[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105698 | 5 Oct 2026 | CVSS 5.4 | Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpointsLangflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the… | Fix |
| CVE-2026-105699 | 5 Oct 2026 | CVSS 7.1 | Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersLangflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project… | Fix |
| CVE-2026-105740 | 5 Oct 2026 | CVSS 9.9 | langflow-ai langflowLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote… | |
| CVE-2026-105741 | 5 Oct 2026 | CVSS 7.1 | Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration WriteLangflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model… | Fix |
| CVE-2026-105768 | 5 Oct 2026 | CVSS 6.3 | chainguard-dev apkoapko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and… | |
| CVE-2026-105438 | 5 Oct 2026 | CVSS 4.3 | O2OAA flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file… | |
| CVE-2026-105444 | 5 Oct 2026 | CVSS 6.3 | dotnet eShopA security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file… | |
| CVE-2026-105447 | 5 Oct 2026 | CVSS 5.5 | Red Hat Quay 3A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing… | |
| CVE-2026-101893 | 5 Oct 2026 | CVSS 4.4 | Newell Brands DYMO IDNewell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses… | |
| CVE-2026-102262 | 5 Oct 2026 | CVSS 7.3 | Newell Brands DYMO IDNewell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file… | |
| CVE-2026-95263 | 5 Oct 2026 | CVSS 7.2 | VulnerabilityFeehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the… | |
| CVE-2026-95264 | 5 Oct 2026 | CVSS 6.5 | VulnerabilityFeehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable… | |
| CVE-2026-95265 | 5 Oct 2026 | CVSS 7.5 | VulnerabilityFeehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not… | |
| CVE-2026-97257 | 5 Oct 2026 | CVSS 8.8 | PressTigers Simple Event PlannerDeserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects… | |
| CVE-2026-93617 | 5 Oct 2026 | CVSS 7.2 | WP Sunshine Sunshine Photo CartDeserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects… | |
| CVE-2026-94201 | 5 Oct 2026 | CVSS 8.2 | ash-project ashAsh stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is… | |
| CVE-2026-78860 | 5 Oct 2026 | CVSS 7.8 | VulnerabilityAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext | |
| CVE-2026-78861 | 5 Oct 2026 | CVSS 7.7 | VulnerabilityAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key | |
| CVE-2026-78862 | 5 Oct 2026 | CVSS 6.8 | VulnerabilityAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB) | |
| CVE-2026-71297 | 5 Oct 2026 | CVSS 5.4 | Red Hat Multicluster Engine for KubernetesA flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication… | |
| CVE-2026-71298 | 5 Oct 2026 | CVSS 6.4 | Red Hat Multicluster Engine for KubernetesA flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list… | |
| CVE-2026-71299 | 5 Oct 2026 | CVSS 6.5 | Red Hat Multicluster Engine for KubernetesA flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to… | |
| CVE-2026-105695 | 5 Oct 2026 | CVSS 5.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID… | |
| CVE-2026-105696 | 5 Oct 2026 | CVSS 6.5 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read… | |
| CVE-2026-105766 | 5 Oct 2026 | CVSS 3.1 | Chainguard Academy (edu)Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit… | |
| CVE-2026-105767 | 5 Oct 2026 | CVSS 3.3 | Chainguard Academy (edu)Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu)… | |
| CVE-2026-105691 | 5 Oct 2026 | CVSS 9.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color… | |
| CVE-2026-105692 | 5 Oct 2026 | CVSS 5.4 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and… | |
| CVE-2026-105693 | 5 Oct 2026 | CVSS 5.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row… | |
| CVE-2026-105694 | 5 Oct 2026 | CVSS 5.4 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose… | |
| CVE-2026-105688 | 5 Oct 2026 | CVSS 6.7 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a… | |
| CVE-2026-105689 | 5 Oct 2026 | CVSS 6.0 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that… | |
| CVE-2026-105690 | 5 Oct 2026 | CVSS 5.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the… | |
| CVE-2026-105683 | 5 Oct 2026 | CVSS 3.8 | Ghost: Path Traversal Vulnerability in Ghost ImageSize ServiceGhost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files… | Fix |
| CVE-2026-105684 | 5 Oct 2026 | CVSS 4.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands… | |
| CVE-2026-105686 | 5 Oct 2026 | CVSS 5.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but… | |
| CVE-2026-105687 | 5 Oct 2026 | CVSS 4.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any… | |
| CVE-2026-105681 | 5 Oct 2026 | CVSS 6.5 | Ghost: Authorization Bypass in Comments FeatureGhost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not… | Fix |
| CVE-2026-105682 | 5 Oct 2026 | CVSS 2.7 | Ghost: Server-Side Request Forgery in Webhook TriggerGhost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe… | Fix |
| CVE-2026-105679 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via File Uploads on Local StorageGhost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent… | Fix |
| CVE-2026-105680 | 5 Oct 2026 | CVSS 6.5 | Ghost: Authorization Issue Allowed Author Role to Delete any PostGhost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not… | Fix |
| CVE-2026-105651 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via Bookmark Card ImagesGhost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from… | Fix |
| CVE-2026-105652 | 5 Oct 2026 | CVSS 3.1 | Ghost: Password Hash Ordering Disclosure in Ghost Admin APIGhost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other… | Fix |
| CVE-2026-105675 | 5 Oct 2026 | CVSS 7.5 | Ghost: Invite Token Disclosure in Ghost Admin APIGhost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the… | Fix |
| CVE-2026-105676 | 5 Oct 2026 | CVSS 4.9 | Ghost: Path Traversal via Locale SettingGhost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an… | Fix |
| CVE-2026-105677 | 5 Oct 2026 | CVSS 7.2 | Ghost: Remote Code Execution via Theme Translation FilesGhost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an… | Fix |
| CVE-2026-105678 | 5 Oct 2026 | CVSS 4.3 | Ghost: Editors Could Promote Staff Users to Their Own RoleGhost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own… | Fix |
| CVE-2026-105647 | 5 Oct 2026 | CVSS 4.0 | Ghost: Server-Side Request Forgery in Bookmark FetchingGhost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be… | Fix |
| CVE-2026-105648 | 5 Oct 2026 | CVSS 4.0 | Ghost: Private IP Filtering Bypass via IPv6 Transition AddressesGhost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be… | Fix |
| CVE-2026-105649 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via SVG Uploads Bypassing SanitizationGhost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension… | Fix |
| CVE-2026-105650 | 5 Oct 2026 | CVSS 8.1 | Ghost: Stored XSS via oEmbed Photo ResponsesGhost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted… | Fix |
| CVE-2026-105388 | 5 Oct 2026 | CVSS 6.3 | feelec-yishu feelcrm-osA weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file… | |
| CVE-2026-105389 | 5 Oct 2026 | CVSS 6.3 | feelec-yishu feelcrm-osA security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file… | |
| CVE-2026-105392 | 5 Oct 2026 | CVSS 7.3 | Lybbn Django-Vue-LyadminA vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file… | |
| CVE-2026-103066 | 5 Oct 2026 | CVSS 8.5 | WP BASE BookingImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking… | |
| CVE-2026-103337 | 5 Oct 2026 | CVSS 6.5 | Kirillbdev WC Ukraine ShippingMissing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-103348 | 5 Oct 2026 | CVSS 7.2 | Smackcoders Inc. WP Ultimate ExporterDeserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue… | |
| CVE-2026-104029 | 5 Oct 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket… | |
| CVE-2026-104030 | 5 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey… | |
| CVE-2026-100511 | 5 Oct 2026 | CVSS 8.8 | Vektor Inc. VK Google Job Posting ManagerDeserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object… | |
| CVE-2026-100506 | 5 Oct 2026 | CVSS 7.2 | WP Spell CheckDeserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell… | |
| CVE-2026-97283 | 5 Oct 2026 | CVSS 9.8 | Liquid Web / StellarWP Advanced Post ManagerDeserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This… | |
| CVE-2026-97303 | 5 Oct 2026 | CVSS 7.6 | Apps Mav Scratch & Win – Giveaways and ContestsMissing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting… | |
| CVE-2026-97304 | 5 Oct 2026 | CVSS 6.5 | Arraytics TimeticsMissing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-97305 | 5 Oct 2026 | CVSS 6.9 | Themeisle AI Chatbot for WordPress – Hyve LiteAuthorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting… | |
| CVE-2026-97309 | 5 Oct 2026 | CVSS 7.1 | Webful Creations RepairBuddyMissing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects… | |
| CVE-2026-88424 | 5 Oct 2026 | CVSS 9.8 | VulnerabilityFineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This… | |
| CVE-2026-95165 | 5 Oct 2026 | CVSS 6.1 | VulnerabilityBacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. | |
| CVE-2026-95166 | 5 Oct 2026 | CVSS 5.4 | VulnerabilityIn Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload. | |
| CVE-2026-97070 | 5 Oct 2026 | CVSS 6.9 | CozyThemes Cozy BlocksAuthorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-97275 | 5 Oct 2026 | CVSS 5.3 | VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderImproper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder… | |
| CVE-2026-58859 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no… | Fix |
| CVE-2026-58865 | 5 Oct 2026 | CVSS 7.5 | Google AndroidIn multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote… | Fix |
| CVE-2026-58880 | 5 Oct 2026 | CVSS 7.0 | Google AndroidIn handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local… | Fix |
| CVE-2026-55270 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of… | Fix |
| CVE-2026-55280 | 5 Oct 2026 | CVSS 8.8 | Google AndroidIn multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no… | Fix |
| CVE-2026-55286 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation… | Fix |
| CVE-2026-58815 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… | Fix |
| CVE-2026-58834 | 5 Oct 2026 | CVSS 5.5 | Google AndroidIn setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation… | Fix |
| CVE-2026-58835 | 5 Oct 2026 | CVSS 8.8 | Google AndroidIn cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with… | Fix |
| CVE-2026-58841 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to… | Fix |
| CVE-2026-58854 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no… | Fix |
| CVE-2026-58856 | 5 Oct 2026 | CVSS 3.3 | Google AndroidIn returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could… | Fix |
| CVE-2026-55265 | 5 Oct 2026 | CVSS 6.5 | Google AndroidIn multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of… | |
| CVE-2026-55266 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of… | |
| CVE-2026-55269 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local… | |
| CVE-2026-49937 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local… | |
| CVE-2026-28641 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in… | |
| CVE-2026-28647 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead… | |
| CVE-2026-28648 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional… | |
| CVE-2026-28667 | 5 Oct 2026 | CVSS 5.5 | Google AndroidIn multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information… | |
| CVE-2026-45524 | 5 Oct 2026 | CVSS 8.8 | Google AndroidIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of… | |
| CVE-2026-49878 | 5 Oct 2026 | CVSS 7.2 | Google AndroidIn wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to… | |
| CVE-2026-49880 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation… | |
| CVE-2026-49885 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of… | |
| CVE-2026-49933 | 5 Oct 2026 | CVSS 7.8 | Google AndroidIn handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized… | |
| CVE-2026-105644 | 5 Oct 2026 | CVSS 6.8 | Ghost : Stored XSS via SVG Files in Content ImportsGhost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An… | Fix |
| CVE-2026-105645 | 5 Oct 2026 | CVSS 4.9 | Ghost: Regular Expression Denial of Service in External Media InlinerGhost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU… | Fix |
| CVE-2026-105646 | 5 Oct 2026 | CVSS 4.9 | Ghost: Regular Expression Denial of Service in Content ImportGhost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the… | Fix |
| CVE-2026-105712 | 5 Oct 2026 | CVSS 3.6 | GnuPGgpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C)… |
Page 118 of 168