[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-87726 | 8 Oct 2026 | CVSS 3.9 | NxpNfcRdLibInsufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted… | |
| CVE-2026-102488 | 8 Oct 2026 | CVSS 8.7 | Octopus Deploy Octopus ServerIn affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain… | |
| CVE-2024-8122 | 8 Oct 2026 | CVSS 5.9 | WSO2 Identity ServerThe WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This… | |
| CVE-2026-87679 | 8 Oct 2026 | CVSS 7.2 | Brocade Fabric OSWhen Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into… | |
| CVE-2026-87680 | 8 Oct 2026 | CVSS 8.8 | Brocade Fabric OSA command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to… | |
| CVE-2026-87681 | 8 Oct 2026 | CVSS 6.3 | Brocade Fabric OSAn Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1… | |
| CVE-2026-17538 | 8 Oct 2026 | CVSS 5.4 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and… | |
| CVE-2026-94154 | 8 Oct 2026 | CVSS 6.1 | r3098 Aurora HeatmapThe Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including… | |
| CVE-2026-107315 | 8 Oct 2026 | CVSS 5.3 | pgjdbcpgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send… | Fix |
| CVE-2026-89322 | 7 Oct 2026 | CVSS 7.2 | HashiCorp VaultVault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an… | |
| CVE-2026-107314 | 7 Oct 2026 | CVSS 5.9 | pgjdbcpgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six… | Fix |
| CVE-2026-107282 | 7 Oct 2026 | CVSS 9.4 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107283 | 7 Oct 2026 | CVSS 3.7 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | Fix |
| CVE-2026-107284 | 7 Oct 2026 | CVSS 3.7 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | |
| CVE-2026-107285 | 7 Oct 2026 | CVSS 5.9 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | Fix |
| CVE-2026-107230 | 7 Oct 2026 | CVSS 7.4 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0… | Fix |
| CVE-2026-107231 | 7 Oct 2026 | CVSS 8.7 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107232 | 7 Oct 2026 | CVSS 7.5 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | |
| CVE-2026-107279 | 7 Oct 2026 | CVSS 8.8 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a… | |
| CVE-2026-107280 | 7 Oct 2026 | CVSS 6.9 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107281 | 7 Oct 2026 | CVSS 7.6 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | |
| CVE-2026-105816 | 7 Oct 2026 | CVSS 8.0 | HashiCorp VaultVault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory… | |
| CVE-2026-105818 | 7 Oct 2026 | CVSS 5.9 | HashiCorp VaultVault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under… | |
| CVE-2026-105820 | 7 Oct 2026 | CVSS 5.4 | HashiCorp Vault EnterpriseVault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially… | |
| CVE-2026-76284 | 7 Oct 2026 | CVSS 9.8 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76285 | 7 Oct 2026 | CVSS 9.8 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76286 | 7 Oct 2026 | CVSS 5.3 | Splunk MCP ServerIn Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom… | |
| CVE-2026-76278 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use… | |
| CVE-2026-76279 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the… | |
| CVE-2026-76280 | 7 Oct 2026 | CVSS 6.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an… | |
| CVE-2026-76281 | 7 Oct 2026 | CVSS 5.3 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76282 | 7 Oct 2026 | CVSS 8.8 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76283 | 7 Oct 2026 | CVSS 7.6 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76271 | 7 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could… | |
| CVE-2026-76272 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause… | |
| CVE-2026-76273 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the… | |
| CVE-2026-76274 | 7 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an… | |
| CVE-2026-76275 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access… | |
| CVE-2026-76276 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could… | |
| CVE-2026-76277 | 7 Oct 2026 | CVSS 4.1 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native… | |
| CVE-2026-76264 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or… | |
| CVE-2026-76265 | 7 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user… | |
| CVE-2026-76266 | 7 Oct 2026 | CVSS 7.7 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running… | |
| CVE-2026-76267 | 7 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged… | |
| CVE-2026-76268 | 7 Oct 2026 | CVSS 9.8 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer… | |
| CVE-2026-76269 | 7 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a… | |
| CVE-2026-76270 | 7 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module… | |
| CVE-2026-107352 | 7 Oct 2026 | CVSS 7.7 | AWS Amazon AthenaMissing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query… | |
| CVE-2026-107363 | 7 Oct 2026 | CVSS 6.1 | OpenStack ZaqarIn OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by… | |
| CVE-2026-1403 | 7 Oct 2026 | CVSS 6.5 | GitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when… | |
| CVE-2026-107227 | 7 Oct 2026 | CVSS 7.5 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0… | Fix |
| CVE-2026-107228 | 7 Oct 2026 | CVSS 6.8 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0… | Fix |
| CVE-2026-107229 | 7 Oct 2026 | CVSS 4.0 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0… | |
| CVE-2026-97715 | 7 Oct 2026 | CVSS 7.1 | Absolute Security Secure AccessCVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can… | |
| CVE-2026-97716 | 7 Oct 2026 | CVSS 8.7 | Absolute Security Secure AccessCVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can… | |
| CVE-2026-97717 | 7 Oct 2026 | CVSS 6.0 | Absolute Security Secure AccessCVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to… | |
| CVE-2026-97714 | 7 Oct 2026 | CVSS 8.2 | Absolute Security Secure AccessCVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a… | |
| CVE-2026-34499 | 7 Oct 2026 | CVSS 8.5 | Johnson Controls ADVMSUse of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects… | |
| CVE-2026-107176 | 7 Oct 2026 | CVSS 6.8 | Red Hat OpenShift Container Platform 4A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch… | |
| CVE-2026-107353 | 7 Oct 2026 | CVSS 6.5 | ljharb traversetraverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through… | |
| CVE-2026-107161 | 7 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer… | |
| CVE-2026-107224 | 7 Oct 2026 | CVSS 6.5 | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high… | Fix |
| CVE-2026-107225 | 7 Oct 2026 | CVSS 6.5 | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font… | Fix |
| CVE-2026-107313 | 7 Oct 2026 | CVSS 4.2 | pgjdbcpgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a… | |
| CVE-2026-107218 | 7 Oct 2026 | CVSS 5.3 | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length… | Fix |
| CVE-2026-107219 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an… | Fix |
| CVE-2026-107220 | 7 Oct 2026 | CVSS 6.5 | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached… | Fix |
| CVE-2026-107221 | 7 Oct 2026 | CVSS 6.5 | Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice… | Fix |
| CVE-2026-107222 | 7 Oct 2026 | CVSS 6.5 | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes… | Fix |
| CVE-2026-107223 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column… | Fix |
| CVE-2026-107217 | 7 Oct 2026 | CVSS 7.5 | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from… | Fix |
| CVE-2026-103371 | 7 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache GeodeInsertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are… | |
| CVE-2026-106164 | 7 Oct 2026 | CVSS 7.3 | Progress Software Telerik Document Processing LibrariesIn Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when… | |
| CVE-2026-96335 | 7 Oct 2026 | CVSS 7.5 | WPMU DEV ForminatorMissing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… | |
| CVE-2026-56851 | 7 Oct 2026 | CVSS 7.5 | golang.org/x/text/secure/precisThe Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. | |
| CVE-2026-107214 | 7 Oct 2026 | CVSS 7.5 | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs… | Fix |
| CVE-2026-107215 | 7 Oct 2026 | CVSS 7.5 | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice… | Fix |
| CVE-2026-107216 | 7 Oct 2026 | CVSS 7.5 | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the… | Fix |
| CVE-2026-107211 | 7 Oct 2026 | CVSS 5.5 | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field… | Fix |
| CVE-2026-107212 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row… | Fix |
| CVE-2026-107213 | 7 Oct 2026 | CVSS 5.5 | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but… | Fix |
| CVE-2026-106066 | 7 Oct 2026 | CVSS 6.3 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing… | |
| CVE-2026-106067 | 7 Oct 2026 | CVSS 6.3 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing… | |
| CVE-2026-95605 | 7 Oct 2026 | CVSS 9.3 | Passionate Programmer Peter WP Data AccessImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access… | |
| CVE-2026-95606 | 7 Oct 2026 | CVSS 9.8 | Liquid Web / StellarWP The Events CalendarDeserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events… | |
| CVE-2026-94662 | 7 Oct 2026 | CVSS 7.1 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-94670 | 7 Oct 2026 | CVSS 7.1 | Everest FormsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue… | |
| CVE-2026-95534 | 7 Oct 2026 | CVSS 8.8 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows… | |
| CVE-2026-95595 | 7 Oct 2026 | CVSS 7.1 | Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendlyImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts |… | |
| CVE-2026-76501 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareA vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as… | |
| CVE-2026-92542 | 7 Oct 2026 | CVSS 6.9 | Docker EngineThe firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged… | |
| CVE-2026-92543 | 7 Oct 2026 | CVSS 7.6 | Docker EngineDocker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as… | |
| CVE-2026-76484 | 7 Oct 2026 | CVSS 8.8 | Cisco License On-PremAs part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart… | |
| CVE-2026-76485 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareA vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an… | |
| CVE-2026-76486 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareA vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an… | |
| CVE-2026-76488 | 7 Oct 2026 | CVSS 6.5 | Cisco Application Policy Infrastructure Controller (APIC)A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated… | |
| CVE-2026-76498 | 7 Oct 2026 | CVSS 9.8 | Cisco Application Policy Infrastructure Controller (APIC)As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC)… | |
| CVE-2026-76499 | 7 Oct 2026 | CVSS 9.8 | Cisco Application Policy Infrastructure Controller (APIC)As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC)… | |
| CVE-2026-76500 | 7 Oct 2026 | CVSS 9.8 | Cisco Application Policy Infrastructure Controller (APIC)As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC)… | |
| CVE-2026-76470 | 7 Oct 2026 | CVSS 8.8 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… |
Page 104 of 168