[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103007 | 6 Oct 2026 | CVSS 7.2 | ElasticsearchIncorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully… | |
| CVE-2026-102168 | 6 Oct 2026 | CVSS 6.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can… | |
| CVE-2026-102169 | 6 Oct 2026 | CVSS 6.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can… | |
| CVE-2026-102404 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged… | |
| CVE-2026-102406 | 6 Oct 2026 | CVSS 8.8 | Elastic KibanaAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers… | |
| CVE-2026-102407 | 6 Oct 2026 | CVSS 5.4 | ElasticsearchIncorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly… | |
| CVE-2026-102408 | 6 Oct 2026 | CVSS 4.3 | ElasticsearchInefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup… | |
| CVE-2026-102409 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting… | |
| CVE-2026-102160 | 6 Oct 2026 | CVSS 7.2 | Arista Networks CloudVision CUEAn operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a… | |
| CVE-2026-102161 | 6 Oct 2026 | CVSS 8.8 | Arista Networks CloudVision CUEAn unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client… | |
| CVE-2026-102162 | 6 Oct 2026 | CVSS 8.8 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless… | |
| CVE-2026-102163 | 6 Oct 2026 | CVSS 8.8 | Arista Networks Wi-Fi Access PointsOn affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF)… | |
| CVE-2026-102164 | 6 Oct 2026 | CVSS 3.1 | Arista Networks Wi-Fi Access PointsOn affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless… | |
| CVE-2026-102165 | 6 Oct 2026 | CVSS 7.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the… | |
| CVE-2026-102167 | 6 Oct 2026 | CVSS 7.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated… | |
| CVE-2026-101158 | 6 Oct 2026 | CVSS 8.4 | Arista Networks CloudVision PortalA missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored… | |
| CVE-2026-102155 | 6 Oct 2026 | CVSS 8.5 | Arista Networks CloudVision CUEAn XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious… | |
| CVE-2026-102156 | 6 Oct 2026 | CVSS 6.8 | Arista Networks CloudVision CUEImproper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under… | |
| CVE-2026-102157 | 6 Oct 2026 | CVSS 5.9 | Arista Networks CloudVision CUEAn insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under… | |
| CVE-2026-102158 | 6 Oct 2026 | CVSS 6.5 | Arista Networks CloudVision CUEImproper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to… | |
| CVE-2026-102159 | 6 Oct 2026 | CVSS 9.8 | Arista Networks CloudVision CUEAn access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal… | |
| CVE-2026-101151 | 6 Oct 2026 | CVSS 4.3 | Arista Networks CloudVision PortalInsufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user… | |
| CVE-2026-101152 | 6 Oct 2026 | CVSS 8.0 | Arista Networks CloudVision PortalInsufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a… | |
| CVE-2026-101153 | 6 Oct 2026 | CVSS 8.0 | Arista Networks CloudVision PortalOn affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with… | |
| CVE-2026-101154 | 6 Oct 2026 | CVSS 7.2 | Arista Networks CloudVision PortalAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through… | |
| CVE-2026-101155 | 6 Oct 2026 | CVSS 9.1 | Arista Networks CloudVision PortalAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through… | |
| CVE-2026-101156 | 6 Oct 2026 | CVSS 8.4 | Arista Networks CloudVision CUEA stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a… | |
| CVE-2026-101157 | 6 Oct 2026 | CVSS 8.7 | Arista Networks CloudVision CUEA stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that… | |
| CVE-2026-101027 | 6 Oct 2026 | CVSS 7.7 | GiteaWhen `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the… | Fix |
| CVE-2026-101029 | 6 Oct 2026 | CVSS 4.3 | GiteaGitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address… | Fix |
| CVE-2026-101149 | 6 Oct 2026 | CVSS 4.1 | Arista Networks CloudVision PortalInsufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary… | |
| CVE-2026-101150 | 6 Oct 2026 | CVSS 4.1 | Arista Networks CloudVision PortalInsufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary… | |
| CVE-2026-9226 | 6 Oct 2026 | CVSS 6.8 | Devolutions ServerAuthentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's… | |
| CVE-2026-96890 | 6 Oct 2026 | CVSS 8.8 | GitHub Enterprise ServerA Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the… | |
| CVE-2026-82162 | 6 Oct 2026 | CVSS 9.8 | Dell Command | Configure (DCC)Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker… | Fix |
| CVE-2026-83550 | 6 Oct 2026 | CVSS 7.1 | Red Hat Multicluster Global HubA flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics… | |
| CVE-2026-86360 | 6 Oct 2026 | CVSS 9.6 | Dell System UpdateDell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… | Fix |
| CVE-2026-86361 | 6 Oct 2026 | CVSS 8.2 | Dell System UpdateDell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged… | Fix |
| CVE-2026-86362 | 6 Oct 2026 | CVSS 8.2 | Dell System UpdateDell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could… | |
| CVE-2026-56936 | 6 Oct 2026 | CVSS 6.8 | Google AndroidIn wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical… | Fix |
| CVE-2026-56952 | 6 Oct 2026 | CVSS 6.7 | Google AndroidIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to… | Fix |
| CVE-2026-63697 | 6 Oct 2026 | CVSS 7.2 | Dell System UpdateDell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote… | Fix |
| CVE-2026-70414 | 6 Oct 2026 | CVSS 5.5 | Dell Command | Configure (DCC)Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with… | Fix |
| CVE-2026-71168 | 6 Oct 2026 | CVSS 7.8 | Dell System UpdateDell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… | Fix |
| CVE-2026-55307 | 6 Oct 2026 | CVSS 4.4 | Google AndroidIn kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local… | Fix |
| CVE-2026-55330 | 6 Oct 2026 | CVSS 9.8 | Google AndroidIn BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to… | Fix |
| CVE-2026-56906 | 6 Oct 2026 | CVSS 7.0 | Google AndroidIn ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no… | Fix |
| CVE-2026-106441 | 6 Oct 2026 | CVSS 7.8 | Hydra logging configuration permits unsafe callable resolutionHydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to… | Fix |
| CVE-2026-106442 | 6 Oct 2026 | CVSS 7.8 | Hydra instantiate target blacklist bypasses permit code executionHydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist… | Fix |
| CVE-2026-106443 | 6 Oct 2026 | CVSS 8.8 | WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCEWeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes… | Fix |
| CVE-2026-106511 | 6 Oct 2026 | CVSS 9.8 | MultiversX Labs S.R.L. multisig-improvedMultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system… | |
| CVE-2026-106512 | 6 Oct 2026 | CVSS 8.4 | MISP sachertortephpThe CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a… | |
| CVE-2026-106513 | 6 Oct 2026 | CVSS 6.9 | MISPMISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the… | |
| CVE-2026-106422 | 6 Oct 2026 | CVSS 4.3 | Google ChromeIncorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page… | |
| CVE-2026-106423 | 6 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-106424 | 6 Oct 2026 | CVSS 4.0 | Google ChromeInformation leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory… | |
| CVE-2026-106425 | 6 Oct 2026 | CVSS 4.2 | Google ChromeMissing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and… | |
| CVE-2026-106426 | 6 Oct 2026 | CVSS 8.3 | Google ChromeRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… | |
| CVE-2026-106427 | 6 Oct 2026 | CVSS 5.4 | Google ChromeConfused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a… | |
| CVE-2026-106439 | 6 Oct 2026 | CVSS 8.5 | Hydra: Mutable instantiate policy sets allow target blocklist bypassHydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target… | Fix |
| CVE-2026-106440 | 6 Oct 2026 | CVSS 7.8 | Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_methodHydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts… | Fix |
| CVE-2026-106414 | 6 Oct 2026 | CVSS 9.6 | Google ChromeImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… | |
| CVE-2026-106415 | 6 Oct 2026 | CVSS 4.3 | Google ChromeInformation leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML… | |
| CVE-2026-106416 | 6 Oct 2026 | CVSS 5.4 | Google ChromeCode injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via… | |
| CVE-2026-106417 | 6 Oct 2026 | CVSS 9.6 | Google ChromeInteger overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… | |
| CVE-2026-106418 | 6 Oct 2026 | CVSS 6.5 | Google ChromeMissing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin… | |
| CVE-2026-106419 | 6 Oct 2026 | CVSS 9.6 | Google ChromeUse after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox… | |
| CVE-2026-106420 | 6 Oct 2026 | CVSS 5.4 | Google ChromeIncorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof… | |
| CVE-2026-106421 | 6 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-106405 | 6 Oct 2026 | CVSS 6.0 | Google ChromeRace condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a… | |
| CVE-2026-106406 | 6 Oct 2026 | CVSS 5.4 | Google ChromeMissing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI… | |
| CVE-2026-106407 | 6 Oct 2026 | CVSS 6.5 | Google ChromeIncorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… | |
| CVE-2026-106408 | 6 Oct 2026 | CVSS 6.5 | Google ChromeProtection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a… | |
| CVE-2026-106409 | 6 Oct 2026 | CVSS 8.3 | Google ChromeIncorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the… | |
| CVE-2026-106410 | 6 Oct 2026 | CVSS 4.2 | Google ChromeMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… | |
| CVE-2026-106411 | 6 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-106412 | 6 Oct 2026 | CVSS 8.3 | Google ChromeRace condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and… | |
| CVE-2026-106413 | 6 Oct 2026 | CVSS 4.2 | Google ChromeRace condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI… | |
| CVE-2026-106396 | 6 Oct 2026 | CVSS 5.4 | Google ChromeImproper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… | |
| CVE-2026-106397 | 6 Oct 2026 | CVSS 6.1 | Google ChromeIncorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass… | |
| CVE-2026-106398 | 6 Oct 2026 | CVSS 4.3 | Google ChromeIncorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page… | |
| CVE-2026-106399 | 6 Oct 2026 | CVSS 3.3 | Google ChromeOut of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory… | |
| CVE-2026-106400 | 6 Oct 2026 | CVSS 5.4 | Google ChromeClickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI… | |
| CVE-2026-106401 | 6 Oct 2026 | CVSS 9.6 | Google ChromeOut of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the… | |
| CVE-2026-106402 | 6 Oct 2026 | CVSS 4.8 | Google ChromeIncorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI… | |
| CVE-2026-106403 | 6 Oct 2026 | CVSS 8.1 | Google ChromeIncorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process… | |
| CVE-2026-106404 | 6 Oct 2026 | CVSS 6.5 | Google ChromeIncorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… | |
| CVE-2026-106388 | 6 Oct 2026 | CVSS 5.3 | Google ChromeMissing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… | |
| CVE-2026-106389 | 6 Oct 2026 | CVSS 6.5 | Google ChromeIncorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system… | |
| CVE-2026-106390 | 6 Oct 2026 | CVSS 4.3 | Google ChromeIncorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive… | |
| CVE-2026-106391 | 6 Oct 2026 | CVSS 4.2 | Google ChromeIncorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer… | |
| CVE-2026-106392 | 6 Oct 2026 | CVSS 4.3 | Google ChromeInformation leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted… | |
| CVE-2026-106393 | 6 Oct 2026 | CVSS 8.3 | Google ChromeUse after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute… | |
| CVE-2026-106394 | 6 Oct 2026 | CVSS 4.3 | Google ChromeIncomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data… | |
| CVE-2026-106395 | 6 Oct 2026 | CVSS 4.7 | Google ChromeUninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via… | |
| CVE-2026-106379 | 6 Oct 2026 | CVSS 4.3 | Google ChromeUninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page… | |
| CVE-2026-106380 | 6 Oct 2026 | CVSS 5.4 | Google ChromeUI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a… | |
| CVE-2026-106381 | 6 Oct 2026 | CVSS 6.5 | Google ChromeIncorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a… | |
| CVE-2026-106382 | 6 Oct 2026 | CVSS 9.6 | Google ChromeUse after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a… | |
| CVE-2026-106383 | 6 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… |
Page 109 of 168