[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105798 | 6 Oct 2026 | CVSS 8.7 | microsoft simplechatSimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST… | |
| CVE-2026-105791 | 6 Oct 2026 | CVSS 7.5 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the… | |
| CVE-2026-105792 | 6 Oct 2026 | CVSS 6.5 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name}… | |
| CVE-2026-104069 | 6 Oct 2026 | CVSS 7.2 | danielbrendel hortusfox-webHortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly… | |
| CVE-2025-8352 | 6 Oct 2026 | CVSS 6.9 | ESET spol. s.r.o ESET PROTECT On-PremAllocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to… | |
| CVE-2026-91140 | 6 Oct 2026 | CVSS 9.6 | Progress Software Autonomous REST Connector GenAI AgentsAn OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI… | |
| CVE-2026-85523 | 6 Oct 2026 | CVSS 8.8 | Felisify Information Technologies Industry and Trade Inc. SambaBoxImproper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies… | |
| CVE-2026-87890 | 6 Oct 2026 | CVSS 5.3 | djangoproject DjangoAn issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial… | |
| CVE-2026-87975 | 6 Oct 2026 | CVSS 4.3 | djangoproject DjangoAn issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18… | |
| CVE-2026-77050 | 6 Oct 2026 | CVSS 5.3 | djangoproject DjangoAn issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18… | |
| CVE-2026-77178 | 6 Oct 2026 | CVSS 9.1 | VulnerabilityOracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the… | |
| CVE-2026-82924 | 6 Oct 2026 | CVSS 5.3 | Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert MailImproper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows… | |
| CVE-2026-84429 | 6 Oct 2026 | CVSS 5.3 | djangoproject DjangoAn issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was… | |
| CVE-2026-34498 | 6 Oct 2026 | CVSS 5.1 | Johnson Controls Illustra Standard - L4L ChinaImproper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects… | |
| CVE-2026-12380 | 6 Oct 2026 | CVSS 6.1 | Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce PackImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co… | |
| CVE-2026-106039 | 6 Oct 2026 | CVSS 6.5 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and… | |
| CVE-2026-106040 | 6 Oct 2026 | CVSS 8.2 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's… | |
| CVE-2026-106041 | 6 Oct 2026 | CVSS 6.5 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed… | |
| CVE-2026-106026 | 6 Oct 2026 | CVSS 3.7 | H. Peter Anvin tftp-hpatftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label… | |
| CVE-2026-106037 | 6 Oct 2026 | CVSS 9.8 | kvcache-ai MooncakeMooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without… | |
| CVE-2026-106038 | 6 Oct 2026 | CVSS 8.2 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any… | |
| CVE-2026-105839 | 6 Oct 2026 | CVSS 7.8 | sezero libmikmodlibmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via… | |
| CVE-2026-105840 | 6 Oct 2026 | CVSS 7.5 | Uwe Ohse lrzszlrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to… | |
| CVE-2026-105841 | 6 Oct 2026 | CVSS 7.5 | Uwe Ohse lrzszlrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute… | |
| CVE-2026-105842 | 6 Oct 2026 | CVSS 6.4 | Uwe Ohse lrzszlrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong… | |
| CVE-2026-105920 | 6 Oct 2026 | CVSS 7.3 | Kusalkasilva Learning-Management-SystemA vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an… | |
| CVE-2026-105788 | 6 Oct 2026 | CVSS 8.8 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app… | |
| CVE-2026-105789 | 6 Oct 2026 | CVSS 5.4 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in… | |
| CVE-2026-105790 | 6 Oct 2026 | CVSS 6.4 | microsoft UFOMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration… | |
| CVE-2026-105837 | 6 Oct 2026 | CVSS 7.8 | sezero libmikmodlibmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow… | |
| CVE-2026-105838 | 6 Oct 2026 | CVSS 5.5 | sezero libmikmodlibmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read… | |
| CVE-2025-15591 | 6 Oct 2026 | CVSS 5.3 | OpenText Content ManagementCross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into… | |
| CVE-2026-82531 | 6 Oct 2026 | CVSS 8.1 | smarty-php smartySmarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during… | |
| CVE-2026-105919 | 6 Oct 2026 | CVSS 7.3 | Kusalkasilva Learning-Management-SystemA vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the… | |
| CVE-2026-106016 | 6 Oct 2026 | CVSS 9.8 | Mozilla FirefoxMitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. | Fix |
| CVE-2026-105834 | 6 Oct 2026 | CVSS 6.5 | rundeckRundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files… | |
| CVE-2026-105835 | 6 Oct 2026 | CVSS 7.4 | plankaPLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force… | |
| CVE-2026-105836 | 6 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows… | |
| CVE-2026-56596 | 6 Oct 2026 | CVSS 3.5 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or… | |
| CVE-2026-105918 | 6 Oct 2026 | CVSS 7.3 | Kusalkasilva Learning-Management-SystemA vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function… | |
| CVE-2026-75820 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a… | |
| CVE-2026-75818 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly… | |
| CVE-2026-75819 | 6 Oct 2026 | CVSS 1.8 | GNU AspellGNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it… | |
| CVE-2026-105985 | 6 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any… | |
| CVE-2026-103831 | 6 Oct 2026 | CVSS 7.5 | TrueLayer Magento 2 PluginCVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's… | |
| CVE-2026-84854 | 6 Oct 2026 | CVSS 7.0 | wibu-systems-ag wibukeyIn the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause… | |
| CVE-2026-80327 | 6 Oct 2026 | CVSS 5.1 | Ping Identity PingGatewayAn open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0… | |
| CVE-2026-98368 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the… | |
| CVE-2026-98369 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for… | |
| CVE-2026-98370 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the… | |
| CVE-2026-98371 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner tot_len When the start of… | |
| CVE-2026-98372 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()… | |
| CVE-2026-98362 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate dvfs_get_idx() may… | |
| CVE-2026-98363 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS… | |
| CVE-2026-98364 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create()… | |
| CVE-2026-98365 | 6 Oct 2026 | CVSS 9.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access… | |
| CVE-2026-98366 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxe_rereg_user_mr()… | |
| CVE-2026-98367 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We… | |
| CVE-2026-98355 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if `init_path()` errors… | |
| CVE-2026-98356 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup… | |
| CVE-2026-98357 | 6 Oct 2026 | CVSS 8.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the… | |
| CVE-2026-98358 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write… | |
| CVE-2026-98359 | 6 Oct 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed… | |
| CVE-2026-98360 | 6 Oct 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds… | |
| CVE-2026-98361 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths Commit 0b261d7c1cd3… | |
| CVE-2026-98349 | 6 Oct 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses… | |
| CVE-2026-98350 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out auth_status on… | |
| CVE-2026-98351 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: free skb when disconnected When the simulated link is… | |
| CVE-2026-98352 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows… | |
| CVE-2026-98353 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ… | |
| CVE-2026-98354 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails… | |
| CVE-2026-98342 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device… | |
| CVE-2026-98343 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When… | |
| CVE-2026-98344 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes… | |
| CVE-2026-98345 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211_classify8021d() A frame that… | |
| CVE-2026-98346 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs… | |
| CVE-2026-98347 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush… | |
| CVE-2026-98348 | 6 Oct 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp()… | |
| CVE-2026-98335 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in… | |
| CVE-2026-98336 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on AP_VLAN interfaces AP_VLAN interfaces… | |
| CVE-2026-98337 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when… | |
| CVE-2026-98338 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we… | |
| CVE-2026-98339 | 6 Oct 2026 | CVSS 8.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an… | |
| CVE-2026-98340 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response… | |
| CVE-2026-98341 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down… | |
| CVE-2026-98328 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band… | |
| CVE-2026-98329 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames… | |
| CVE-2026-98330 | 6 Oct 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network… | |
| CVE-2026-98331 | 6 Oct 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only… | |
| CVE-2026-98332 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211_tdls_oper()… | |
| CVE-2026-98333 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface… | |
| CVE-2026-98334 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211_start_ap() can set… | |
| CVE-2026-98321 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat: unregister and release hooks on error If… | |
| CVE-2026-98322 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup… | |
| CVE-2026-98323 | 6 Oct 2026 | CVSS 9.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr()… | |
| CVE-2026-98324 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was… | |
| CVE-2026-98325 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit… | |
| CVE-2026-98326 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211_join_mesh()… | |
| CVE-2026-98327 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in… | |
| CVE-2026-98314 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer… |
Page 113 of 168