[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-25273 | 6 Oct 2026 | CVSS 6.7 | Qualcomm, Inc. SnapdragonMemory Corruption when processing camera operations due to out-of-bounds write during driver updates. | Fix |
| CVE-2026-25274 | 6 Oct 2026 | CVSS 6.7 | Qualcomm, Inc. SnapdragonMemory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. | |
| CVE-2026-25291 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. | Fix |
| CVE-2026-105701 | 6 Oct 2026 | CVSS 8.8 | Mauro Cassani ACPT (Premium)The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function… | |
| CVE-2026-105776 | 6 Oct 2026 | CVSS 7.3 | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCLA flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4… | |
| CVE-2026-105778 | 6 Oct 2026 | CVSS 9.9 | Tenda AC5A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of… | |
| CVE-2026-25263 | 6 Oct 2026 | CVSS 6.6 | Qualcomm, Inc. SnapdragonMemory corruption while processing IOCTL command called from user space to the kernel with invalid parameters. | |
| CVE-2026-25267 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory corruption when non-secure loader rewrites page tables before secure memory initialization. | |
| CVE-2026-97300 | 6 Oct 2026 | CVSS 6.5 | Arraytics WP Event SolutionUnauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. | |
| CVE-2026-39760 | 6 Oct 2026 | CVSS 7.1 | Creative interactive media Real 3D FlipBookUnauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. | |
| CVE-2026-39789 | 6 Oct 2026 | CVSS 7.5 | WP Manage Ninja Fluent Affiliate ProUnauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. | |
| CVE-2026-41558 | 6 Oct 2026 | CVSS 7.5 | WP Synchro WP Migration Plugin DB & Files – WP SynchroSubscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions. | |
| CVE-2026-41563 | 6 Oct 2026 | CVSS 7.5 | Dawer Drew SitemovrUnauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. | |
| CVE-2026-75962 | 6 Oct 2026 | CVSS 7.2 | saadiqbal Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile AppThe Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable… | |
| CVE-2026-105708 | 6 Oct 2026 | CVSS 4.3 | imgproxyA flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of… | |
| CVE-2026-105775 | 6 Oct 2026 | CVSS 4.3 | vllm-project vLLMA security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file… | |
| CVE-2026-32576 | 6 Oct 2026 | CVSS 6.5 | ZWEISCHNEIDER Faktur Pro for WooCommerceAuthorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly… | |
| CVE-2026-32582 | 6 Oct 2026 | CVSS 6.5 | iatoai IATO MCPMissing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-39599 | 6 Oct 2026 | CVSS 4.3 | wallstrdev WDS MCP Content ManagerContributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. | |
| CVE-2026-39723 | 6 Oct 2026 | CVSS 7.5 | Green Invoice Morning for WooCommerceMissing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-105072 | 6 Oct 2026 | CVSS 7.5 | WP Manage Ninja FluentBooking ProUnauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. | |
| CVE-2026-105706 | 6 Oct 2026 | CVSS 4.3 | SourceCodester Drug Recommendation SystemA weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead… | |
| CVE-2026-105707 | 6 Oct 2026 | CVSS 5.3 | uptraceA security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file… | |
| CVE-2026-105704 | 6 Oct 2026 | CVSS 7.3 | SourceCodester Drug Recommendation SystemA vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such… | |
| CVE-2026-105705 | 6 Oct 2026 | CVSS 4.3 | SourceCodester Drug Recommendation SystemA security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file… | |
| CVE-2026-105621 | 6 Oct 2026 | CVSS 5.4 | jishenghua jshERPA security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file… | |
| CVE-2026-105703 | 6 Oct 2026 | CVSS 4.7 | PHPGurukul User Registration & Login and User Management SystemA vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of… | |
| CVE-2026-105611 | 6 Oct 2026 | CVSS 2.7 | chillzhuang SpringBladeA vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file… | |
| CVE-2026-105573 | 6 Oct 2026 | CVSS 4.3 | newbee-ltd newbee-mallA vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file… | |
| CVE-2026-105610 | 6 Oct 2026 | CVSS 4.7 | chillzhuang SpringBladeA vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file… | |
| CVE-2026-105572 | 6 Oct 2026 | CVSS 4.3 | PickMall LilishopA vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component… | |
| CVE-2026-105484 | 6 Oct 2026 | CVSS 10.0 | TOTOLINK X6000RA security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file… | |
| CVE-2026-105486 | 6 Oct 2026 | CVSS 7.3 | OSSRS srsA vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component… | |
| CVE-2026-105487 | 6 Oct 2026 | CVSS 6.3 | yogeshojha reNgineA vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file… | |
| CVE-2026-105571 | 6 Oct 2026 | CVSS 7.3 | PickMall LilishopA flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of… | |
| CVE-2026-104039 | 6 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic… | |
| CVE-2026-104040 | 6 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped… | |
| CVE-2026-104041 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS)… | |
| CVE-2026-104042 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request… | |
| CVE-2026-104043 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by… | |
| CVE-2026-104044 | 6 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM)… | |
| CVE-2026-104380 | 6 Oct 2026 | CVSS 5.3 | VulnerabilityPunk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and… | |
| CVE-2026-92821 | 6 Oct 2026 | CVSS 6.8 | Red Hat Enterprise Linux 10A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory… | |
| CVE-2026-105472 | 6 Oct 2026 | CVSS 6.3 | girishsaraf Online-Appointment-Booking-SystemA weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element… | |
| CVE-2026-104033 | 6 Oct 2026 | CVSS 5.4 | Red Hat Enterprise Linux 10A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD… | |
| CVE-2026-104034 | 6 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting… | |
| CVE-2026-104035 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by… | |
| CVE-2026-104036 | 6 Oct 2026 | CVSS 5.8 | Red Hat Enterprise Linux 10A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination… | |
| CVE-2026-104037 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs… | |
| CVE-2026-104038 | 6 Oct 2026 | CVSS 5.9 | Red Hat Enterprise Linux 10A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security… | |
| CVE-2026-104031 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is… | |
| CVE-2026-104032 | 6 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing… | |
| CVE-2026-82989 | 6 Oct 2026 | CVSS 9.8 | Viewsonic vCastThere is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject… | |
| CVE-2026-82988 | 6 Oct 2026 | CVSS 7.5 | Viewsonic vCastThere exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to… | |
| CVE-2026-105785 | 6 Oct 2026 | CVSS 4.8 | laurent22 joplinJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2… | |
| CVE-2026-105786 | 6 Oct 2026 | CVSS 8.5 | laurent22 joplinJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13… | |
| CVE-2026-105762 | 6 Oct 2026 | CVSS 8.3 | langgenius difyDify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in… | |
| CVE-2026-105763 | 6 Oct 2026 | CVSS 9.6 | twentyhq twentyTwenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query… | |
| CVE-2026-105764 | 6 Oct 2026 | CVSS 7.7 | immich-app immichImmich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files… | |
| CVE-2026-105782 | 6 Oct 2026 | CVSS 7.5 | scrapyScrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in… | |
| CVE-2026-105783 | 6 Oct 2026 | CVSS 8.0 | laurent22 joplinJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is… | |
| CVE-2026-105784 | 6 Oct 2026 | CVSS 4.6 | laurent22 joplinJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note… | |
| CVE-2026-105471 | 6 Oct 2026 | CVSS 7.3 | girishsaraf Online-Appointment-Booking-SystemA security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an… | |
| CVE-2026-105761 | 5 Oct 2026 | CVSS 7.1 | langgenius difyDify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in… | |
| CVE-2026-105754 | 5 Oct 2026 | CVSS 6.5 | vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresvLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated… | Fix |
| CVE-2026-105755 | 5 Oct 2026 | CVSS 4.2 | vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank… | Fix |
| CVE-2026-105756 | 5 Oct 2026 | CVSS 6.5 | vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of servicevLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt… | Fix |
| CVE-2026-105757 | 5 Oct 2026 | CVSS 6.5 | vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped… | Fix |
| CVE-2026-105758 | 5 Oct 2026 | CVSS 5.3 | vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reachvLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes… | Fix |
| CVE-2026-105759 | 5 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw… | Fix |
| CVE-2026-105760 | 5 Oct 2026 | CVSS 5.3 | vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustionvLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to… | Fix |
| CVE-2026-105469 | 5 Oct 2026 | CVSS 7.3 | girishsaraf Online-Appointment-Booking-SystemA vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability… | |
| CVE-2026-105470 | 5 Oct 2026 | CVSS 7.3 | girishsaraf Online-Appointment-Booking-SystemA vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects… | |
| CVE-2026-105752 | 5 Oct 2026 | CVSS 3.1 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oraclevLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses"… | Fix |
| CVE-2026-105753 | 5 Oct 2026 | CVSS 6.5 | vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine corevLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash… | Fix |
| CVE-2026-104852 | 5 Oct 2026 | CVSS 8.2 | GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep… | Fix |
| CVE-2026-105750 | 5 Oct 2026 | CVSS 7.5 | Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until… | Fix |
| CVE-2026-105751 | 5 Oct 2026 | CVSS 7.5 | Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backendDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until… | Fix |
| CVE-2026-21589 | 5 Oct 2026 | CVSS 7.5 | Unauthenticated file read in Atlassian Data Center productsThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data… | ExploitedFix |
| CVE-2026-91107 | 5 Oct 2026 | CVSS 9.3 | OS4ED openSIS-ClassicopenSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the… | |
| CVE-2026-93315 | 5 Oct 2026 | CVSS 5.8 | moby BuildKitWhen proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside… | |
| CVE-2026-93321 | 5 Oct 2026 | CVSS 6.9 | moby BuildKitA malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | |
| CVE-2026-105743 | 5 Oct 2026 | CVSS 5.8 | Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until… | Fix |
| CVE-2026-105744 | 5 Oct 2026 | CVSS 8.8 | Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engineDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until… | Fix |
| CVE-2026-105745 | 5 Oct 2026 | CVSS 7.8 | Docling imports plugin entry points before the allow_external_plugins checkDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until… | Fix |
| CVE-2026-105746 | 5 Oct 2026 | CVSS 5.3 | docling-project doclingDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until… | Fix |
| CVE-2026-105747 | 5 Oct 2026 | CVSS 4.3 | Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until… | Fix |
| CVE-2026-105748 | 5 Oct 2026 | CVSS 4.3 | Docling: Crafted DoclingDocument JSON embeds local image files into converted outputDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until… | Fix |
| CVE-2026-105749 | 5 Oct 2026 | CVSS 6.5 | Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until… | Fix |
| CVE-2026-0482 | 5 Oct 2026 | CVSS 5.4 | AMD Alveo™ Accelerator CardsIn AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted… | |
| CVE-2026-103433 | 5 Oct 2026 | CVSS 6.9 | Docker BuildxDocker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable… | |
| CVE-2026-103546 | 5 Oct 2026 | CVSS 4.3 | MongoDB, Inc. Mongodb Controllers for KubernetesIn MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager… | |
| CVE-2026-105468 | 5 Oct 2026 | CVSS 7.3 | girishsaraf Online-Appointment-Booking-SystemA vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function… | |
| CVE-2026-105742 | 5 Oct 2026 | CVSS 5.3 | Docling: Configured HTTP headers sent to every remote image host named by a documentDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until… | Fix |
| CVE-2026-0461 | 5 Oct 2026 | CVSS 7.5 | AMD Zynq™ UltraScale+ MPSoCsInsufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device… | |
| CVE-2026-77226 | 5 Oct 2026 | CVSS 8.1 | Camunda 7Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where… | |
| CVE-2026-84900 | 5 Oct 2026 | CVSS 6.8 | HP Inc ThinPro 8.1Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1… | |
| CVE-2026-93326 | 5 Oct 2026 | CVSS 6.0 | moby BuildKitA build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the… | |
| CVE-2026-105773 | 5 Oct 2026 | CVSS 7.0 | Canimaan Software ClamXAVCanimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race… | |
| CVE-2026-105697 | 5 Oct 2026 | CVSS 9.9 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationLangflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever… | Fix |
Page 117 of 168