8.2 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16111 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an… | |
| CVE-2026-16159 | 8 Oct 2026 | CVSS 8.6 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-14990 | 8 Oct 2026 | CVSS 9.3 | IBM DataPower Gateway 10.6.0IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed… | |
| CVE-2026-14991 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a… | |
| CVE-2026-15762 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-107613 | 8 Oct 2026 | CVSS 5.9 | GlavSoft TightVNCA NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker… | |
| CVE-2026-107614 | 8 Oct 2026 | CVSS 6.1 | GlavSoft TightVNCAn integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated… | |
| CVE-2026-107615 | 8 Oct 2026 | CVSS 7.8 | GlavSoft TightVNCAn uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute… | |
| CVE-2026-107611 | 8 Oct 2026 | CVSS 7.1 | GlavSoft TightVNCAn out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC… | |
| CVE-2026-107612 | 8 Oct 2026 | CVSS 7.8 | GlavSoft TightVNCIncorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the… | |
| CVE-2026-103663 | 8 Oct 2026 | CVSS 9.4 | OllamaOllama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An… | |
| CVE-2026-104634 | 8 Oct 2026 | CVSS 2.3 | ScriptKittyOS beam_mcpIncorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool… | |
| CVE-2026-62127 | 8 Oct 2026 | CVSS 6.5 | MediaRon LLC WP Plugin Info CardImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card… | |
| CVE-2026-62128 | 8 Oct 2026 | CVSS 5.3 | Creator LMSMissing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-62142 | 8 Oct 2026 | CVSS 8.8 | Melapress WP 2FACross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a… | |
| CVE-2026-66479 | 8 Oct 2026 | CVSS 7.1 | Liquid Web / StellarWP WPCompleteCross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from… | |
| CVE-2026-44031 | 8 Oct 2026 | CVSS 7.5 | OFFIS DCMTKUncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated… | |
| CVE-2026-44033 | 8 Oct 2026 | CVSS 5.5 | OFFIS DCMTKUncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK… | |
| CVE-2026-44034 | 8 Oct 2026 | CVSS 4.4 | OFFIS DCMTKA heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up… | |
| CVE-2026-44035 | 8 Oct 2026 | CVSS 5.5 | OFFIS DCMTKUncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of… | |
| CVE-2026-44036 | 8 Oct 2026 | CVSS 5.5 | OFFIS DCMTKUncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter… | |
| CVE-2026-44037 | 8 Oct 2026 | CVSS 5.5 | OFFIS DCMTKUncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in… | |
| CVE-2026-44038 | 8 Oct 2026 | CVSS 4.4 | OFFIS DCMTKA global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0… | |
| CVE-2026-16178 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16179 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an… | |
| CVE-2026-16181 | 8 Oct 2026 | CVSS 7.4 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16182 | 8 Oct 2026 | CVSS 5.9 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2… | |
| CVE-2026-16340 | 8 Oct 2026 | CVSS 9.8 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-19218 | 8 Oct 2026 | CVSS 9.1 | AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezztaWeak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta… | |
| CVE-2026-106611 | 8 Oct 2026 | CVSS 7.1 | WPMU DEV ForminatorCross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator… | |
| CVE-2026-14521 | 8 Oct 2026 | CVSS 4.9 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to… | |
| CVE-2026-16169 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 11.0.0IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | |
| CVE-2026-16170 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16176 | 8 Oct 2026 | CVSS 7.5 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-16177 | 8 Oct 2026 | CVSS 5.3 | IBM DataPower Gateway 10.6CDIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a… | |
| CVE-2026-105891 | 8 Oct 2026 | CVSS 4.3 | Liquid Web / StellarWP Event TicketsMissing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-105893 | 8 Oct 2026 | CVSS 5.3 | Liquid Web / StellarWP Event TicketsAuthorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating… | |
| CVE-2026-106596 | 8 Oct 2026 | CVSS 5.3 | Visual Composer Website BuilderMissing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-106600 | 8 Oct 2026 | CVSS 5.3 | Liquid Web / StellarWP GiveWPMissing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-106603 | 8 Oct 2026 | CVSS 6.5 | Groundhogg HollerBoxAuthorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-105079 | 8 Oct 2026 | CVSS 6.5 | StylemixThemes MasterStudy LMSImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS… | |
| CVE-2026-105878 | 8 Oct 2026 | CVSS 5.3 | YITH WooCommerce Product BundlesMissing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly… | |
| CVE-2026-105886 | 8 Oct 2026 | CVSS 6.5 | BdThemes Ultimate Post KitMissing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-105887 | 8 Oct 2026 | CVSS 6.5 | Robosoft Robo GalleryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows… | |
| CVE-2026-105888 | 8 Oct 2026 | CVSS 5.4 | Liquid Web / StellarWP Event TicketsMissing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-105890 | 8 Oct 2026 | CVSS 6.5 | Liquid Web / StellarWP Gutenberg Blocks by Kadence BlocksImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by… | |
| CVE-2026-102784 | 8 Oct 2026 | CVSS 8.7 | balbooa.com Gridbox extension for JoomlaJoomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla… | |
| CVE-2026-103070 | 8 Oct 2026 | CVSS 6.5 | ShortPixel Image OptimizerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer… | |
| CVE-2026-103072 | 8 Oct 2026 | CVSS 4.3 | VillaTheme CoreMissing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-105076 | 8 Oct 2026 | CVSS 7.6 | Appsbd ViteposImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL… | |
| CVE-2026-105078 | 8 Oct 2026 | CVSS 6.5 | WP Store LocatorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator… | |
| CVE-2026-102783 | 8 Oct 2026 | CVSS 6.3 | balbooa.com Gridbox extension for JoomlaJoomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its… | |
| CVE-2026-92555 | 8 Oct 2026 | CVSS 9.8 | AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control PanelInsertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX… | |
| CVE-2026-19083 | 8 Oct 2026 | CVSS 8.8 | AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloudAuthorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows… | |
| CVE-2026-107580 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote… | |
| CVE-2026-107581 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length… | |
| CVE-2026-107582 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot… | |
| CVE-2026-107583 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote… | |
| CVE-2026-107584 | 8 Oct 2026 | CVSS 7.4 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC… | |
| CVE-2026-107587 | 8 Oct 2026 | CVSS 5.9 | Progressive Robot Ltd hMailServerImproper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have… | |
| CVE-2026-107573 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerIncorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read… | |
| CVE-2026-107574 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail… | |
| CVE-2026-107575 | 8 Oct 2026 | CVSS 5.3 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated… | |
| CVE-2026-107576 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a… | |
| CVE-2026-107577 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0… | |
| CVE-2026-107578 | 8 Oct 2026 | CVSS 6.7 | Progressive Robot Ltd hMailServerImproper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot… | |
| CVE-2026-107579 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote… | |
| CVE-2026-107275 | 8 Oct 2026 | CVSS 6.8 | @fastify/jwt@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or… | |
| CVE-2026-107570 | 8 Oct 2026 | CVSS 2.5 | muttheap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template. | |
| CVE-2026-107572 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to… | |
| CVE-2026-93509 | 8 Oct 2026 | CVSS 6.5 | Unknown Wallet System for WooCommerceThe Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the… | |
| CVE-2026-104659 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerMissing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer… | |
| CVE-2026-104660 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerMissing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no… | |
| CVE-2026-104671 | 8 Oct 2026 | CVSS 5.3 | Unknown TutorStarterThe TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers… | |
| CVE-2026-104704 | 8 Oct 2026 | CVSS 7.4 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA… | |
| CVE-2026-105190 | 8 Oct 2026 | CVSS 5.3 | Unknown Easy Digital DownloadsThe Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account… | |
| CVE-2026-103649 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerMissing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads… | |
| CVE-2026-104658 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerThe Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by… | |
| CVE-2026-103010 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerHeap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0… | |
| CVE-2026-103011 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerHeap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot… | |
| CVE-2026-103517 | 8 Oct 2026 | CVSS 5.3 | Unknown Airwallex Online Payments GatewayThe Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the… | |
| CVE-2026-103647 | 8 Oct 2026 | CVSS 8.0 | Progressive Robot Ltd hMailServerCross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted… | |
| CVE-2026-107510 | 8 Oct 2026 | CVSS 9.1 | Infoblox NIOSAn authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation. | |
| CVE-2026-107503 | 8 Oct 2026 | CVSS 7.1 | Eclipse Ditto Ditto Explorer UIIn Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto… | |
| CVE-2026-71183 | 8 Oct 2026 | CVSS 7.1 | Apache Software Foundation Apache DolphinSchedulerAn authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized… | |
| CVE-2026-71895 | 8 Oct 2026 | CVSS 7.1 | Apache Software Foundation Apache DolphinSchedulerAn authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for… | |
| CVE-2026-71896 | 8 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache DolphinSchedulerAn authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the… | |
| CVE-2026-89191 | 8 Oct 2026 | CVSS 6.8 | SQLView KRISUnsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard… |
Page 102 of 168