[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-79618 | 2 Oct 2026 | CVSS 4.3 | Unknown WP User FrontendThe WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers… | |
| CVE-2026-13413 | 2 Oct 2026 | CVSS 5.3 | Unknown CMP – Coming Soon & MaintenanceThe CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode… | |
| CVE-2026-15999 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpImproper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc… | |
| CVE-2026-16000 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpMissing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0… | |
| CVE-2026-16001 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpExposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block… | |
| CVE-2026-1661 | 2 Oct 2026 | CVSS 4.3 | Unknown WP Mail LoggingThe WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin… | |
| CVE-2026-63566 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpMemory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle… | |
| CVE-2026-102565 | 2 Oct 2026 | CVSS 7.2 | bookingalgorithms BA Book EverythingThe BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up… | |
| CVE-2026-92174 | 2 Oct 2026 | CVSS 7.5 | gpriday SiteOrigin Widgets BundleThe SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme'… | |
| CVE-2026-92820 | 2 Oct 2026 | CVSS 8.1 | SaturdayDrive Ninja Forms - File UploadsThe Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the… | |
| CVE-2026-94298 | 2 Oct 2026 | CVSS 6.2 | Unknown BuildKitThe BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and… | |
| CVE-2026-97317 | 2 Oct 2026 | CVSS 5.3 | Unknown Giveaways and Contests by RafflePressThe Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it… | |
| CVE-2026-97318 | 2 Oct 2026 | CVSS 6.1 | Unknown Giveaways and Contests by RafflePressThe Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it… | |
| CVE-2026-90438 | 2 Oct 2026 | CVSS 7.2 | kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form BuilderThe Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text… | |
| CVE-2026-90988 | 2 Oct 2026 | CVSS 5.3 | Unknown Request a QuoteThe Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing… | |
| CVE-2026-91022 | 2 Oct 2026 | CVSS 6.8 | Unknown MotorsThe Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute… | |
| CVE-2026-91023 | 2 Oct 2026 | CVSS 3.1 | Unknown MotorsThe Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its… | |
| CVE-2026-91828 | 2 Oct 2026 | CVSS 7.5 | Unknown OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an… | |
| CVE-2026-15897 | 2 Oct 2026 | CVSS 8.8 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316… | |
| CVE-2026-78471 | 2 Oct 2026 | CVSS 5.4 | optimizingmatters AutoptimizeThe Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including… | |
| CVE-2026-81740 | 2 Oct 2026 | CVSS 5.3 | Unknown Paytm Payment GatewayThe Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its… | |
| CVE-2026-84925 | 2 Oct 2026 | CVSS 6.1 | ThemeFusion Avada | Website Builder For WordPress & WooCommerceThe Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter… | |
| CVE-2026-85004 | 2 Oct 2026 | CVSS 4.3 | Unknown Popup MakerThe Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce… | |
| CVE-2026-85016 | 2 Oct 2026 | CVSS 6.8 | Unknown Unlimited Elements for ElementorThe Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in… | |
| CVE-2026-13718 | 2 Oct 2026 | CVSS 6.8 | Unknown Tabs ResponsiveThe Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing… | |
| CVE-2026-15896 | 2 Oct 2026 | CVSS 9.1 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316… | |
| CVE-2026-19660 | 2 Oct 2026 | CVSS 9.8 | DiviEngine Divi MembershipThe Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The… | |
| CVE-2026-10026 | 2 Oct 2026 | CVSS 7.2 | CTX Feed ProThe CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input… | |
| CVE-2026-93367 | 2 Oct 2026 | CVSS 7.2 | wp-buy Visitor Traffic Real Time Statistics proThe Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up… | |
| CVE-2026-14378 | 2 Oct 2026 | CVSS 9.8 | dplugins DevKit ProThe DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and… | |
| CVE-2026-104123 | 2 Oct 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of… | |
| CVE-2026-104120 | 2 Oct 2026 | CVSS 7.3 | modelcontextprotocol mcp-server-fetchA security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the… | |
| CVE-2026-104480 | 2 Oct 2026 | CVSS 9.4 | Discord libdaveDiscord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker… | |
| CVE-2026-21140 | 2 Oct 2026 | CVSS 6.9 | Samsung Mobile DevicesImproper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications. | |
| CVE-2026-104052 | 2 Oct 2026 | CVSS 6.3 | itsourcecode Pet Shop Management SystemA vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-104053 | 2 Oct 2026 | CVSS 6.3 | itsourcecode Pet Shop Management SystemA vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file… | |
| CVE-2026-104054 | 2 Oct 2026 | CVSS 6.3 | calcom cal.diyA security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file… | |
| CVE-2026-103097 | 2 Oct 2026 | CVSS 7.5 | GeoVision Inc. GV-EyeAn API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API… | |
| CVE-2026-103098 | 2 Oct 2026 | CVSS 7.5 | GeoVision Inc. GV-EyeTransmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is… | |
| CVE-2026-103096 | 2 Oct 2026 | CVSS 7.5 | GeoVision Inc. GV-EyeAPI key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API… | |
| CVE-2026-86345 | 2 Oct 2026 | CVSS 9.0 | Red Hat Directory Server 11A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS… | |
| CVE-2026-103764 | 2 Oct 2026 | CVSS 9.8 | kvcache-ai MooncakeMooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers… | |
| CVE-2026-103765 | 2 Oct 2026 | CVSS 9.4 | kvcache-ai MooncakeMooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows… | |
| CVE-2026-103766 | 2 Oct 2026 | CVSS 7.2 | MacWarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject… | |
| CVE-2025-71427 | 1 Oct 2026 | CVSS 6.8 | GongRzhe Office-PowerPoint-MCP-ServerOffice-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the… | |
| CVE-2026-103760 | 1 Oct 2026 | CVSS 5.9 | kvcache-ai MooncakeMooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the… | |
| CVE-2026-103761 | 1 Oct 2026 | CVSS 7.5 | kvcache-ai MooncakeMooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows… | |
| CVE-2026-71452 | 1 Oct 2026 | CVSS 7.2 | Johnson Controls EasyIO FS32- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63. | |
| CVE-2026-71453 | 1 Oct 2026 | CVSS 5.6 | Johnson Controls EasyIO FS32- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32… | |
| CVE-2026-71454 | 1 Oct 2026 | CVSS 5.8 | CWE-79 - Cross-site Scripting CAPEC-63Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows… | |
| CVE-2026-86344 | 1 Oct 2026 | CVSS 7.5 | Red Hat Directory Server 11A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete… | |
| CVE-2026-51895 | 1 Oct 2026 | CVSS 6.5 | VulnerabilityRagflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an… | |
| CVE-2026-51896 | 1 Oct 2026 | CVSS 6.5 | Vulnerabilityinfiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can… | |
| CVE-2026-51897 | 1 Oct 2026 | CVSS 9.8 | VulnerabilityRAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger… | |
| CVE-2026-64892 | 1 Oct 2026 | CVSS 6.3 | Johnson Controls Easy IO Neo- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue… | |
| CVE-2026-64893 | 1 Oct 2026 | CVSS 7.3 | Johnson Controls EasyIO NEO- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects… | |
| CVE-2026-71448 | 1 Oct 2026 | CVSS 5.6 | Johnson Controls EasyIO FS32: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO… | |
| CVE-2026-71449 | 1 Oct 2026 | CVSS 9.3 | Johnson Controls EasyIO FS32: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects… | |
| CVE-2026-51882 | 1 Oct 2026 | CVSS 9.1 | VulnerabilityThe OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to… | |
| CVE-2026-51883 | 1 Oct 2026 | CVSS 9.1 | VulnerabilityThe knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject… | |
| CVE-2026-51884 | 1 Oct 2026 | CVSS 9.8 | VulnerabilityThe /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting… | |
| CVE-2026-51886 | 1 Oct 2026 | CVSS 9.8 | Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Descriptionlangflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is… | Fix |
| CVE-2026-51888 | 1 Oct 2026 | CVSS 7.5 | Vulnerabilitylangflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage… | |
| CVE-2026-51892 | 1 Oct 2026 | CVSS 6.5 | Vulnerabilityinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>. | |
| CVE-2026-51893 | 1 Oct 2026 | CVSS 9.8 | Vulnerabilityinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object… | |
| CVE-2026-51894 | 1 Oct 2026 | CVSS 6.5 | Vulnerabilityinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant… | |
| CVE-2026-51873 | 1 Oct 2026 | CVSS 8.8 | VulnerabilityDevika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the… | |
| CVE-2026-51874 | 1 Oct 2026 | CVSS 7.5 | VulnerabilityIn Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside… | |
| CVE-2026-51875 | 1 Oct 2026 | CVSS 9.1 | VulnerabilityIn Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside… | |
| CVE-2026-51876 | 1 Oct 2026 | CVSS 9.1 | VulnerabilityDeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a… | |
| CVE-2026-51878 | 1 Oct 2026 | CVSS 4.3 | Vulnerabilitydeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote… | |
| CVE-2026-51879 | 1 Oct 2026 | CVSS 9.1 | Vulnerabilitydeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can… | |
| CVE-2026-51880 | 1 Oct 2026 | CVSS 9.8 | Vulnerabilitydeeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce… | |
| CVE-2026-51881 | 1 Oct 2026 | CVSS 9.8 | Vulnerabilitydeeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer… | |
| CVE-2026-18397 | 1 Oct 2026 | CVSS 9.4 | Thales SConnectThis vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses… | |
| CVE-2026-27873 | 1 Oct 2026 | CVSS 5.6 | Johnson Controls EasyIO FG- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52. | |
| CVE-2026-34493 | 1 Oct 2026 | CVSS 7.2 | Johnson Controls EasyIO FS32- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO… | |
| CVE-2026-34494 | 1 Oct 2026 | CVSS 7.2 | Johnson Controls Neo Series MVP2- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects… | |
| CVE-2026-104002 | 1 Oct 2026 | CVSS 5.3 | AWS powertools-lambda-pythonA fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field… | |
| CVE-2026-104051 | 1 Oct 2026 | CVSS 8.2 | HaschekSolutions pictsharePictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and… | |
| CVE-2026-104356 | 1 Oct 2026 | CVSS 5.9 | HaschekSolutions pictsharePictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG… | |
| CVE-2026-96780 | 1 Oct 2026 | CVSS 8.2 | figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small widthfiglet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an… | Fix |
| CVE-2026-71451 | 1 Oct 2026 | CVSS 5.6 | Johnson Controls EasyIO FS32- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63. | |
| CVE-2026-55393 | 1 Oct 2026 | CVSS 10.0 | Teledyne FLIR Aware2Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote… | |
| CVE-2026-55394 | 1 Oct 2026 | CVSS 5.3 | Teledyne FLIR Aware2Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept… | |
| CVE-2026-55395 | 1 Oct 2026 | CVSS 9.4 | Teledyne FLIR Aware2Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote… | |
| CVE-2026-55396 | 1 Oct 2026 | CVSS 8.5 | Teledyne FLIR Aware2Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through… | |
| CVE-2026-27874 | 1 Oct 2026 | CVSS 5.0 | Johnson Controls EasyIO FS32: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue… | |
| CVE-2026-104182 | 1 Oct 2026 | CVSS 6.2 | stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser… | Fix |
| CVE-2026-104183 | 1 Oct 2026 | CVSS 5.1 | stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objectsstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler… | Fix |
| CVE-2026-102514 | 1 Oct 2026 | CVSS 8.4 | PeaZipOut-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and… | |
| CVE-2026-104020 | 1 Oct 2026 | CVSS 7.5 | Amazon ion-pythonUncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using… | |
| CVE-2026-104181 | 1 Oct 2026 | CVSS 5.4 | Filament: Multi-factor authentication (app) management actions do not require password reauthenticationFilament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor… | Fix |
| CVE-2026-102370 | 1 Oct 2026 | CVSS 5.4 | TP-Link Systems Inc. Kasa EC70 V4Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader… | |
| CVE-2026-82357 | 1 Oct 2026 | CVSS 6.5 | RT-Labs AB C-OpenRT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user… | |
| CVE-2026-82358 | 1 Oct 2026 | CVSS 6.5 | RT-Labs AB C-OpenRT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails… | |
| CVE-2026-93832 | 1 Oct 2026 | CVSS 4.4 | Motorola Setup AppA component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other… | |
| CVE-2026-70650 | 1 Oct 2026 | CVSS 8.8 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an… | |
| CVE-2026-71426 | 1 Oct 2026 | CVSS 7.1 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an… | |
| CVE-2026-71542 | 1 Oct 2026 | CVSS 8.7 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior… |
Page 127 of 168