[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104612 | 2 Oct 2026 | CVSS 4.3 | SourceCodester Student Result Management SystemA vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file… | |
| CVE-2026-102797 | 2 Oct 2026 | CVSS 6.4 | ThemeREX Group ThemeREX AddonsServer-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects… | |
| CVE-2026-102798 | 2 Oct 2026 | CVSS 6.5 | ThemeREX Group ThemeREX AddonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons… | |
| CVE-2026-94653 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftInefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are… | |
| CVE-2026-96288 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftUncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects… | |
| CVE-2026-96292 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftInefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache… | |
| CVE-2026-96294 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftUncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift… | |
| CVE-2026-94636 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftImproper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of… | |
| CVE-2026-94637 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftImproper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before… | |
| CVE-2026-94638 | 2 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache ThriftAllocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0… | |
| CVE-2026-94646 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftUncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype… | |
| CVE-2026-94648 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftAllocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0… | |
| CVE-2026-94652 | 2 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache ThriftMissing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0… | |
| CVE-2026-86536 | 2 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache ThriftImproperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue… | |
| CVE-2026-86537 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftUncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D… | |
| CVE-2026-87117 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftNULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to… | |
| CVE-2026-90440 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftUncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D… | |
| CVE-2026-92834 | 2 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache ThriftUse of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift… | |
| CVE-2026-82458 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftMemory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml… | |
| CVE-2026-82459 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftInteger underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache… | |
| CVE-2026-85086 | 2 Oct 2026 | CVSS 6.9 | Apache Software Foundation Apache ThriftImproper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue… | |
| CVE-2026-85087 | 2 Oct 2026 | CVSS 6.9 | Apache Software Foundation Apache ThriftImproper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before… | |
| CVE-2026-85088 | 2 Oct 2026 | CVSS 6.9 | Apache Software Foundation Apache ThriftImproper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager… | |
| CVE-2026-86535 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftLoop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution')… | |
| CVE-2026-104471 | 2 Oct 2026 | CVSS 7.2 | yeswikiYesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the… | |
| CVE-2026-104472 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to… | |
| CVE-2026-104473 | 2 Oct 2026 | CVSS 6.1 | yeswikiYesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through… | |
| CVE-2026-104609 | 2 Oct 2026 | CVSS 7.3 | onetwothreeneth HospitalManagementSystemA weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function… | |
| CVE-2026-61373 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftAllocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift… | |
| CVE-2026-104465 | 2 Oct 2026 | CVSS 6.1 | yeswikiYesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field… | |
| CVE-2026-104466 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post… | |
| CVE-2026-104467 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call… | |
| CVE-2026-104468 | 2 Oct 2026 | CVSS 4.8 | yeswikiYesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens… | |
| CVE-2026-104469 | 2 Oct 2026 | CVSS 6.8 | yeswikiYesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not… | |
| CVE-2026-104470 | 2 Oct 2026 | CVSS 5.0 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the… | |
| CVE-2026-104460 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into… | |
| CVE-2026-104461 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension… | |
| CVE-2026-104462 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw… | |
| CVE-2026-104463 | 2 Oct 2026 | CVSS 7.0 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending… | |
| CVE-2026-104464 | 2 Oct 2026 | CVSS 8.6 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by… | |
| CVE-2026-104453 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by… | |
| CVE-2026-104454 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex… | |
| CVE-2026-104455 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the… | |
| CVE-2026-104456 | 2 Oct 2026 | CVSS 7.6 | yeswikiYesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated… | |
| CVE-2026-104457 | 2 Oct 2026 | CVSS 8.6 | yeswikiYesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes… | |
| CVE-2026-104458 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the… | |
| CVE-2026-104459 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS… | |
| CVE-2026-104448 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET… | |
| CVE-2026-104449 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages… | |
| CVE-2026-104450 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an… | |
| CVE-2026-104451 | 2 Oct 2026 | CVSS 4.3 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions… | |
| CVE-2026-104452 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET… | |
| CVE-2026-104442 | 2 Oct 2026 | CVSS 5.8 | yeswikiYesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch… | |
| CVE-2026-104443 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary… | |
| CVE-2026-104444 | 2 Oct 2026 | CVSS 7.1 | yeswikiYesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege… | |
| CVE-2026-104445 | 2 Oct 2026 | CVSS 8.2 | yeswikiYesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer… | |
| CVE-2026-104446 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through… | |
| CVE-2026-104447 | 2 Oct 2026 | CVSS 7.1 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed… | |
| CVE-2026-104435 | 2 Oct 2026 | CVSS 7.4 | ZcashFoundation zebraZebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that… | |
| CVE-2026-104436 | 2 Oct 2026 | CVSS 3.7 | ZcashFoundation zebraZebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by… | |
| CVE-2026-104437 | 2 Oct 2026 | CVSS 7.4 | ZcashFoundation zebraZebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for… | |
| CVE-2026-104438 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate… | |
| CVE-2026-104439 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered… | |
| CVE-2026-104440 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side… | |
| CVE-2026-104441 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch… | |
| CVE-2026-104427 | 2 Oct 2026 | CVSS 5.9 | ZcashFoundation zebraZebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node… | |
| CVE-2026-104428 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraThe getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because… | |
| CVE-2026-104429 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because… | |
| CVE-2026-104430 | 2 Oct 2026 | CVSS 7.5 | ZcashFoundation zebraZebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode… | |
| CVE-2026-104431 | 2 Oct 2026 | CVSS 7.5 | ZcashFoundation zebraZebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool… | |
| CVE-2026-104432 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses… | |
| CVE-2026-104434 | 2 Oct 2026 | CVSS 6.5 | ZcashFoundation zebraZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which… | |
| CVE-2026-104421 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving… | |
| CVE-2026-104422 | 2 Oct 2026 | CVSS 7.5 | ZcashFoundation zebraThe block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that… | |
| CVE-2026-104423 | 2 Oct 2026 | CVSS 7.5 | ZcashFoundation zebraZebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification… | |
| CVE-2026-104424 | 2 Oct 2026 | CVSS 3.7 | ZcashFoundation zebraZebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count… | |
| CVE-2026-104425 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by… | |
| CVE-2026-104426 | 2 Oct 2026 | CVSS 5.9 | ZcashFoundation zebraZebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level… | |
| CVE-2026-104414 | 2 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post… | |
| CVE-2026-104415 | 2 Oct 2026 | CVSS 3.1 | TryGhost GhostGhost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the… | |
| CVE-2026-104416 | 2 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of… | |
| CVE-2026-104417 | 2 Oct 2026 | CVSS 4.9 | TryGhost GhostGhost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to… | |
| CVE-2026-104418 | 2 Oct 2026 | CVSS 7.2 | TryGhost GhostGhost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme… | |
| CVE-2026-104419 | 2 Oct 2026 | CVSS 4.8 | ZcashFoundation zebraZebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban… | |
| CVE-2026-104420 | 2 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid… | |
| CVE-2026-103763 | 2 Oct 2026 | CVSS 5.8 | siyuan-note siyuanSiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded… | |
| CVE-2026-104410 | 2 Oct 2026 | CVSS 7.5 | siyuan-note siyuanSiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled… | |
| CVE-2026-104411 | 2 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files… | |
| CVE-2026-104412 | 2 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own… | |
| CVE-2026-104413 | 2 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host… | |
| CVE-2026-103762 | 2 Oct 2026 | CVSS 5.3 | siyuan-note siyuanSiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath… | |
| CVE-2026-96990 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftAllocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0… | |
| CVE-2026-97876 | 2 Oct 2026 | CVSS 6.4 | GNU grub2A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB… | |
| CVE-2026-94633 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftMemory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This… | |
| CVE-2026-94642 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftUncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to… | |
| CVE-2026-94644 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftAllocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0… | |
| CVE-2026-94645 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftImproper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs… | |
| CVE-2026-94650 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftUncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to… | |
| CVE-2026-94651 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Thriftimproper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This… | |
| CVE-2026-91135 | 2 Oct 2026 | CVSS 9.2 | Apache Software Foundation Apache ThriftHeap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it… |
Page 125 of 168