[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-12260 | 8 Oct 2026 | CVSS 10.0 | NetBoard CRM Demo PlatformSQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the… | |
| CVE-2026-4894 | 8 Oct 2026 | CVSS 6.9 | Frappe TechnologiesA vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email… | |
| CVE-2026-66082 | 8 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache DolphinSchedulerAn authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules… | |
| CVE-2026-66084 | 8 Oct 2026 | CVSS 8.1 | Apache Software Foundation Apache DolphinSchedulerAn authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not… | |
| CVE-2026-66087 | 8 Oct 2026 | CVSS 8.1 | Apache Software Foundation Apache DolphinSchedulerAn authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not… | |
| CVE-2026-105110 | 8 Oct 2026 | CVSS 9.8 | Iskratel InnboxOS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary… | |
| CVE-2026-107466 | 8 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous… | |
| CVE-2026-93699 | 8 Oct 2026 | CVSS 8.5 | WebPros WP ToolkitArgument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | |
| CVE-2026-87424 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayA vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication… | |
| CVE-2026-87425 | 8 Oct 2026 | CVSS 6.8 | Brocade Active Support Connectivity GatewayAn unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized… | |
| CVE-2026-87426 | 8 Oct 2026 | CVSS 4.3 | Brocade Active Support Connectivity GatewayAn unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the… | |
| CVE-2026-87428 | 8 Oct 2026 | CVSS 7.8 | Brocade Active Support Connectivity GatewayIn Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract… | |
| CVE-2026-85422 | 8 Oct 2026 | CVSS 7.8 | Brocade Active Support Connectivity GatewayA vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software… | |
| CVE-2026-85423 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayA vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector… | |
| CVE-2026-85486 | 8 Oct 2026 | CVSS 8.0 | Brocade Active Support Connectivity GatewayBrocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a… | |
| CVE-2026-85487 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayA path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local… | |
| CVE-2026-85488 | 8 Oct 2026 | CVSS 7.8 | Brocade Active Support Connectivity GatewayBrocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user… | |
| CVE-2026-85489 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayAn authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API… | |
| CVE-2026-85490 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayWhen Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path… | |
| CVE-2026-85097 | 8 Oct 2026 | CVSS 9.8 | BricksforgeThe Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to… | |
| CVE-2026-85421 | 8 Oct 2026 | CVSS 8.8 | Brocade Active Support Connectivity GatewayA critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce… | |
| CVE-2026-94258 | 8 Oct 2026 | CVSS 2.7 | Unknown SMS AlertThe SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning… | |
| CVE-2026-94275 | 8 Oct 2026 | CVSS 5.3 | Unknown Track Orders for WooCommerceThe Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing… | |
| CVE-2026-94244 | 8 Oct 2026 | CVSS 4.3 | Unknown Wallet System for WooCommerceThe Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user… | |
| CVE-2026-94245 | 8 Oct 2026 | CVSS 6.5 | Unknown Wallet System for WooCommerceThe Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being… | |
| CVE-2026-94246 | 8 Oct 2026 | CVSS 6.3 | Unknown Wallet System for WooCommerceThe Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to… | |
| CVE-2026-86828 | 8 Oct 2026 | CVSS 6.6 | Unknown BackWPupThe BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its… | |
| CVE-2026-5769 | 8 Oct 2026 | CVSS 4.1 | Brocade SANnavA vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file… | |
| CVE-2026-86826 | 8 Oct 2026 | CVSS 5.9 | Unknown BackWPupThe BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing… | |
| CVE-2026-86827 | 8 Oct 2026 | CVSS 5.3 | Unknown BackWPupThe BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from… | |
| CVE-2026-5048 | 8 Oct 2026 | CVSS 8.0 | Brocade SANnavIn Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated… | |
| CVE-2026-5049 | 8 Oct 2026 | CVSS 5.7 | Brocade SANnavA path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can… | |
| CVE-2026-107459 | 8 Oct 2026 | CVSS 9.8 | Openfind SecuShare ProThe SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands… | |
| CVE-2026-5047 | 8 Oct 2026 | CVSS 5.7 | Brocade SANnavA vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could… | |
| CVE-2026-105260 | 8 Oct 2026 | CVSS 4.3 | Unknown Database Addon For WPForms ( wpforms entries )The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and… | |
| CVE-2026-105195 | 8 Oct 2026 | CVSS 2.7 | Unknown Booking CalendarThe Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its… | |
| CVE-2026-105196 | 8 Oct 2026 | CVSS 3.3 | Unknown Appointment Booking PluginThe Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions… | |
| CVE-2026-105197 | 8 Oct 2026 | CVSS 2.7 | Unknown Appointment Booking PluginThe Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record… | |
| CVE-2026-105198 | 8 Oct 2026 | CVSS 5.3 | Unknown Appointment Booking PluginThe Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier… | |
| CVE-2026-104646 | 8 Oct 2026 | CVSS 6.8 | Unknown Image Photo Gallery Final Tiles GridThe Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden… | |
| CVE-2026-105193 | 8 Oct 2026 | CVSS 4.8 | Unknown Booking CalendarThe Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a… | |
| CVE-2026-105194 | 8 Oct 2026 | CVSS 4.3 | Unknown Easy Digital DownloadsThe Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with… | |
| CVE-2026-103692 | 8 Oct 2026 | CVSS 9.8 | Unknown Frontend DashboardThe Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users… | |
| CVE-2026-104645 | 8 Oct 2026 | CVSS 2.7 | Unknown Image Photo Gallery Final Tiles GridThe Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image… | |
| CVE-2026-103309 | 8 Oct 2026 | CVSS 7.5 | Unknown GPTranslateThe GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them… | |
| CVE-2026-103646 | 8 Oct 2026 | CVSS 9.8 | Unknown Ultimate MultisiteThe Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an… | |
| CVE-2026-94577 | 8 Oct 2026 | CVSS 7.8 | Brocade Fabric OSA privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS… | |
| CVE-2026-94579 | 8 Oct 2026 | CVSS 8.0 | Brocade Fabric OSAn OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on… | |
| CVE-2026-94581 | 8 Oct 2026 | CVSS 6.8 | Brocade Fabric OSAn OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… | |
| CVE-2026-94585 | 8 Oct 2026 | CVSS 8.8 | Brocade Fabric OSAn authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610… | |
| CVE-2026-94586 | 8 Oct 2026 | CVSS 6.8 | Brocade Fabric OSA command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of… | |
| CVE-2026-94587 | 8 Oct 2026 | CVSS 4.5 | Brocade Fabric OSA buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of… | |
| CVE-2026-87661 | 8 Oct 2026 | CVSS 5.7 | Brocade Fabric OSBrocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or… | |
| CVE-2026-87662 | 8 Oct 2026 | CVSS 6.7 | Brocade Fabric OSBrocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings… | |
| CVE-2026-87663 | 8 Oct 2026 | CVSS 6.7 | Brocade Fabric OSAn authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before… | |
| CVE-2026-87664 | 8 Oct 2026 | CVSS 7.8 | Brocade Fabric OSA session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When… | |
| CVE-2026-87677 | 8 Oct 2026 | CVSS 6.6 | Brocade Fabric OSAn OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… | |
| CVE-2026-94576 | 8 Oct 2026 | CVSS 8.0 | Brocade Fabric OSAn authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d… | |
| CVE-2026-107449 | 8 Oct 2026 | CVSS 3.4 | linuxserver Heimdalllinuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and… | |
| CVE-2026-107450 | 8 Oct 2026 | CVSS 5.4 | stumpapp StumpIn Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the… | |
| CVE-2026-17196 | 8 Oct 2026 | CVSS 8.8 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including… | |
| CVE-2026-17609 | 8 Oct 2026 | CVSS 9.1 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including… | |
| CVE-2023-5648 | 8 Oct 2026 | CVSS 6.1 | Brocade Active Support Connectivity GatewayIn Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding… | |
| CVE-2023-5649 | 8 Oct 2026 | CVSS 5.5 | Brocade Active Support Connectivity GatewayAn Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to… | |
| CVE-2026-94575 | 8 Oct 2026 | CVSS 5.7 | Brocade Fabric OSA logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass… | |
| CVE-2026-94580 | 8 Oct 2026 | CVSS 4.5 | Brocade Fabric OSAn arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric… | |
| CVE-2026-94584 | 8 Oct 2026 | CVSS 2.6 | Brocade Fabric OSA race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user… | |
| CVE-2026-87685 | 8 Oct 2026 | CVSS 6.8 | Brocade Fabric OSAn arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0… | |
| CVE-2026-87687 | 8 Oct 2026 | CVSS 7.3 | Brocade Fabric OSAn authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated… | |
| CVE-2026-87688 | 8 Oct 2026 | CVSS 6.8 | Brocade Fabric OSAn input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API… | |
| CVE-2026-87675 | 8 Oct 2026 | CVSS 6.8 | Brocade Fabric OSAn OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… | |
| CVE-2026-87673 | 8 Oct 2026 | CVSS 7.2 | Brocade Fabric OSAn OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0… | |
| CVE-2026-87674 | 8 Oct 2026 | CVSS 7.8 | Brocade Fabric OSA local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… | |
| CVE-2026-87660 | 8 Oct 2026 | CVSS 7.1 | Brocade Fabric OSAn improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions… | |
| CVE-2026-87666 | 8 Oct 2026 | CVSS 8.0 | Brocade Fabric OSAn OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… | |
| CVE-2026-87667 | 8 Oct 2026 | CVSS 4.5 | Brocade Fabric OSAn argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and… | |
| CVE-2026-107445 | 8 Oct 2026 | CVSS 5.4 | Red Hat Hardened ImagesA flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote… | |
| CVE-2026-107446 | 8 Oct 2026 | CVSS 6.8 | containerd overlaybdcontainerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for… | |
| CVE-2026-107448 | 8 Oct 2026 | CVSS 3.4 | Wizards of the Coast Magic: The Gathering ArenaMagic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a… | |
| CVE-2026-107444 | 8 Oct 2026 | CVSS 4.3 | Red Hat Hardened ImagesA flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a… | |
| CVE-2026-94583 | 8 Oct 2026 | CVSS 2.6 | Brocade Fabric OSA race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1… | |
| CVE-2026-87678 | 8 Oct 2026 | CVSS 5.2 | Brocade Fabric OSAn input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When… | |
| CVE-2026-87684 | 8 Oct 2026 | CVSS 9.8 | Brocade Fabric OSA stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an… | |
| CVE-2026-87686 | 8 Oct 2026 | CVSS 4.3 | Brocade Fabric OSAn authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1… | |
| CVE-2026-92861 | 8 Oct 2026 | CVSS 5.1 | Wavedash Co., Ltd. Ticket Ryutsu CenterThe Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the… | |
| CVE-2026-92862 | 8 Oct 2026 | CVSS 4.6 | Wavedash Co., Ltd. Ticket Ryutsu CenterThe Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an… | |
| CVE-2026-94578 | 8 Oct 2026 | CVSS 8.8 | Brocade Fabric OSBrocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting)… | |
| CVE-2026-94582 | 8 Oct 2026 | CVSS 7.8 | Brocade Fabric OSA memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF)… | |
| CVE-2026-87668 | 8 Oct 2026 | CVSS 6.5 | Brocade Fabric OSA stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing… | |
| CVE-2026-87669 | 8 Oct 2026 | CVSS 4.3 | Brocade Fabric OSA missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated… | |
| CVE-2026-87670 | 8 Oct 2026 | CVSS 4.3 | Brocade Fabric OSAn authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted… | |
| CVE-2026-87671 | 8 Oct 2026 | CVSS 7.5 | Brocade Fabric OSAn out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP… | |
| CVE-2026-87672 | 8 Oct 2026 | CVSS 5.5 | Brocade Fabric OSAn information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When… | |
| CVE-2026-87676 | 8 Oct 2026 | CVSS 5.7 | Brocade Fabric OSA stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing… | |
| CVE-2026-87659 | 8 Oct 2026 | CVSS 9.8 | Brocade Fabric OSA critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised… | |
| CVE-2026-87665 | 8 Oct 2026 | CVSS 7.5 | Brocade Fabric OSA stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1… | |
| CVE-2017-20283 | 8 Oct 2026 | CVSS 6.5 | NXP MQXNXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of the… | |
| CVE-2026-82627 | 8 Oct 2026 | CVSS 7.5 | uncannyowl Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage IncludedThe Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP… | |
| CVE-2026-87682 | 8 Oct 2026 | CVSS 8.8 | Brocade Fabric OSMultiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before… | |
| CVE-2026-87683 | 8 Oct 2026 | CVSS 8.8 | Brocade Fabric OSMultiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When… |
Page 103 of 168