[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106122 | 6 Oct 2026 | CVSS 7.5 | RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0… | Fix |
| CVE-2026-106123 | 6 Oct 2026 | CVSS 5.5 | RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0… | Fix |
| CVE-2026-106179 | 6 Oct 2026 | CVSS 5.4 | Google ChromeUI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML… | |
| CVE-2026-106180 | 6 Oct 2026 | CVSS 3.1 | Google ChromeObservable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a… | |
| CVE-2026-106118 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but… | Fix |
| CVE-2026-106119 | 6 Oct 2026 | CVSS 6.0 | LangChain: MongoDBChatMessageHistory query injection can allow cross-session accessLangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type… | Fix |
| CVE-2026-106120 | 6 Oct 2026 | CVSS 6.0 | LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iterationLiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently… | Fix |
| CVE-2026-105488 | 6 Oct 2026 | CVSS 7.1 | Devolutions ServerMissing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view… | |
| CVE-2026-106033 | 6 Oct 2026 | CVSS 5.4 | Red Hat Ansible Automation Platform 2A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's… | |
| CVE-2026-104073 | 6 Oct 2026 | CVSS 7.6 | netbox-community netboxNetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom… | |
| CVE-2026-104944 | 6 Oct 2026 | CVSS 7.1 | TP-Link Systems Inc. Tapo C500 v2.0TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP… | |
| CVE-2026-104945 | 6 Oct 2026 | CVSS 6.8 | TP-Link Systems Inc. Tapo C500 v2.0TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit… | |
| CVE-2026-105485 | 6 Oct 2026 | CVSS 6.8 | Devolutions ServerAuthentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's… | |
| CVE-2026-102322 | 6 Oct 2026 | CVSS 9.6 | Google ChromeIncorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted… | |
| CVE-2026-103620 | 6 Oct 2026 | CVSS 6.5 | GitHub Enterprise ServerA missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete… | |
| CVE-2026-103778 | 6 Oct 2026 | CVSS 5.5 | Dell Command | Configure (DCC)Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker… | Fix |
| CVE-2026-0198 | 6 Oct 2026 | CVSS 4.4 | Google AndroidIn is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information… | Fix |
| CVE-2026-88252 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system… | |
| CVE-2026-66666 | 6 Oct 2026 | CVSS 6.9 | Automattic WordPressInsertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects… | |
| CVE-2026-106114 | 6 Oct 2026 | CVSS 5.3 | ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and… | Fix |
| CVE-2026-106115 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output bufferImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though… | Fix |
| CVE-2026-106116 | 6 Oct 2026 | CVSS 5.3 | ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per… | Fix |
| CVE-2026-106117 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharpImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass… | Fix |
| CVE-2026-106106 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite… | Fix |
| CVE-2026-106107 | 6 Oct 2026 | CVSS 8.3 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering… | Fix |
| CVE-2026-106109 | 6 Oct 2026 | CVSS 4.1 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesQuasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed… | Fix |
| CVE-2026-106110 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow… | Fix |
| CVE-2026-106111 | 6 Oct 2026 | CVSS 5.9 | ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result… | Fix |
| CVE-2026-106112 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: ICC LUT16 output channel count can write beyond Vector4ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though… | Fix |
| CVE-2026-106113 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and… | Fix |
| CVE-2026-106103 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate… | Fix |
| CVE-2026-106104 | 6 Oct 2026 | CVSS 8.7 | Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded… | Fix |
| CVE-2026-106105 | 6 Oct 2026 | CVSS 8.4 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and… | Fix |
| CVE-2026-101207 | 6 Oct 2026 | CVSS 8.8 | Dell OpenManage IntegrationDell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements… | |
| CVE-2025-45871 | 6 Oct 2026 | CVSS 8.1 | VulnerabilityLogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to… | |
| CVE-2026-95140 | 6 Oct 2026 | CVSS 7.5 | VulnerabilitykkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile… | |
| CVE-2026-95153 | 6 Oct 2026 | CVSS 4.9 | VulnerabilityAn issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft… | |
| CVE-2026-106101 | 6 Oct 2026 | CVSS 3.1 | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of ServiceQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in… | Fix |
| CVE-2026-106102 | 6 Oct 2026 | CVSS 10.0 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in… | Fix |
| CVE-2026-106218 | 6 Oct 2026 | CVSS 10.0 | JetBrains TeamCityIn JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | |
| CVE-2026-106219 | 6 Oct 2026 | CVSS 7.5 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server | |
| CVE-2026-105867 | 6 Oct 2026 | CVSS 6.5 | Payload: Client uploads could overwrite S3 objectsPayload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105868 | 6 Oct 2026 | CVSS 7.1 | Payload: Uploaded XML files could execute same-origin JavaScriptPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local… | Fix |
| CVE-2026-105957 | 6 Oct 2026 | CVSS 6.3 | SourceCodester Performance Indicator SystemA vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-106100 | 6 Oct 2026 | CVSS 7.1 | Payload: Field-level write access bypass in Payload on MongoDBPayload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before… | Fix |
| CVE-2026-105860 | 6 Oct 2026 | CVSS 7.1 | Payload has a tenant authorization bypass in Multi-Tenant PluginPayload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105861 | 6 Oct 2026 | CVSS 8.2 | Payload external upload trust validation issuePayload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based… | Fix |
| CVE-2026-105862 | 6 Oct 2026 | CVSS 8.7 | Payload: Bypassed sanitization of user uploaded SVGsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a… | Fix |
| CVE-2026-105863 | 6 Oct 2026 | CVSS 9.4 | Payload authentication token field handling issuePayload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a… | Fix |
| CVE-2026-105864 | 6 Oct 2026 | CVSS 4.3 | @payloadcms/plugin-multi-tenant has a cross-tenant create issuePayload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105865 | 6 Oct 2026 | CVSS 8.1 | Payload: Incomplete validation during the upload file lifecyclePayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105866 | 6 Oct 2026 | CVSS 7.5 | Payload: Unauthenticated account-lockout denial of servicePayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105853 | 6 Oct 2026 | CVSS 6.5 | Payload: Token refresh and password reset responses may expose restricted user fieldsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105854 | 6 Oct 2026 | CVSS 7.5 | Payload: ReDoS in Multipart Content-Type ValidationPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105855 | 6 Oct 2026 | CVSS 7.1 | Payload didn't enforce field-level password update restrictionsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the… | Fix |
| CVE-2026-105856 | 6 Oct 2026 | CVSS 8.3 | Payload: SQL injection in SQLite/PostgresPayload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update… | Fix |
| CVE-2026-105857 | 6 Oct 2026 | CVSS 10.0 | Payload Form Builder has an RCE issuePayload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105858 | 6 Oct 2026 | CVSS 8.1 | Payload: Remote Code Execution through first-registerPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted… | Fix |
| CVE-2026-105859 | 6 Oct 2026 | CVSS 9.8 | Payload: Unauthorized update to collection documentsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105847 | 6 Oct 2026 | CVSS 6.5 | Payload: Polymorphic join queries could disclose hidden fieldsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105848 | 6 Oct 2026 | CVSS 9.6 | Payload: Insufficient Access Control in Stripe REST ProxyPayload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105849 | 6 Oct 2026 | CVSS 8.3 | Payload vulnerable to API key disclosure through ordinary document readsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105850 | 6 Oct 2026 | CVSS 8.2 | Payload Ecommerce has an order confirmation validation issuePayload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105851 | 6 Oct 2026 | CVSS 8.1 | Payload: Field access control bypass on auth collectionsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105852 | 6 Oct 2026 | CVSS 7.5 | Payload relationship-query authorization bypassPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying… | Fix |
| CVE-2026-105846 | 6 Oct 2026 | CVSS 6.1 | Payload: Untrusted redirect URL parameter exploitPayload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-104850 | 6 Oct 2026 | CVSS 7.5 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions… | Fix |
| CVE-2026-104070 | 6 Oct 2026 | CVSS 9.8 | SPIP Crayons PluginThe Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary… | |
| CVE-2025-71384 | 6 Oct 2026 | CVSS 6.7 | VulnerabilityDbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow… | |
| CVE-2025-71383 | 6 Oct 2026 | CVSS 9.8 | VulnerabilityDbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login… | |
| CVE-2026-76105 | 6 Oct 2026 | CVSS 7.1 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker… | |
| CVE-2026-63690 | 6 Oct 2026 | CVSS 7.4 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the… | |
| CVE-2026-63691 | 6 Oct 2026 | CVSS 9.6 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax -… | |
| CVE-2026-67270 | 6 Oct 2026 | CVSS 7.4 | Dell Container Storage Modules (CSM)Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server… | |
| CVE-2026-67273 | 6 Oct 2026 | CVSS 9.6 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine… | |
| CVE-2026-70411 | 6 Oct 2026 | CVSS 6.5 | Dell Container Storage Modules (CSM)Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the… | |
| CVE-2026-61411 | 6 Oct 2026 | CVSS 7.7 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low… | |
| CVE-2026-63689 | 6 Oct 2026 | CVSS 6.5 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low… | |
| CVE-2026-26287 | 6 Oct 2026 | CVSS 7.1 | External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationExternal Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in… | Fix |
| CVE-2026-105805 | 6 Oct 2026 | CVSS 6.9 | Payload: Sort queries could expose protected field informationPayload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an… | Fix |
| CVE-2026-105806 | 6 Oct 2026 | CVSS 8.6 | Payload: Improper access control for MCP API keysPayload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated… | Fix |
| CVE-2026-105844 | 6 Oct 2026 | CVSS 9.3 | Payload: Prototype pollution in Payload Import Export pluginPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105845 | 6 Oct 2026 | CVSS 9.8 | Payload: SQL Injection in SQLite and PostgresPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105950 | 6 Oct 2026 | CVSS 3.5 | getformwork formworkA security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the… | |
| CVE-2026-105804 | 6 Oct 2026 | CVSS 5.7 | Payload: Password hashes use insufficient PBKDF2 iterationsPayload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from… | Fix |
| CVE-2026-63692 | 6 Oct 2026 | CVSS 10.0 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated… | |
| CVE-2026-67269 | 6 Oct 2026 | CVSS 9.9 | Dell Container Storage Modules (CSM)Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the… | |
| CVE-2026-54472 | 6 Oct 2026 | CVSS 7.5 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An… | |
| CVE-2026-61421 | 6 Oct 2026 | CVSS 9.8 | Dell Container Storage ModulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An… | |
| CVE-2026-63688 | 6 Oct 2026 | CVSS 10.0 | Dell Container Storage Modules (CSM)Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the… | |
| CVE-2026-105799 | 6 Oct 2026 | CVSS 2.3 | LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesLangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in… | Fix |
| CVE-2026-105800 | 6 Oct 2026 | CVSS 3.7 | i18next-http-backend incomplete URL validation permits SSRFi18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2… | Fix |
| CVE-2026-105801 | 6 Oct 2026 | CVSS 8.4 | openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generationopenapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI… | Fix |
| CVE-2026-105921 | 6 Oct 2026 | CVSS 6.3 | Kusalkasilva Learning-Management-SystemA vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown… | |
| CVE-2026-105922 | 6 Oct 2026 | CVSS 4.3 | vllm-project vLLMA security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file… | |
| CVE-2026-105793 | 6 Oct 2026 | CVSS 9.1 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in… | |
| CVE-2026-105794 | 6 Oct 2026 | CVSS 9.1 | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLMsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic… | Fix |
| CVE-2026-105795 | 6 Oct 2026 | CVSS 3.1 | Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsKiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path… | Fix |
| CVE-2026-105796 | 6 Oct 2026 | CVSS 8.8 | Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsKiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete… | Fix |
| CVE-2026-105797 | 6 Oct 2026 | CVSS 8.8 | microsoft simplechatSimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and… |
Page 112 of 168